!

I had the wonderful idea to host the enumeration script in my GitHub. Therefore, if you'd like to see the (well documented) script, head to the file itself.

driverquery /v /fo csv > outFile.csv

driverquery lists every driver installed on the system. /v makes it verbose (including much more information) and /fo csv makes the output structured as a CSV file for ease of use. Driver information is valuable to an attacker because there are so many installed drivers on Windows, and any vulnerabilities could be exploited. This list can also give the attacker information on the installed applications on the device, as well as any peripherals that are attached.

pktmon start
pktmon stop

pktmon is a native packet capture tool for Windows. start starts packet capture, and creates a log file in C:\Windows\system32\PktMon.etl by default. stop stops capture. Packet capture allows an attacker to gain a massive amount of information about a users device, including what it's communicating with, potentially unencrypted communication, and broadcasts from nearby devices. It can also easily lead to setup for an Adversary in the Middle (AitM) attack.

reg save HKLM\SAM outFile.hiv

reg is the command line tool for managing the Windows registry. The command above saves the Security Account Manager (SAM) hive to a file that can be exfiltrated. The SAM hive is a database of all the local accounts on the device and the hashes of their passwords. This gives an attacker more knowledge about the accounts on the device, and can turn into account hijacking if the passwords in the file are cracked.

psr /start /output outFile.zip /sc 1 /gui 0
psr /stop

psr is the command line tool for the Problem Steps Recorder. It's been deprecated, but is still present on versions of Windows that released before 2024. psr essentially allows the attacker to have a view of the user's desktop for however long they want, giving them an abundance of information on the user, the applications they use, who they contact, and potentially some of their personally identifiable information.

cmdkey /list

cmdkey is the Windows utility for storing and managing credentials for logging into other devices. /list shows all cached credentials. If you find accounts in /list, it's worth it to check the groups that those accounts are a part of to see if you can use them for local privilege escalation.

!

The .7z file. Found here.

!

The .tar.gz file. Found here.

!

The .zip file made with Powershell's Compress-Archive cmdlet. Found here.

!

ddfGenerator.ps1 is a solution to the fact that makecab can't by default create an archive out of a folder. To make a .cab archive with multiple files in it, one has to create a .ddf file that describes the method of created the .cab file to makecab. ddfGenerator.ps1 automates this process, then creates the .cab file, and deletes the .ddf file when it's done. ddfGenerator.ps1 is available here, and the .cab file can be found here.

!

Here, you can see the Meterpreter session opening at "Meterpreter session 1 opened."

! !

The download command is listed at the top of the first screenshot, and the archives are listed at the bottom. Comparing the file sizes in the first screenshot with the second (the files on the Windows host), it's likely that the files didn't change in transit.

Drive Link This video shows the extracting and checking of the files.

1. 7zip created the smallest file.
2. tar and 7zip felt equally easy. I would say that tar was a little bit easier because it created a directory by default, instead of dumping all of the extracted files into the current folder. However, that's up to user preference.

Drive Link

Drive Link