Escalating your pivot – passing attacks down the line

Let me paint a scenario for you. From inside the restricted network you were able to plug into, you’ve just established your foothold on a Windows 7 Enterprise machine with a NIC facing an internal 192.168.249.0/24 network. You can’t see this network from your position, so using your Meterpreter session, you establish routing via your Windows 7 pivot point. After some further reconnaissance, you determine that 192.168.249.128 is running an FTP service. However, you can’t connect to it from your pivot point. After watching the LAN, you notice traffic passing between 192.168.249.128 and 192.168.249.130, so you suspect a trust relationship between those two hosts. You also see the Windows user Phil frequently, so it could be an administrator’s account that is used on different machines or a shared local account for the purposes of setting up these hosts.

I already tried to pivot to 192.168...