Post Exploitation - Windows

Two types of privilege escalation:

• Vertical
• Horizontal

Information Gathering

Find out OS Name and Version:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

ver

Hostname:

hostname

Username:

whoami

echo %username

Check user privilege (check if belong to admin group):

net user [user]

Network:

ipconfig /all

Searching for Password in Configuration files

Clear-text passwords

c:\unattend.txt

c:\sysprep.ini - [Clear Text]

c:\sysprep\sysprep.xml - [Base64]

The command below will search the file system for file names containing certain keywords

dir /s *pass* == *cred* == *vnc* == *.config*

Search certain file types for a keyword, this can generate a lot of output.

findstr /si password *.xml *.ini *.txt

Similarly the two commands below can be used to grep the registry for keywords, in this case "password".

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

Discovery of Missing Patches

By CMD

wmic qfe get Caption,Description,HotFixID,InstalledOn

wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3136041" /C:"KB4018483"

By Metasploit

use post/windows/gather/enum_patches

By PowerShell (Sherlock)

PS C:\Users\User > Find-AllVulns

Tools

PowerUp

Privilege Escalation Table (Due to lack of sufficient patching)

Privilege Escalation Exploit