manual host enumeration

Mixed Windows and Linux commands

It should be pretty easier to distinguish between them though (e.g. you know it’s Windows when it uses net or .exe).

• User enumeration:
  • whoami /all (windows), whoami (any)
  • net user, net accounts (windows, list of users and account policy)
  • id
  • hostname (any)
  • cat /etc/passwd /etc/shadow /etc/group
  • query user
• OS info
  • systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
  • cat /etc/issue /etc/*-release
  • uname -a
• Processes, Services, and Scheduled Tasks
  • tasklist /SVC
  • schtasks /query /fo LIST /v
  • Query installed services: sc query, Get-Service | fl, or services.msc (GUI)
  • ps aux
  • pspy (need to upload)
  • ls /etc/cron.* /var/spool/cron/crontabs/*
  • cat /etc/*crontab
  • systemctl list-unit-files --state=enabled
  • services
• Network Information
  • ipconfig /all
  • route print (windows)
  • ip a[ddr]
  • netstat -ano (windows)
  • /sbin/route or /sbin/routel
  • netstat -anp or ss -anp (linux)
  • netsh advfirewall show currentprofile to check firewall state
  • netsh advfirewall firewall show rule name=all to show firewall rules
  • ls /etc/iptables/
  • Look for iptables-save and iptables-restore in processes
• Installed Applications & Updates
  • wmic product get name, version, vendor (applies only to Windows installers)
  • wmic qfe get Caption, Description, HotFixID, InstalledOn
  • dpkg -l
• Drivers, Kernel Modules
  • driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object 'Display Name', 'Start Mode', Path
  • Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DriverVersion, Manufacturer | Where-Object {$_.DeviceName -like "*VMware*"}
  • lsmod, /sbin/modinfo <libname>
  • reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer (if AlwaysInstallElevated, craft MSI installer with payload)
  • find / -perm -u=s -type f 2>/dev/null (SUID binaries)
• Filesystem Enumeration, e.g. Weak permissions (R/W)
  • accesschk.exe -uws "Everyone" "C:\Program Files" (download from SysInternals)
  • Get-ChildItem "C:\Program Files" -Recurse | Get-ACL | ?{$_.AccessToString -match "Everyone\sAllow\s\sModify"}
  • find / -writable -type d 2>/dev/null
  • mountvol (windows)
  • cat /etc/fstab, mount, lsblk