The first step on our journey is collecting information from a local device.
This information can be really useful for understanding the
environment and escalating privileges on the machine.
When talking about local machine enumeration,
we're interested in several types of data.
For example, we should enumerate operational system information,
such as the Windows version and which patches are applied.
In this way,
we can easily identify potential OS vulnerabilities that
could help us to escalate privileges.
Other important information to enumerate on a machine
are the local users and local groups.
These can be useful to identify local
administrators that we could try to attack.
Other important information to enumerate are the scripts running on the machine.
If those are misconfigured,
we can then edit them and add malicious code to run on the machine.
And depending on your attack techniques,
you might also want to enumerate people that log into the
machine and the active RDP sessions.
In this way, you can try to pivot to another user and escalate your privileges.
Other important information is the software installed on the machine.
You can try to find outdated software and exploit remedies on them to
escalate your privileges or create persistence.
And last, but also really important,
we need to understand what security products are installed on a machine
so we can tailor our attacks and avoid being detected.
So,
let's go to our demos and see in real life how to
collect that information with PowerShell.
In case you want to follow the demos in your own environment,
you need two things.
First, you need the victim machine, which can be any modern Windows version.
In here, I'm using a Windows 2019 server,
and in there,
we will run PowerShell scripts on this machine to enumerate the
localhost and the network surrounding it.
Also, as we'll be doing a lot of domain enumeration,
you need a domain controller machine.
In here, I'm using a Windows Server 2016.
And if you want to make your lab even more interesting,
you can also have other Windows servers connected to this domain controller.
So, enough of talking.
It's demo time.