6.1.1. Information collection

6.1.1.1. Basic command

  • Hostname hostname

  • Query all computer names dsquery computer

  • View configuration and patch information

    • systeminfo

    • wmic qfe get description,installedOn /format:csv

  • View version ver

  • Process information

    • tasklist /svc

    • wmic process get caption,executablepath,commandline /format:csv

    • get-process

  • View all environment variables set

  • View scheduled tasks schtasks /QUERY /fo LIST /v

  • View installed drivers DRIVERQUERY

  • View operating system information

    • Architecture wmic os get osarchitecture

    • system name wmic os get caption

  • View logical disks wmic logicaldisk get caption

  • View installed software information wmic product get name,version

  • View service information

    • wmic service list brief

    • sc query

    • Get-WmiObject win32_service | select PathName

6.1.1.2. Domain Information

  • Get the computer name of the current group net view

  • Network discovery net view /all

  • View all domains net view /domain

  • Domain forest, domain tree information

  • Domain trust information nltest /domain_trusts

  • Locate Domain Controller net time /domain

  • View usernames in a domain dsquery user

  • Query Domain Group Name net group /domain

  • query domain administrator net group "Domain Admins" /domain

  • Domain controller information

    • nltest /dclist:xx

    • Get-NetDomain

    • Get-NetDomainController

    • net group "Domain controllers"

  • Group Policy

6.1.1.3. User Information

  • View users

    • net user

    • whoami / whoami /priv / whoami /all

    • wmic useraccount get /ALL /format:csv

  • User Privilege Information whoami /priv

  • View current permissions net localgroup administrators

  • View Online Users quser / qwinsta / query user

  • View current computer name, full name, user name, system version, workstation domain, login domain net config Workstation

  • ACL information get-acl

6.1.1.4. Network Information

  • Intranet segment information

  • network card information ipconfig

  • External network export

  • ARP table arp -a

  • Route table route print

  • Listening port netstat -ano

  • Connected port

  • Port information

    • Get-NetTCPConnection

  • hosts file

  • Active and standby DNS

  • DNS cache

    • ipconfig /displaydns

    • Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_DNSClientCache

  • Detect the network situation

    • powershell -c “1..65535 | % {echo ((new-object Net.Sockets.TcpClient).Connect(‘allports.exposed’,$_)) $_ } 2>$null”

6.1.1.5. Firewall

  • View firewall status netsh advfirewall show allprofiles

  • Firewall log directory netsh firewall show logging

  • Firewall rules netsh advfirewall firewall show rule name=all

  • netsh firewall show config

  • netsh firewall show state

6.1.1.6. Password Information

  • Windows RDP connection logging

  • Account password saved in the browser

  • Various passwords in the system password manager

  • assword information in unattended installation files

    • C:\sysprep.inf

    • C:\sysprep\sysprep.xml

    • C:\Windows\Panther\Unattend\Unattended.xml

    • C:\Windows\Panther\Unattended.xml

6.1.1.7. Ticket Information

  • cmdkey /l

  • klist

  • msf meterpreter

6.1.1.8. Special files

  • Documentation

    • xlsx / xls

    • docx / doc

    • pptx / ppt

    • vsdx / vsd

    • md / txt

  • Compressed file

    • zip / rar / 7z

  • VPN configuration

    • ovpn

  • Code

    • py / php / jsp / aspx / asp / sql

  • Configuration file

    • conf / ini / xml

  • Specific keywords

    • account/account/login/login/user

    • password/pass

    • code/documentation/handover/backup/git/svn

    • Mailbox / Address Book / Cluster / Office

    • Proxy/ Intranet/ VPN

    • Equipment/Asset

    • System/Operation/Topology/Network/IT

    • Backend/Admin/Database

    • Monitoring / Isolation / Firewall / Gatekeeper / Inspection

6.1.1.9. LAN Survival Host

  • NetBIOS scan

  • OXID scan

6.1.1.10. Others

  • Enabled Shared Folders

  • recycle bin

  • Recently run command

  • Access file history

  • Check patch installation

    • wmic qfe get Caption,Description,HotFixID,InstalledOn

  • Log and event information

    • wevtutil

    • eventvwr

  • Registry Information

    • reg

  • Installed various agent monitoring software

  • Installed antivirus software

  • View/set suffix associations

    • assoc

    • assoc .ext=example

  • PowerShell version

  • .Net version

  • Wi-Fi password