Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.
Be aware sometimes these commands require elevated privileges to be run, or may be blocked by GPO or other means ( for example).
Most commands that run in cmd.exe will also run in PowerShell! This gives many more options and provides flexibility at times. Some commands may not work directly though, and will need to be run through cmd.exe by prefixing the commands with cmd /c
= My favorite Windows enumeration script, automates most common enumeration methods.
User Enumeration
Get user information
$env:username Displays the current user's display name
Get-LocalUser | Select * Display usernames, password and account expiration, SID, Description, enabled status
Groups
[Security.Principal.WindowsIdentity]::GetCurrent() Not very good output by default, need to manipulate the object a bit to get the desired information
The below example is better. Will display group name and SIDs. Still not the same as whoami /all though.
Use either Get-WmiObject or Get-CimInstance to pull information about all local accounts. This can also be used remotely, and to query information about AD accounts.
Get-CimInstance -ComputerName $env:computername -Class Win32_UserAccount -Filter "LocalAccount=True" | Select PSComputername, Name, Status, Disabled, AccountType, Lockout, PasswordRequired, PasswordChangeable | Out-GridView
#Get Current or last logged in username
$CurrentUser = Get-CimInstance -ComputerName $Computer -Class Win32_ComputerSystem | Select-Object -ExpandProperty UserName
Get-WmiObject has been deprecated. Only use it if Get-CimInstance is not available due to outdated PowerShell version or problems with Windows Remoting. In most cases the two command names should be replaceable with no issues.
Can be run on remote machines by substituting $env:computername with the computer name of the remote machine. This returns a large amount of useful information on all users.
There is a property called Password, though this did not return anything on my Microsoft Account-enabled machine. Will have to try this on a domain or local account.
whoami /all Includes: Username, SID, Groups (including their descriptions!), and user privileges.
echo %username% Displays the current username
net user $username Displays account and password expiration information, Logon script, User profile, Home directory, and group membership
Gets display name, description, lockout status, password requirements, login name and domain, and SID.
If run on a domain connected machine dumps all accounts on the whole domain! On a non-domain joined machine lists all local users. Includes Service Accounts.
Enumeration without Active Directory module installed
# current domain info
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
# domain trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
# current forest info
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
# get forest trust relationships
([System.DirectoryServices.ActiveDirectory.Forest]::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'forest-of-interest.local')))).GetAllTrustRelationships()
# list all DCs of a domain
nltest /dclist:test.local
net group "domain controllers" /domain
# get DC for currently authenticated session
nltest /dsgetdc:test.local
# get domain trusts from cmd shell
nltest /domain_trusts
# get user info
nltest /user:"Administrator"
# get DC for currently authenticated session
set l
# get domain name and DC the user authenticated to
klist
# get all logon sessions. Includes NTLM authenticated sessions
klist sessions
# kerberos tickets for the session
klist
# cached krbtgt
klist tgt
Using WMI Query Language (WQL)
WQL is an entire subject on its own. If you want to know the full extent of the capabilities of this powerful query language, type Get-Help WQL in a PowerShell prompt. Below are a few examples of queries to pull lists of users from both local machines and from the domain.
# The following WQL query returns only local user accounts.
$q = "Select * from Win32_UserAccount where LocalAccount = True"
Get-CimInstance -Query $q
# To find domain accounts, use a value of False, as shown in the following example.
$q = "Select * from Win32_UserAccount where LocalAccount = False"
Get-CimInstance -Query $q
WQL uses the backslash (\) as its escape character. This is different from Windows PowerShell, which uses the backtick character (`).
LAPS
LAPS allows you to manage the local Administrator password (which is randomized, unique, and changed regularly) on domain-joined computers. These passwords are centrally stored in Active Directory and restricted to authorized users using ACLs. Passwords are protected in transit from the client to the server using Kerberos v5 and AES.
When using LAPS, two new attributes appear in the computer objects of the domain: ms-msc-AdmPwd and ms-mcs-AdmPwdExpirationTime. These attributes contains the plain-text admin password and the expiration time. In a domain environment, it could be interesting to check which users can read these attributes.
Find Administrator Accounts
TODO: Add more examples
Many administrators set their account passwords to never expire, so searching for these can be valuable. Also, this means the password may have been set a long time ago.
function Get-AntivirusName {
#Enable -Verbose output, piping of input from other comdlets, and more
[CmdletBinding()]
#List of input parameters
Param
(
#List of ComputerNames to process
[Parameter(ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true)]
[ValidateNotNullOrEmpty()]
[alias('Name')] #Allows for piping in of computers by name from Active Directory (Get-ADComputer)
[string[]]
$ComputerName = "$env:computername",
$Credential
)
Begin
{
$wmiQuery = "SELECT * FROM AntiVirusProduct"
}
Process
{
$AntivirusProduct = Get-CimInstance -Namespace "root\SecurityCenter2" -Query $wmiQuery @psboundparameters
[array]$AntivirusNames = $AntivirusProduct.displayName
foreach ($av in $AntivirusNames)
{
Out-Host "The installed antivirus products are:"
Out-Host $av
}
}
}
Get-AntivirusName
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get DisplayName
Windows Firewall
Check the status of the Windows Firewall
Get-NetFirewallProfile -All
Use the -Name Public property (instead of -All) to select a specific firewall profile. Pipe the results to | Get-NetFirewallRule to see the currently configured rules.
