HomeGitHubPortfolioTwitter/XMediumCont@ct

Windows Enumeration

Enumeration

System Information

  1. Basic System Info

    • hostname Displays the hostname of the current machine.

    • qwinsta Lists users connected to the machine along with session details. Similar to Linux's w or who.

    • query user Shows details about active sessions.

  2. Detailed System Information

    • systeminfo Retrieves comprehensive system details.

      Filter specific details:

      systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

    • Using PowerShell:

      [System.Environment]::OSVersion.Version

  3. Patch and Update Information

    • CMD:

      • wmic qfe get Caption, Description, HotFixID, InstalledOn (List installed patches)

      • wmic qfe list brief (Quick overview of updates)

      • wmic product get name (List installed programs)

    • PowerShell:

      • Get-HotFix | ft -AutoSize (List installed patches)

      • Get-WmiObject -Class Win32_Product | select Name, Version (Installed programs)

  4. Running Processes

    • CMD:

      tasklist /svc

      Lists all running processes and associated services.

Domain Status

  • PowerShell:

    (Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain

    Returns True if the machine is part of a domain.

PowerShell and AppLocker Policies

  1. PowerShell Execution Policy

    Get-ExecutionPolicy -List

  2. AppLocker Policy Rules

    Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

  3. Testing AppLocker Policies

    Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone

  4. PowerShell History Retrieve the PowerShell command history for a specific user:

    Get-Content C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt

Environment Variables

  1. CMD:

    set

  2. PowerShell:

    Get-ChildItem Env: | ft Key,Value

Windows Defender

  1. Firewall and Antivirus Status (CMD):

    • View firewall profiles:

      netsh advfirewall show allprofiles

    • Check Windows Defender status:

      sc query windefend

  2. Windows Defender Status (PowerShell):

    Get-MpComputerStatus

Users

  1. Current User Details:

    • whoami /all

    • whoami /priv

    • whoami /groups

  2. Local Users (CMD):

    • List all users: net users

    • Get user details: net user <USER>

    • Current user's details: net user %username%

    • Password policy:

      net accounts
net accounts /domain

  3. Create a New User:

    net user /add <USERNAME> <PASSWORD>

  4. User Domain and SID Information:

    • Show domain:

      echo "%USERDOMAIN%"

    • Check login server:

      echo %logonserver%

    • Display domain, name, and SID:

      wmic USERACCOUNT Get Domain,Name,Sid

Groups

  1. Local Groups:

    • List all groups: net localgroup

    • Group details: net localgroup Administrators

    • Add a user to administrators:

      net localgroup administrators <USERNAME> /add

  2. Domain Groups:

    • Info about domain groups: net group /domain

    • List users in a group: net group /domain <DOMAIN_GROUP_NAME>

    • List connected computers:

      net group "Domain Computers" /domain

    • Domain controllers:

      net group "Domain Controllers" /domain

Network Enumeration

  1. Basic Networking Information:

    • ifconfig

    • ipconfig /all

  2. Routing and Firewall Status:

    • Routing table: route print

    • ARP table: arp -a

    • Open ports and connections: netstat -ano

    • Firewall state:

      netsh advfirewall show state

Shared Resources

  1. Common Shares:

    • C$: Administrative share for C:/.

    • ADMIN$: Assigned to C:/Windows.

    • IPC$: Used for interprocess communication (RPC).

    • SYSVOL: Only on Domain Controllers (DCs).

    • NETLOGON: Available on DCs for logon scripts and policies.

  2. Commands:

    • List SMB shares:

      Get-SMBShare
net share

    • Mount a share:

      net use z: \\172.16.0.1\C$ /user:elliot "P@ssword123!"

    • Unmount a share:

      net use /delete z:

    • View shared resources on a host:

      net view \\172.16.0.1 /all

References

PreviousAD EnumerationNextLinux Enumeration

Last updated