Main Doc😱

---

🌲Enumeration LOLBins🌲

Find the native Windows command to run the commands below, some are likely from the LOLBins assignment. Run each command as the champuser account. Redirect output to files in C:\temp\ (create this folder if it doesn’t exist.). Save all the commands to a script (.bat or Powershell, your choice).

#	Description	Command
1	Current user, groups, and privileges	whoami /all
2	Running processes	tasklist /v
3	Open network sockets and connections	netstat -ano
4	Running services	sc.exe query
5	All local user accounts	net user
6	All local groups	net localgroup
7	Users in the Administrators group	net localgroup administrator
8	Network configuration (IP, gateway, DNS)	ipconfig /all
9	Firewall policies	netsh advfirewall firewall show rule name=all
10	ARP table	arp -a
11	SMB sessions	net session
12	System information	systeminfo

🫶Enumerate.ps1🫶

---

🔨Troubleshoot🔨

• If PowerShell scripts are blocked on your machine, run this command to enable:
  • Set-ExecutionPolicy RemoteSigned

---

• Your script should run smoothly from there!

---

🌲Additional Research🌲

• Research and document 5 additional LOLBin commands useful for host enumeration. For each, provide:
  • The command and its flags
  • What information it gathers
  • Why an attacker would want that information

#	LOLBin	Command	Description	Attacker Desire
1	where.exe	where.exe notepad	Looks for all text files on the system	An attacker could search for sensitive files like passwords, configs, or keys
2	reg.exe	reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Queries startup registry keys revealing persistence mechanisms	Querying startup registry keys shows an attacker what persistence mechanisms already exist
3	nslookup.exe	nslookup google.com	DNS resolution info revealing DNS server being used	Reveals the internal DNS server being used
4	wmic.exe	wmic os get caption,version,buildnumber	Queries OS information through WMI	Can be run remotely against other machines making it powerful for lateral movement
5	dsquery.exe	dsquery user	Queries Active Directory for all users and groups	Attacker can identify high value targets like Domain Admins

⚡where.exe⚡

⚡reg.exe⚡

⚡nslookup.exe⚡

⚡wmic.exe⚡

⚡dsquery.exe⚡

Because AD is not installed on the VMs, my command came back with an error response, but it would typically show users on the domain and is crucial information for attackers.

🌲Compressing & Archiving🌲

🌞Compression🌞

After completing all enumeration commands, compress all output files into one archive using each of these compression tools from the “Lab Environment Setup.”

⚡Create your file path⚡

• mkdir C:\temp\archives

⚡Download your 7zip/tar⚡

• 7-zip
  • "C:\Program Files\7-zip\7z.exe" a -tzip C:\temp\archives\enum_out_7z.zip C:\temp\*.txt
• Tar
  • tar -czvf C:\temp\archives\enum_out.tar.gz -C C:\temp *.txt

⚡Compress and Archive!⚡

• Switch to Windows PowerShell ISE and run this
  • Compress-Archive -Path C:\temp\*.txt -DestinationPath C:\temp\archives\enum_out_pscompress.zip

• Compress all the files into a .ddf file and save as enum.ddf

  • enum.ddf

• Run the ddf file with this command

  • makecab /f C:\temp\enum.ddf

---