🌹Reconnaissance & System Discovery LOLBins🌹 - sophialevasseur/SEC-335 GitHub Wiki

Main DOC😱

1: 🌻ipconfig🌻

  • The exact command you ran:
    • ipconfig /all
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • An attacker can use inconfig in the discovery portion of their attack, learning crucial information about a users system such as ipv4/6, subnet mask, default gateway, DNS servers, etc.
  • The MITRE ATT&CK technique ID:
    • ipconfig: S0100
    • System Network Configuration Discovery: T1016

2: 🌻Cmdkey🌻

  • The exact command you ran:
    • cmdkey /list
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • By running the cmdkey lolbin, attackers expose the contents of the Windows Credential Manager for the current user session.
  • The MITRE ATT&CK technique ID:
    • Credentials from Password Stores: T1555
    • Windows Credential Manager: T1555.004
  • Source

3: 🌻arp🌻

  • The exact command you ran:
    • arp -a
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • This command shows attackers all the hosts on the same subnet as their victim. It can be used to find neighboring machines without sending any network traffic out.
  • The MITRE ATT&CK technique ID:
    • ARP cache poisoning: T1557.002
    • Adversary-in-the-Middle: T1557
    • arp: S0099

4: 🌻Psr🌻

  • The exact command you ran:
    • psr.exe /start /output C:\Windows\Temp\file.zip /sc 1 /gui 0
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • Attackers use silent command-line switches to record user screen actions, mouse clicks, and keyboard inputs into an encrypted ZIP file containing an MHTML report.
  • The MITRE ATT&CK technique ID:
    • Screen Capture: T1113
    • Archive via Utility: T1560.001
  • Source

5: 🌻systeminfo🌻

  1. The exact command you ran:
    • systeminfo
  2. a screenshot of YOUR output:
  1. An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • The systeminfo command gives an attacker access to the Windows OS config, hardware architecture, and patch level. This kind of information is ideal for an attacker to find in the discovery phase because they have obtained all necessary info to plan privilege escalation and lateral movement.
  2. The MITRE ATT&CK technique ID:
    • System Information Discovery: T1082
    • Software ID: S0096

6: 🌻tasklist🌻

  1. The exact command you ran:
    • tasklist /v
  2. a screenshot of YOUR output:
  1. An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • Running the tasklist command will give an attacker a map of all the running processes and system architecture on their target machine.
  2. The MITRE ATT&CK technique ID:
    • Process Discovery: T1057
    • Software ID: S0057

7: 🌻net.exe🌻

  1. The exact command you ran:
    • net user
  2. a screenshot of YOUR output:
  1. An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • The command net.exe is useful to attackers because it displays user accounts on the system.
  2. The MITRE ATT&CK technique ID:
    • Software ID: S0039

8: 🌻gpresult🌻

  1. The exact command you ran:
    • gpresult /r
  2. a screenshot of YOUR output:
  1. An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • The gpresult command essentially gives attackers a list of the organizations AD security policies and the network architecture of the compromised machine.
  2. The MITRE ATT&CK technique ID:
    • Group Policy enumeration: T1615