# Offensive Windows ~ Manual Enumeration ![Offensive Windows ~ Manual Enumeration](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985236561/cfc0cdc3-dbca-415e-86ec-902a75e3571c.jpeg) It's no secret that windows isn't my strong suit. I'm more of a Linux guy. So, here's my shot at getting better at offensive windows techniques! I'll be writing about a couple topics which will also double up as my notes! Here we gouu! * * * Enumeration ----------- One of the most important things to do after getting a foothold into a machine is to find out what we're going up against AKA perform enumeration. There are five main domains in this category. * System * User(s) * Network * Password * Firewall, AV & Services Once we've gotten information of all five domains, we will have a better understanding of the machine that is in question. * * * System Enumeration ------------------ This section will contain techniques that can be used to gather more information regarding the base system. systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" Returns system's type, its OS name and its OS version. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-10.png) systeminfo Returns every system information possibly stored on the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-9.png) hostname Returns system's hostname. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-11.png) wmic qfe Returns information regarding the system and the patches that it has installed. `QFE = Quick Fix Engineering` ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-12.png) wmic qfe get Caption,Description,HotFixID,InstalledOn Returns the more crucial information regarding the system and the patches that it has installed. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-13.png) wmic logicaldisk Returns all disks on the machine. `Extremely messy` ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-14.png) wmic logicaldisk get caption, description, providername Returns all disks on the machine. `Refined output` ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-15.png) * * * User(s) Enumeration ------------------- This section will contain techniques that can be used to gather more information regarding the users and their settings on the machine. whoami Returns the user that is currently logged in. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-16.png) whoami /priv Returns the privileges of the user that is currently logged in. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-17.png) whoami /groups Returns the groups that the currently logged in user belongs to. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-18.png) net user Returns all users on the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-19.png) net user Returns settings of the queried user. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-20.png) net localgroup Returns all existing groups on the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-21.png) net localgroup Returns more information pertaining to the queried group. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-22.png) * * * Network Enumeration ------------------- This section will contain techniques that can be used to gather more information regarding the network settings of the machine. ipconfig /all Returns all interface configuration of the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-23.png) arp -a Return's the ARP table of the machine. Useful for identifying other machines that have communicated before. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-24.png) route print Returns the routing table of the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-25.png) netstat -ano Returns the live network connections pertaining to the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-26.png) * * * Password Enumeration -------------------- This section will contain techniques that can be used to gather any sort of plaintext credentials that may be lying around the machine. findstr /si password *.txt Returns entries in all `.txt` files in that directory which has the word `password` in it. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-27.png) findstr /si password *.txt *.xml *.ini *.conf *.config Returns entries in all `*.txt *.xml *.ini *.conf *.config` files in that directory which has the word `password` in it. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-28.png) ### Other Methods These are other methods which stood out to me during my research on this topic. [Shoutout PATT](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md). **Files** findstr /si password *.txt findstr /si password *.xml findstr /si password *.ini #Find all those strings in config files. dir /s *pass* == *cred* == *vnc* == *.config* # Find all passwords in all files. findstr /spin "password" *.* findstr /spin "password" *. **Registry** # VNC reg query "HKCU\Software\ORL\WinVNC3\Password" # Windows autologin reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" # SNMP Paramters reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" # Putty reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" # Search for password in registry reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s * * * Firewall, AV & Service Enumeration ---------------------------------- This section will contain techniques that can be used to gather more information regarding the firewall, AV and most importantly all services running on the machine. `SC = Service Control` sc query windefend Returns information regarding windows defender on the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-29.png) sc queryex type= service Returns information regarding all the services on the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-30.png) netsh advfirewall firewall dump Returns basic firewall options. `Faulty on some machines` as u can see ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-31.png) netsh firewall show state Returns basic firewall options. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-32.png) netsh firewall show config Returns the firewall config of the machine. ![Offensive Windows ~ Manual Enumeration](/content/images/2021/03/image-33.png) * * * That's it for manual enumeration! Do feel free to [let me know](https://whois.neeranjan.com/contact/) if you feel that I missed out any other important domains in windows manual enumeration. ~Nee.