Automated Enumeration
In the previous three sections, we manually enumerated CLIENTWK220.
We gathered information,
which led us to two different ways to elevate our privileges.
However, this took us quite some time to do.
In a real-life penetration test for a client, we often have time constraints,
limiting the time we can take to enumerate systems in a manual way.
Therefore, we should use automated tools that enumerate the target machine and
provide us results about situational awareness as well as potential
sensitive information in an easy to consume fashion.
One such tool is winPEAS.
As Kali already includes winPEAS, we can copy the 64-bit binary to our
home directory and start a Python3 web server to serve it.
Let’s connect to the bind shell running on port 4444 at CLIENTWK220
as user dave as we did before.
We’ll start PowerShell,
and use the iwr Cmdlet with the URL of the winPEAS binary as the argument for -Uri,
and winPeas.exe for -Outfile.
Now, let’s run the winPEAS program.
It’ll take a few minutes for the program to finish.
While it is running, let’s review the winPEAS output legend.
It categorizes results in different colors,
indicating items worth a deeper inspection in red
and important information about protections in green.
Let’s review some of the findings.
We’ll begin with the basic system information.
The output shows that winPEAS detected the target machine as Windows 10 Pro
instead of Windows 11 as we established before.
This shows that we should never blindly trust the output of a tool.
Next, winPEAS provides information about security protections as well as PowerShell
and NTLM settings.
One of these information sections is about transcript files.
The list of transcript files is empty,
but we know that one exists in C\Users\Public\.
This is another example of information we would have missed by relying on
tool output alone without incorporating manual work.
Next, let’s scroll down to the Users section and review the output.
The output lists all users and their groups in an easy to read manner.
This way of displaying the information makes it very easy for us to understand
which users exist and are members of certain groups,
such as Remote Desktop Users.
Scrolling down, we’ll find information about processes, services,
scheduled tasks, network information, and installed applications.
The next area we’ll analyze is Looking for possible password files in users homes.
The list of files does not contain the asdf.txt file on the Desktop for dave.
Again, we would have missed this finding without any additional manual work
or by using another tool.
Running winPEAS on CLIENTWK220 provided us with lots of information and gave us
some great situational awareness about the system.
On the other hand, the tool incorrectly identified the target as Windows 10
and missed the meeting note, PowerShell history, and transcript file,
which we used to elevate our privileges in the previous sections.
However, because of the missing findings we should not abstain from using
automated tools, but merely understand their limits.
Automated tools such as winPEAS are essential in real-life penetration tests.
Outside of lab environments, the targets often contain numerous files,
configuration settings, and information to go through.
While we have only a few files in lab environments,
we’ll potentially get a list of hundreds or thousands of files to search through
a single system in an assessment.
With a pending deadline for the penetration test,
we would spend all of our time going through files without employing
automated tools.
In this section, we familiarized ourselves with winPEAS and how to use it.
We collected information on the target system and compared it
with our manual enumeration results.
While there were some missing findings by winPEAS, the sheer amount of information
resulting from its execution demonstrates how much time we can save in order to
avoid manually obtaining all this information.