sc query windefend
netsh advfirewall firewall dump
netsh advfirewall show currentprofile
netsh advfirewall firewall show rule name=all
netsh firewall show state
netsh firewall show config
# Disable firewall
netsh firewall set opmode disable
The below PowerShell script will return a more complete list of all software installed by querying SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall on a list of computer names. It displays the following information:
Computer Name,
Software Name,
Version,
Publisher
function Get-SoftwareInventory
{
#Enable -Verbose output, piping of input from other comdlets, and more
[CmdletBinding()]
#List of input parameters
Param
(
#List of ComputerNames to process
[Parameter(ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true)]
[ValidateNotNullOrEmpty()]
[alias('Name')] #Allows for piping in of computers by name from Active Directory (Get-ADComputer)
[string[]]
$ComputerName
)
Begin
{
$SoftwareArray = @()
}
Process
{
#Variable to hold the location of Currently Installed Programs
$SoftwareRegKey = ”SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall”
#Create an instance of the Registry Object and open the HKLM base key
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey(‘LocalMachine’,$ComputerName)
#Open the Uninstall subkey using the OpenSubKey Method
$RegKey = $Reg.OpenSubKey($SoftwareRegKey)
#Create a string array containing all the subkey names
[String[]]$SubKeys = $RegKey.GetSubKeyNames()
#Open each Subkey and use its GetValue method to return the required values
foreach($key in $SubKeys)
{
$UninstallKey = $SoftwareRegKey + ”\\” + $key
$UninstallSubKey = $reg.OpenSubKey($UninstallKey)
$obj = [PSCustomObject]@{
Computer_Name = $ComputerName
DisplayName = $($UninstallSubKey.GetValue(“DisplayName”))
DisplayVersion = $($UninstallSubKey.GetValue(“DisplayVersion”))
InstallLocation = $($UninstallSubKey.GetValue(“InstallLocation”))
Publisher = $($UninstallSubKey.GetValue(“Publisher”))
}
$SoftwareArray += $obj
}
}
End
{
$SoftwareArray | Where-Object { $_.DisplayName } | Select-Object ComputerName, DisplayName, DisplayVersion, Publisher | Format-Table -AutoSize
}
}
Get-SoftwareInventory
dir /a "C:\Program Files"
dir /a "C:\Program Files (x86)"
reg query HKEY_LOCAL_MACHINE\SOFTWARE
WMIC
wmic product get name /value
Uninstall Software
$Program = Read-Host "[Type the program to uninstall here]:"
$MyProgram = Get-CimInstance -Class Win32_Product | Where-Object {$_.Name -eq “$Program”}
$MyProgram.uninstall()
If Get-CimInstance is not able to find your software, you can try this instead:
To get PowerShell to display all the programs in the Control Panel, use an asterisk in place of the Name parameter.
This command only uninstalls the latest version of a program. If you’ve installed multiple versions use the -RequiredVersion 2.0 property of Get-Package to specify the version to uninstall.
wmic product where name="$program" call uninstall /INTERACTIVE:OFF
Services
Get a list of services:
Get-Service
Get a list of services:
net start
wmic service list brief
sc query
Get detailed information for a specific service
sc qc $service_name
To use this command in PowerShell you need to specify sc.exe instead of sc. In PowerShell sc is an alias for Set-Content and will not give the expected output.
Enable a disabled service
If you are having this error (for example with SSDPSRV):
System error 1058 has occurred. The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. You can enable it using:
Note: In Windows XP SP1, the service upnphost depends on SSDPSRV to work
Unquoted service paths
Unquoted service paths are paths to services that contain a space in them, that are not surrounded by quotes. These paths can be hijacked to run arbitrary code if the break in the path is a writeable location.
To get connection information for a specific port use the -LocalPort $port attribute.
Since this cmdlet returns objects, you can use these objects to return other information, such as getting the process ID associated with each connection:
To show listening ports filter for the address 0.0.0.0:
Get-NetUDPEndpoint | Where {$_.LocalAddress -eq "0.0.0.0"}
Use the -CimSession $CimSession Parameter to run this on a remote computer after creating a New-CimSession.
netstat -ano
PowerShell netstat implementation
Shows TCP and UDP connections, with the following properties: Local Address, Local Port, Remote Address, Remote Port, Connection State, Process Name, and PID
TODO: Make this fully PowerShell implemented, without netstat
For a comprehensive list of auto-executed files you can use AutoRuns from SysInternals
To run this from a command prompt without popup windows:
autorunsc.exe -m -nobanner -a * -ct /accepteula
SMB/Samba
Port 139 and 445
Server Message Block is a service that enables the user to share files with other machines. May be able to browse files without having credentials (Null Session).
