Environment Enumeration via Pshell & Cmd

During pentest processes gathering information about systems are very essential. Here is the few commands that i personally use frequently due to gathering information about Microsoft Architectures;

Notice That: You can get more information about commands that we will use in this article by typing help commandname or commandname \?

Information Gathering About Local System

For detecting Network adapters, IP adresses, DNS server:

C:\Users\Hyaloid>ipconfig /all

        --code snippet--
   IPv4 Address. . . . . . . . . . . : 10.0.0.43
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.10.100
   DNS Servers . . . . . . . . . . . : 10.0.0.1
        --code snippet--

Gathering information about open ports(detecting services which only runs in local):

C:\Users\Hyaloid>netstat -anot

 Proto  Local Address          Foreign Address        State           PID      Offload State

  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       536      InHost
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4        InHost
  TCP    0.0.0.0:902            0.0.0.0:0              LISTENING       3800     InHost
  TCP    0.0.0.0:912            0.0.0.0:0              LISTENING       3800     InHost
  TCP    0.0.0.0:1536           0.0.0.0:0              LISTENING       680      InHost
  TCP    0.0.0.0:1537           0.0.0.0:0              LISTENING       1272     InHost
  TCP    0.0.0.0:1538           0.0.0.0:0              LISTENING       1784     InHost
  TCP    0.0.0.0:1539           0.0.0.0:0              LISTENING       760      InHost
  TCP    0.0.0.0:1540           0.0.0.0:0              LISTENING       3216     InHost
                --code snippet--

Gathering information about tasks & killing tasks(if you have enough privilege to do);

Gathering information about system (OS Name, Version, Type, Installed Hotfixes etc.):

Gathering scheduled tasks & creating scheduled tasks (you must be administrator):

Finding, adding, deleting users and groups & gathering information about spesific user and group:

Information gathering about services:

Starting, stopping, deleting and editing services:

Checking file permissions:

Playing with firewall configutions:

Downloading files to target system via powershell:

Downloading and executing .ps1 files via powershell (you can use this to execute malicious powershell files on target):

Microsoft Domain Structer Enumeration

In order to gather information about Domain structers, i personally use an excellent and simple tool called windapsearch. Its uses LDAP queries to extract information about users, groups and computers.

Here is an example taken from its README file;

And also a few metasploit modules that you can use to gather information about domain;

Of course this techniques are not all of techniques that pentesters may use in order to gather information but at least i can say that im using these techniques for sure.

PreviousVBA: HTTP File DropperNextReverse Shell Exploit chain With AV Bypass

Last updated

Was this helpful?