Basic Windows Privilege Escalation
As I have been working through my OSCP course I have had to reference several cheat sheets and blog posts for windows enumeration, and while its not a major inconvenience, I figured I would put what I already knew and what I have found in one location for everyone's benefit. This list is by no means complete and I will update it as I come across more information and from what is contributed in the comments. Note: this is heavily influenced by g0tmilk's Linux Privilege Escalation post, so the overall layout credit goes to him.
What version of windows is running? Is it 32 or 64-bit?
ver systeminfo more c:\boot.ini wmic os get osarchitecture
set computername hostname
What drives are there? Are any being shared?
wmic logicaldisk get caption,description,providername net share wmic share net use
What can the OS variables tell you?
more C:\WINDOWS\System32\drivers\etc\hosts more C:\WINDOWS\System32\drivers\etc\networks more C:\Users\username\AppData\Local\Temp path echo %path% set tree (massive output) wmic context wmic bootconfig wmic environment wmic loadorder wmic startup
What patches are installed?
What services are installed/running?
wmic service net start sc query
What is the current network config? What is this machine talking to?
ipconfig /allcompartments /all getmac wmic nicconfig get description,IPAddress,MACaddress route PRINT netstat -ano arp -a nbtstat wmic nicconfig get macaddress,caption
What is the firewall configuration?
netsh dump netsh firewall show state netsh firewall show config netsh advfirewall firewall show rule name=all netsh advfirewall export "firewallinfo.txt"
Is the machine on a domain?
set userdomain net view /domain
What software is currently running? What is installed?
tasklist tasklist /svc tasklist /fi “pid eq PID” tasklist /fi “username eq USERNAME” qprocess driverquery /v assoc wmic sysdriver wmic product
Who is logged in? Who is an administrator? Who belongs to what group/domain?
set username whoami echo %username% net users wmic group net localgroup net localgroup administrators qusers qwinsta wmic useraccount
What is in the registry?
reg query reg query "HKLM\Software\Microsoft\Windows NT\Currentversion\Winlogon" /v LastUsedUsername
What is installed in this PC?
wmic bios wmic baseboard get manufacturer wmic cdrom wmic cpu list full wmic csproduct