So now we have a shell and we need to start focusing on enumeration.
Now this just goes back to our hacking roots.
You know the five steps of hacking in the first three of those are in four motion gathering scanning
an enumeration and then exploitation.
Well we've done that and now we've exploded this machine.
But we are a low level user.
So guess what we have to go back to our roots and we have to start focusing again on that scanning in
enumeration.
We have to look at what information is out there and see how we can utilize that to elevate our privileges
into a system level user.
That is our end goal here.
So what we're going to do first is we're going to focus on system so system enumeration is looking at
things like system info and we could see things like the operating system name or the operating system
version maybe the system architecture we can look at the hostname we can extract patching and see what
sort of patching is out there what sort of hot fixes are out there and we'll talk about that here in
a second.
We look at things like the drives in the system etc. So it is going to take a look at what the system
is providing us from a high level.
So let's dive into a shell and one of the first easy commands that we can do is just type in System
Info and this will come back into play a little bit later when we actually utilize tools for all of
this.
But here you can see that we have the hostname we've got the operating system being Windows 7 we've
got the operating system version we've got the manufacturer all sorts of information who the owner is
of this machine we could tell we're running on VM where so x 86 architecture etc. Now in all those resources
that provided you there are some great one liners.
Now this is one of those I've kind of taken and modify but let's say that we want to just pull down
system info and kind of get a grip upon it.
And I just want to pull down a few things.
So let's say system info and the pipe here is similar to grep we're gonna just say fine string and we're
gonna just go for it's Ashby for its slash C and we're going to grab the OS name we're gonna grab the
OS version and we're going to grab the system tight and let's take a look at what this does.
Now I don't expect you to type this all out.
It's just as easy to put it in System Info and review this but say you just want to pull down this information.
This is a quick way to do it and this is a good way just to learn the syntax of Windows command line.
If you're not familiar with it.
So we could do a quick find string pull down some information.
Now we just see instead of all this mess for you to say Hey we're running on Windows 7 here's our build
version here's the version type etc. and then we've got an X 86 architecture on this P.C..
So that's very useful information to know for example for trying to run an exploding in this machine
and exploit it for 64 bit only we can rule that one out because we know hey it's only X 86 architecture
or if we're trying to run a kernel based exploit for example which we haven't gotten to yet and we're
trying to do it against a version that is newer than this.
It's probably not going to work.
So we want to make sure that we fall in line with the right parameters for the exploit in having the
information in front of us helps.
Same thing maybe the exploits for Windows 10 doesn't work on Windows 7 or maybe for Windows 7 Home Edition
doesn't work on enterprise.
There's a lot of variables here for exploits that we need to kind of understand the information behind
them before we can just start firing exploits at this.
So it's good to know your system info if you want to pull down things like hostname you can add that
and or you just type in hostname for example but also appears in the system info.
Another important thing to do is we can extract patching so we can look at how well patch this system
is.
Now it's not going to work on this system.
W Am I QF e and I'll explain what this is and the second you can see I typed it in doesn't work.
So when to pull up a another Windows box that I have and I'm going to show you what it does look like
when you actually run it against a system where it works.
Now w am I.
What is that.
That's the windows management instrumentation and the C stands for command line.
Basically what it does for us is it returns information about the system that we're running it on and
what we're looking at with the QF is what's called a quick fix engineering we're basically just trying
to see hey what's available what's been patched.
When was the last patch.
So let's pull up this command prompt here and let me just say WIC UEFA here.
And if you've a Windows machine you can do this again on yours and you can see things now you can see.
OK well here is the knowledge base I.D. Here's the hot fix I.D. Here's who installed it and here's when
it was installed.
So maybe we know based on these different knowledge bases whether or not something is patched or not
patched with but we're looking at.
So this is very common.
Quick and dirty commando run.
Now we can run something like this.
Let me just copy and paste it and show it to you if you want to copy paste so that you can and that
do not copy I apologize.
So when we copy paste this we can kind of narrow down and just say w my C UEFA and then we can say get
and we can just pull down what we want.
So we only want the caption the description the Hoff fakes I.D. and then installed on then we can really
narrow down and not have to look at this big list we can just get a nice and cleaner list here.
So this is one of those things just like that system info where you can put this into a quick copy paste
list if you're doing enumeration or we can rely on tools once we get to the tool section to actually
kind of help us and do this for us.
So this is important to know again we can look at the knowledge bases see what's out there and how we
can exploit it.
So last thing I want to show you with system related.
For now we'll get into more things that we're gonna look at as we go.
But just the basics of what we're looking at is just let's list out the drives maybe this other drives
out there.
So what we can do is we can do it a W M I see again and we can just say logical disk
and you can see all the different information here.
That looks kind of dirty right.
We don't really want that.
So we could do something like list drives for actually.
Or we could just do something like this.
This is where I actually like to copy and paste so we could do a WNYC and again we'll just to get caption
description provider name and watch what happens and then you could see Hey C D E F and H exist on this
one specifically.
Now if you just wanted it really quick and you just want to say hey w I see logical this you could say
get caption and get the caption and they'll still pull down.
How many drives are there and you don't have to say pull down the description or provide her name but
quick quick wins here to see what's there.
Maybe your running machine and you're on the C drive but maybe there's this E F and H drive that you
can look through.
Maybe there's information in those drives you want to make sure that you have the knowledge in front
of you and all the information in front of you that's possible.
So that's it for this video.
We're going to go ahead and move on to a user base enumeration and so I'll catch you in the next video
when we start talking about how to enumerate users and groups.