> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/initial-enumeration.md). # Initial Enumeration ### System Enumeration ``` systeminfo ```

``` systeminfo | findstr /b /c:"OS Name" /c:"OS Version" /c:"System Type" ```

#### Enumerating Quick Fixes ``` wmic qfe ```

``` wmic qfe get Caption,Description,HotFixID,InstalledOn ```

#### Enumerate Drives ``` wmic logicaldisk ``` ``` wmic logicaldisk get caption,description,providername ```

### User Enumeration ``` whoami ```

#### Current User Privileges ``` whoami /priv ```

#### Current User Groups ``` whoami /groups ```

#### Users on Current Machine ``` net user ```

#### Details about a single user including group memberships ``` net user Administrator ```

#### Enumerate Groups ``` net localgroup ```

#### Check the members of a group ``` net localgroup administrators ```

### Network Enumeration ``` ipconfig /all ``` #### Check arp table ``` arp -a ```

#### Check Routing Table ``` route print ```

#### Check Open Ports ``` netstat -ano ```

### AV and Firewall Enumeration ``` sc query windefend ```

#### List all services ``` sc queryex type= service ``` This lists all active services on the machine, including their process IDs (PIDs) and status. We can manually check if some antivirus is running on target. #### Firewall Enumeration ``` netsh advfirewall firewall dump ``` Displays or "dumps" the entire current configuration and rule set of the Windows Defender Firewall. If it does not work use the older command. ``` netsh firewall show state ``` * `netsh`: A command-line utility that allows you to display or modify the network configuration of a computer that is currently running. * `firewall`: Enters the context for managing the Windows Firewall. * `show state`: Specifically requests the current operational status of the firewall.

``` netsh firewall show config ```

### Cleartext Passwords #### Search for them ``` findstr /si password *.txt findstr /si password *.xml findstr /si password *.ini #Find all those strings in config files. dir /s *pass* == *cred* == *vnc* == *.config* # Find all passwords in all files. findstr /spin "password" *.* findstr /spin "password" *.* ``` #### In Files These are common files to find them in. They might be base64-encoded. So look out for that. ``` c:\sysprep.inf c:\sysprep\sysprep.xml c:\unattend.xml %WINDIR%\Panther\Unattend\Unattended.xml %WINDIR%\Panther\Unattended.xml dir c:\*vnc.ini /s /b dir c:\*ultravnc.ini /s /b dir c:\ /s /b | findstr /si *vnc.ini ``` #### In Registry ``` # VNC reg query "HKCU\Software\ORL\WinVNC3\Password" # Windows autologin reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" # SNMP Paramters reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" # Putty reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" # Search for password in registry reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s ``` ### Service only available from inside Sometimes there are services that are only accessible from inside the network. For example a MySQL server might not be accessible from the outside, for security reasons. It is also common to have different administration applications that is only accessible from inside the network/machine. Like a printer interface, or something like that. These services might be more vulnerable since they are not meant to be seen from the outside. ``` netstat -ano ``` Example output: ``` Proto Local address Remote address State User Inode PID/Program name ----- ------------- -------------- ----- ---- ----- ---------------- tcp 0.0.0.0:21 0.0.0.0:* LISTEN 0 0 - tcp 0.0.0.0:5900 0.0.0.0:* LISTEN 0 0 - tcp 0.0.0.0:6532 0.0.0.0:* LISTEN 0 0 - tcp 192.168.1.9:139 0.0.0.0:* LISTEN 0 0 - tcp 192.168.1.9:139 192.168.1.9:32874 TIME_WAIT 0 0 - tcp 192.168.1.9:445 192.168.1.9:40648 ESTABLISHED 0 0 - tcp 192.168.1.9:1166 192.168.1.9:139 TIME_WAIT 0 0 - tcp 192.168.1.9:27900 0.0.0.0:* LISTEN 0 0 - tcp 127.0.0.1:445 127.0.0.1:1159 ESTABLISHED 0 0 - tcp 127.0.0.1:27900 0.0.0.0:* LISTEN 0 0 - udp 0.0.0.0:135 0.0.0.0:* 0 0 - udp 192.168.1.9:500 0.0.0.0:* 0 0 - ``` Look for **LISTENING/LISTEN**. Compare that to the scan you did from the outside.\ Does it contain any ports that are not accessible from the outside? If that is the case, maybe you can make a remote forward to access it. ``` # Port forward using plink plink.exe -l root -pw mysecretpassword 192.168.0.101 -R 8080:127.0.0.1:8080 # Port forward using meterpreter portfwd add -l -p -r portfwd add -l 3306 -p 3306 -r 192.168.1.101 ``` So how should we interpret the netstat output? **Local address 0.0.0.0**\ Local address 0.0.0.0 means that the service is listening on all interfaces. This means that it can receive a connection from the network card, from the loopback interface or any other interface. This means that anyone can connect to it. **Local address 127.0.0.1**\ Local address 127.0.0.1 means that the service is only listening for connection from the your PC. Not from the internet or anywhere else. **This is interesting to us!** **Local address 192.168.1.9**\ Local address 192.168.1.9 means that the service is only listening for connections from the local network. So someone in the local network can connect to it, but not someone from the internet. **This is also interesting to us!**