❎
wiki.hackerlab.cz
  • About me
  • Vulnerability Assessment
  • CLOUD PENTESTING
    • AWS
    • GCP
    • Microsoft Azure
    • Labs
  • REST API - Bypasses and Privilege Escalations
  • Python Virtual Environment (VENV)
  • OSINT & Information Gathering
  • Web Pentesting
    • JavaScript .maps
    • SSRF
    • LDAP Injection
    • Django ORM Exploitation
    • HTTP Request Smuggling
    • Server Side Template Injection (SSTI)
    • Insecure Deserialization
    • Brute force
    • Shell Fu - Oneliners
    • CORS
    • Special Chars & NULL Bytes
    • XSS
    • XXE
    • Nuclei
    • SQL Injection
    • Blind SQL Injection
    • SQLmap
    • NoSQL Injection
    • CRLF Injection
    • Input Validation - Fuzz1
    • HTTP Headers - X-Forwarded
    • Log4j
    • Enumeration with Wordlists
    • Bug Bounty - Web Recon
    • HTTP Proxy Override
    • CSV Injection
    • Windows Forbidden File Names
    • Path Traversal
    • OS Command Injection
    • Open Redirect
    • JWT Tool
    • Burp Extensions - TokenJAR & ATOR
    • Upload RCE
    • GUID and UUIDs
  • Toolset
    • Git - Repo and Tools
    • Docker for Pentesters
  • Infrastructure Pentesting
    • Active Directory (AD)
      • Vulnerable Machines (labs)
      • Pass the hash
      • Azure Active Directory
      • Password Cracking
      • Domain Enumeration
      • LLMNR Poisoning with Responder
      • HTB Forest
      • LDAP
      • WinRM
      • SMB & RPC Enumeration
      • SMB Relay
      • Impacket
      • Bloodhound
      • OWA Exchange Server 2019
      • Active Directory Web Services (ADWS)
      • Active Directory Attacks
    • Mail Server Attacks
    • NFS Enumeration
    • Windows PostExploitation
      • Windows Enumeration
      • Powershell Payloads
      • Add RDP Account & Ride on Meterpreter
    • Dump File Analysis
  • Other Pentest Projects
    • Security Projects
  • WIFI Pentesting
    • Kali Linux - Alpha card AWUS 1900 (VirtualBox)
    • Active Card & Monitor Mode
    • Aircrack-ng Suite
  • Certs
    • Burp Suite Certified Practitioner
  • Linux
    • Network Manager
  • Books
    • The Hacker Playbook 3
Powered by GitBook
On this page
  • WIN PAESS
  • Identity
  • System
  • Users and Groups
  • Net
  • Shares, Account Policy, Autostart
  • PowerShell
  • Network
  • Tasks
  • Disk and Registry

Was this helpful?

  1. Infrastructure Pentesting
  2. Windows PostExploitation

Windows Enumeration

Manual and automated scripts for windows enumeration

PreviousWindows PostExploitationNextPowershell Payloads

Last updated 1 year ago

Was this helpful?

WIN PAESS

Automatic priv esc profiling scripts

Identity

whoami
whoami /priv
whoami /groups
whoami /all

System

hostname

set

echo %COMPUTERNAME%
echo %USERNAME%
echo %USERDOMAIN%
echo %USERDNSDOMAIN%

# wmic
wmic nicconfig get description,IPAddress,MACAddress
wmic product get name, version, vendor
wmic qfe get Caption, Description, HotFixID, InstalledOn

Users and Groups

Net

net user
net user administrator
net localgroup
net localgroup administrators

Shares, Account Policy, Autostart

net share
net accounts
net start

PowerShell

# powershell
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember Administrators

Network

arp -a
ifconfig /all
route print

Tasks

tasklist

tasklist /SVC

Disk and Registry

tree /a /f

search password

REG QUERY HKLM /F "password" /t REG_SZ /S /K

PEASS-ng/winPEAS at master · carlospolop/PEASS-ngGitHub
Windows EnumerationNoRed0x
Logo
PayloadsAllTheThings/Windows - Privilege Escalation.md at master · swisskyrepo/PayloadsAllTheThingsGitHub
Checklist - Local Windows Privilege EscalationHackTricks
Logo
Logo
Logo