Enumerate Windows Environments

author: Nathan Acks
date: 2022-08-17

net

Windows’ net command is can also be used to manipulate user and group information (if you already have admin/SYSTEM permission)! For example:

# Change a user's password
#
net user $USERNAME $PASSWORD

# Add a user to a domain
#
net user $USERNAME /add /domain

# Make a user a domain admin
#
net group "Domain Admins" $USERNAME /add /domain

netstat

The netstat command on Windows almost works exactly like its Linux equivalent. The difference is that -o displays the PID of the process using the connection on Windows (which, IMHO, is more useful than -o on Linux).

systeminfo

Use findstr to filter the output of systeminfo:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

wmic

The wmic command is extremely useful, but is also deprecated (because of its usefulness to attackers!). It can be used on Windows 10 21H1 and earlier. For later systems, PowerShell command-lets will need to be used instead (which increases the risk that activity will be logged).

Useful Scripts

Notes: