> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/infra-pentesting/windows-postexploitation/windows-enumeration.md).

# Windows Enumeration

## WIN PAESS

Automatic priv esc profiling scripts

{% embed url="<https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS>" %}

## Identity

```powershell
whoami
whoami /priv
whoami /groups
whoami /all
```

## System

<pre class="language-powershell"><code class="lang-powershell">hostname

set

<strong>echo %COMPUTERNAME%
</strong>echo %USERNAME%
echo %USERDOMAIN%
echo %USERDNSDOMAIN%

# wmic
wmic nicconfig get description,IPAddress,MACAddress
wmic product get name, version, vendor
wmic qfe get Caption, Description, HotFixID, InstalledOn
</code></pre>

## Users and Groups

### Net

```shell
net user
net user administrator
net localgroup
net localgroup administrators
```

### Shares, Account Policy, Autostart

```
net share
net accounts
net start
```

### PowerShell

```powershell
# powershell
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember Administrators
```

## Network

```
arp -a
ifconfig /all
route print
```

## Tasks

```
tasklist

tasklist /SVC
```

## Disk and Registry

```
tree /a /f

search password

REG QUERY HKLM /F "password" /t REG_SZ /S /K
```

{% embed url="<https://nored0x.github.io/red-teaming/windows-enumeration/>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md>" %}

{% embed url="<https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation>" %}