Enumerating Operating Systems
In a typical penetration test,
we use various recon tools in order to detect which operating system
a client or server is using.
We can, however, enumerate this from Active Directory.
Let’s use the Get-NetComputer PowerView command
to enumerate the computer objects in the domain.
There are many interesting attributes,
but for now we’ll search for the operating system and hostnames.
Let’s pipe the output into select and clean up our list.
The output reveals a total of six computers in this domain,
tthree of which are servers, including one DC.
It’s a good idea to grab this information early in the assessment
to determine the relative age of the systems
and to locate potentially weak targets.
According to the information we’ve gathered so far,
the machine with the oldest OS appears to be running Windows 10.
Additionally, it appears we are dealing with a web server
and a file server that will require our attention at some point as well.
So far in our enumeration
we have obtained a nice list of all object in the domain as well as their attributes.