Well, I have to admit, this is what I would call a super fun video because we are going to dive into
some sample enumeration techniques.
In Windows there is a couple of tried and true naming conventions and naming mechanisms.
One of those is net bios.
The other is the existence of a hosts file, by the way.
So on your Windows Drive is a host file and that can do a name resolution and override things like DNS.
So watch out for that host file that's been around forever on a Windows system.
But notice what I'm doing here.
I am enumerating information about the local system with NBT step.
So NBT stat, if you type that, you will get a list of all of the possible switches.
Notice we can look at the bios name cache with dash.
See.
We can look at the list of local bios names with dilshan.
So I'll do an NBT stat dash dn.
And sure enough, we are enumerating the names for this local system.
I can see that I'm in a workgroup called workgroup.
That's the default Windows workgroup and I'm on a system name omen one.
Boy, oh boy.
You can tell that I am not in a high security type environment and that is because what a lazy name
for my laptop, which is an HP omen.
So niche we don't want to easily enumerate information like that to a would be attacker.
So a classic case of don't do as I do here.
Right.
This machine I'm using is not one that I have well protected.
All right.
Anyways, so look at that.
We just learned the name of this system, right?
Now, what about shared resources that might be available?
Well, we could enumerate that thanks to net view.
So I can do the net view command and I do whack whack.
The name of the machine that we've now learned is omen one.
And then I do a forward slash all.
And look at this.
There is three shares that are being shared on my device.
You might not have been aware of any of them, and that's because they are windows hidden shares.
That's what that dollar sign at the S is an indicator of.
And one is for remote admin.
The other is the entire default share of the C drive and the remote IPC channel for remote calls.
So notice we are able to enumerate even the hidden shares on this machine with that powerful net view
command.
Now something else in a microsoft environment that you might want to do is enumerate user accounts.
What might that look like?
Well, let me show you.
Microsoft themselves gave us tools for enumeration of user account information in their called pass
tools and noticed this list of tools.
So we have exac to execute processes remotely.
WPS file shows files opened remotely, displayed the SSID of a computer or a user.
WPS get said notice once you remember that it's WPS tools.
If they were to give you one of these tools.
Notice how self-explanatory the names are.
Right.
So it would be very easy for you just to recall that.
Yep, it's part of the tools toolkit and it's for enumeration.
Now, notice this word CID right here.
What is that?
That is like second nature to me, because I'm an old, old, old Microsoft engineer from way back.
Yes.
I was supporting Windows Systems when it was oh my gosh, pre Windows 95.
That's how old I am.
So anyways, this sed concept is something we are intimately familiar with and that is the security
ID of the computer or the user.
It's a, you know, code.
It's not the user's name.
It's a unique identifier, a long string of digits.
That is the true identity of the user on a system.
So it is this ssid that must be protected at all costs, oftentimes in the Windows environment.
By the way, the CID is why when you delete a user account, you can't just create another one with
the same name and have it, you know, have all those properties.
Things are identified by the CID in the Windows environment.
So those are the exact kinds of tools that would be used when enumeration is being performed against
a network infrastructure or some architectural solution you have in the cloud or whatever your I.T infrastructure
might be.
Those enumeration tools and steps that we went through, very, very typical.