Host Recon

For automated enumeration of potential PE vectors see here.

Get Help

CMD

# List available commands
help

# Help for a specified command
help <command>
<command> /?

PS

Networking

All the below commands work with both CMD and Powershell.

Network Info

General networking information, such as interfaces, IP addresses, and DNS:

ipconfig /all

ARP Table

Active Connections

Routes

Ports

Test-NetConnection -ComputerName 192.168.210.12 -Port 5985

Hosts

System

General

# General system information
systeminfo

# Name of the host
hostname

# Operating system version
[environment]::OSVersion.Version
ver
echo %OS%

# Environment variables
dir env:
set

# Diplay the value of a specific variable
set %PATH%
echo %PATH%

# Named pipes
gci \\.\pipe\

# Clipboard
Get-Clipboard

Applications

Processes

Services

Other

Users & Groups

Users

# Domain/username (domain-joined) or NetBIOS/username (non domain-joined)
whoami # can be used to infer the purpose and type of the machine

# List current user's privileges
whoami /priv

# List current user's information
whoami /all

# List local users (net.exe only lists user objects, not group objects, so it can miss nested group memberships)
net user /domain
Get-LocalUser

# Query about the specified user
net user robert /domain

# List active (logged-on) users (works only on Windows Servers)
query user

Groups

Shared Resources

All the below commands work with both CMD and Powershell.

# List resources
net share

Protections

Windows Defender

Check WD's status with PS:

Get-MpComputerStatus

Check WD's status with CMD:

sc query windefend

AppLocker

HotFixes

Files

PowerShell (PS) uses different host types depending on how it's being accessed, so the (Get-PSReadlineOption).HistorySavePath command will point to different files.

1. If the PS process is spawed as local (e.g. via SSH or RDP) → ConsoleHost_history.txt

2. If the PS process is spawned as remote (e.g. WinRM) → ServerRemoteHost_history.txt

PowerShell

# List all (including) hidden files
Get-ChildItem -Force
# All dirs and files
GCI C:\Users\User -Force 
# Only hidden files
GCI C:\Users\User\ -Hidden

# Search for a specific file
Get-ChildItem -Path C:\ -Filter local.txt -Recurse -ErrorAction SilentlyContinue -Force

# Config files, temp saves
GCI C:\Users\User\AppData

# Check PS's host type
$Host.Name
# PS history of the current user
(Get-PSReadlineOption).HistorySavePath

# PS history file of another user
Get-Content C:\Users\<user>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# History files of all host's users (assuming default path)
foreach($user in ((ls C:\users).fullname)){cat "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue}

# Documents in the user's home directory
Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

CMD

Interesting Files

Permissions

DPAPI

Writable Directories

C:\Windows\System32\spool\drivers\color
C:\Windows\Tasks
C:\Users\Public # similar to \Temp but more stealthy
C:\Windows\Temp # all users have rwx
C:\Users\<user>\AppData\Local\Temp # similar to above, but user-only
C:\windows\tracing
C:\Windows\Registration\CRMLog
C:\Windows\System32\FxsTmp
C:\Windows\System32\com\dmp
C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
C:\Windows\System32\spool\PRINTERS
C:\Windows\System32\spool\SERVERS
C:\Windows\System32\Tasks\Microsoft\Windows\SyncCenter
C:\Windows\System32\Tasks_Migrated
C:\Windows\SysWOW64\FxsTmp
C:\Windows\SysWOW64\com\dmp
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System

Test access:

# Move into the target directory
cd C:\Windows\Temp
# Create a file
echo "test" > test
# List the file's contents
type test

Use another user's credentials

# Create a PSCredential object
$pass = ConvertTo-SecureString '<password>' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential('<domain\user', $pass)

# Add the target user to the group with PowerView
Add-DomainGroupMember -Identity '<group>' -Members '<user>' -Credential $creds

# Confirm
Get-DomainUser <user> -Credential $cred

# Execute remote commands on another host
Invoke-Command -Computer DC -Credential $cred -ScriptBlock { whoami; hostname }

Binaries

We can transfer the binary in a Unix-based attacking host and run strings on it:

# strings with 16-bit encoding for Windows binaries
strings -eb <FILE> | grep pass