I recently got inspired by a neat trick by @flodari where he managed to carry out a RBCD LPE on a Windows machine with just some regular domain creds.

There is nothing new in these techniques but I hadn't seen the idea before so I decided to see if it could also be done via a C2 1st part of the attack is to open a socks proxy on port 1080 using CStrike on the compromised workstation (Elish) to allow us to tunnel our Kali tools through it.
Then reverse port fwd 8888 to 80 on our localhost. This will catch any auth on 8888 & pass it to ntlmrelayx on 80