In this demo, we'll perform some initial local host enumeration using PowerShell.
In here,
we'll collect some basic information such as the operation system version,
patching levels, local users, and much more.
Welcome to our lab environment.
As I mentioned before, we have here two machines.
This first one is our victim machine, which is a Windows 2019 server.
This victim machine is part of the Globomantics domain,
and we have here this other machine,
which is the domain controller for Globomantics.
Both machines are in the same network, and they are part of the same domain.
So, let's start our local machine in enumeration.
Here, on my victim computer, I'll open PowerShell.
And, just as a note, in this demo,
we'll be enumerating all of the information manually,
so then you learn what each command does and how the enumeration works,
but don't worry.
In the end of this module we will create an automated
script to enumerate everything that we need.
Perfect.
So, let's talk about the basics.
We can gather some basic information about the system by reading the
information contained on the environment variables.
For example, if we type $env: and then press Tab a few times,
we can see all the environment variables for this session.
For example, I can press Tab until I see the computer name here,
and if I press Enter, this will return my hostname.
We can explore these environment variables by pressing Tab
multiple times and selecting whatever we want to see,
like the OS information.
One interesting piece of information that we can get from here is the
name of the domain that this machine belongs to.
For that, I will use env:user domain, and this is a simple,
but effective way of getting some information about the machine.
Now, let's take a look at some of the PowerShell features for local enumeration.
Let's take a look at the command Get‑ComputerInfo.
If you run this command, you enumerate pretty much everything about this machine.
And, as you can see, it takes a little while,
but it is because a lot of information is being collected.
Then, take a look, we got tons of information,
from operational system data to bios information.
For example, in here, we can see that this is a Windows 2019 machine.
And, by looking at the bios information,
we can see that it is a virtual machine running on VirtualBox.
If we scroll down to the operation of system information,
we can see the exact version of this Windows and even the
list of patches that are installed,
and this can be really useful to identify missing patches and
potential vulnerabilities that could be exploited.
As you can see, there is a lot of information here,
and it can get overwhelming to evaluate all this information at once.
So, we need a way to retrieve only the information that we want to see.
The cool thing about PowerShell is that we can easily filter
to find just the information that we want.
For example,
if I want to know the Windows version that is running on this machine,
I can run the exact same command, but now with the field that I want to retrieve,
which is OsName.
Once I pressed Enter, I will get only the information that I requested,
and in case I need multiple fields,
I will just have to use comma to list all the fields that I want.
Another cool thing is that you can use wild cards to select information.
For example, if I want to view all the data about the operational system,
I can use Get‑ComputerInfo then Os*, and this will return
all the fields that starts with Os.
Pretty cool, right? Now, my recommendation for you is to review all the
fields from the Get‑ComputerInfo command and decide which information is
important for you. And that's good advice here, only retrieve the data that
you find valuable otherwise you'll be overwhelmed by the amount of
information. Personally, I'd like to retrieve the following information,
the hostname of this machine,
the domain that the machine belongs to, the Windows
name, the specific Windows version, the build number,
the patches that are installed,
the Windows compilation version, and the bios information, and this will
give me the basic information about the machine. And if I need more
information, I can always add it later. Interesting, right? Now, although
this Get‑ComputerInfo shows me tons of good information, if I have enough
privileges in this machine,
I always like to take a look at the event logs of the computer.
The event logs help you to understand who is using the machine and the
overall behavior of the computer; however to get the information, you have to
have some privileges on your account you're using. For example, if I try to
use the command Get‑EventLog to retrieve security logs, I will get this error
here saying that I don't have enough permissions. But, to solve that, we can
open a PowerShell terminal as the administrator, and then we can run the
exact same command. Perfect. In here, you can see that we have tons of
security logs. The ones that I'd like to take a look at are those account
logons, which as we can see, have this event ID 4624. So, let's filter that.
We can execute the same command as before, but now filtering by the
InstanceID equals 4624, which are the logon events.
Then, take a look, we can see all the logon activity.
The only thing is that this information is truncated.
I cannot see too much information about the event. To solve that, it is
really easy. We just have to use the exact same command and then |
Format‑Table with the options Wrap and AutoSize.
Perfect.
Now, let's execute this again.
Perfect. Take a look. We've got all the information that
we need, and now I can see who logged into the machine
and what time they logged in.
As we can see, with just a few PowerShell commands, we're able to
enumerate pretty much everything about this machine from hosting to
install the patches and login attempts.