This can show all connected hard drives, not only network fileshares
Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root
Listing all PSDrives can also give you valuable information, showing how to access environment variables, certificates, registry keys, temp folders, and more.
Check for SMB vulnerabilities:
nmap --script=smb-check-vulns.nse $ip -p 445
SMB nmap scripts to enumerate shares and OS discovery
@rewardone in the PWK forums posted a script to gather Samba versions:
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 7 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
sleep 0.5 && echo ""
To get Windows SMB information open the pcap in Wireshark and filter on ntlmssp.ntlmv2_response
SNMP
SNMP is based on UDP, a simple, stateless protocol, and is therefore susceptible to IP spoofing, and replay attacks. In addition, the commonly used SNMP protocols 1, 2, and 2c offer no traffic encryption, meaning SNMP information and credentials can be easily intercepted over a local network.
MIB Tree (Management Information Base)
(MIB) is a database containing information usually related to network management.
The database is organized like a tree, where branches represent different organizations or network functions. The leaves of the tree (final endpoints) correspond to specific variable values that can then be accessed, and probed, by an external user.
You can use a tool such as onesixtyone, which will check for given community strings against an IP list, allowing you to brute force various community strings from a list.
echo public > community
echo private >> community
echo manager >> community
for ip in $(seq 1 254);do echo 10.10.10.$ip;done > ips
onesixtyone -c community -i ips
We can probe and query SNMP values using a tool such as snmpwalk once you know the SNMP read-only community string (which in most cases is “public”).
# Enumerating the Entire MIB Tree
snmpwalk -c public -v1 $ip
# Enumerating Windows Users:
snmpwalk -c public -v1 $ip 1.3.6.1.4.1.77.1.2.25
# Enumerating Running Windows Processes:
snmpwalk -c public -v1 $ip 1.3.6.1.2.1.25.4.2.1.2
# Enumerating Open TCP Ports:
snmpwalk -c public -v1 $ip 1.3.6.1.2.1.6.13.1.3
# Enumerating Installed Software:
snmpwalk -c public -v1 $ip 1.3.6.1.2.1.25.6.3.1.2
The notation 1.3.6.1.2.1.25.6.3.1.2 is the MIB, which is the shorthand SNMP uses to perform queries.
You can also use snmpenum and snmpcheck to gather information.
snmpcheck -t 10.10.10.1 -c public
snmpenum -t 10.10.10.1
TODO: Everything below from the above site...in the process of verification, cleanup, and assimilation.
Windows one line commands that make life easier, shortcuts and command line fu.
Get entries from IPv4 neighbor cache
C:\>netsh interface ipv4 show neighbors
Get available wireless networks via cmd and netsh
C:\>netsh wlan show networks mode=b
Quick list IP addresses only
Save the following in ip.bat in %PATH%
C:\>ipconfig | find /I "pv"
Call ip from CLI
List ALL services AND their binaries
for /F "tokens=2* delims= " %i in ('sc query ^| find /I "ce_name"') do @sc qc %i %j
Port forward (proxy) traffic to remote host and port
C:\> netsh int p add v4tov4 <LPORT> <RHOST> [RPORT] [LHOST]
Enable/Disable NetBIOS over TCP/IP
Step 1. Get Index of Network Adapter:
C:\> wmic nicconfig get caption,index
Step 2. Use the index
C:\> wmic nicconfig where index=1 call SetTcpipNetbios 1
0-Def
1-En
2-Dis
Compact multiple VDI files across folders
C:\> for /F %i in ('dir /b /s *.vdi ^| find ".vdi"') do vboxmanage modifyhd --compact %i
Full scan using WinDefender
C:\>"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -scan -scantype 2
Use #wmic /node:@ips process for multiple.
First, you have to know the SSID of the access point (AP) to get the password from
netsh wlan show profiles
Next, get the cleartext password:
netsh wlan show profile $SSID key=clear
Gather hostnames of machines on a network
#!/bin/bash
##Author : Paranoid Ninja
##Email : paranoidninja@protonmail.com
#GitHub : https://github.com/paranoidninja/alpha-stage-scripts/blob/master/dns_lookup_ad.sh
##Descr : A Script to gather hostnames of machines within a domain
i="0"
while [ $i -lt "255" ]
do nslookup 10.11.1.$i 10.11.1.220 | grep -v "NXDOMAIN" | grep name | cut -f1,3 -d" "
i=$[ $i+1 ]
done
Winpeas
winpeas.exe cmd searchall searchfast #cmd commands, search all filenames and avoid sleeping (noisy - CTFs)
winpeas.exe #Will execute all checks except the ones that use a CMD
winpeas.exe cmd #All checks
winpeas.exe systeminfo userinfo #Only systeminfo and userinfo checks executed
winpeas.exe notcolor #Do not color the output
winpeas.exe cmd wait #cmd commands and wait between tests
In Linux the ouput will be colored using ANSI colors. If you are executing winpeas.exe from a Windows console, you need to set a registry value to see the colors (and open a new CMD): REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1
References
(TODO:check for more network enumeration info here)
/
Windows CLI gems. Tweets of
If you like this content and would like to see more, please consider !
