Windows Domain Privilege Escalation : Implementing PSLoggedOn in Metasploit (+ a bonus history module)

This write-up introduces a Metasploit post-exploitation module that uses the Windows NetSessionEnum API to quickly identify systems where a specified domain user (e.g., a Domain Admin) has active sessions, offering a lighter-weight alternative to tools like nmap smb-enum-sessions or PsLoggedOn. It includes step-by-step usage in MSF/meterpreter, notes a current limitation with x64 meterpreter, and provides a simple msfconsole history plugin; both tools are available on GitHub.