In net user script, the attacker writes the following two-line script (obviously the word localaccountname is replaced with an actual local account name.):
5/30
In net user script, the attacker writes the following two-line script (obviously the word localaccountname is replaced with an actual local account name.):
net user /domain /block localaccountname password / net group /domain "Domain Admins" /add Domain
net user /domain /add localaccountname password/ net group /domain "Domain Admins" /add Domain
net admin /domain /add localaccountname password/ net group /domain "Domain Admins" /add Domain