Now that we have some base information about the local host,
we can then enumerate to the software contained on the machine
and the security products they are running.
Welcome back to our lab environment.
Now,
let's take a look on how to enumerate software and
antivirus solutions using PowerShell.
The easiest way of enumerating software is using the
Windows Management Instrumentation protocol,
or WMI.
For that, we can use the command Get‑WmiObject and then win32_product.
When we execute this,
PowerShell will use the WMI to enumerate all software installed on the machine.
As you can see here, we have a list of all the software installed.
However, personally, I'd like to see more information about what is installed.
I'd like to see when the software was installed and the package number.
So, I'll run the exact same command, but now,
I'll use pipe and add Select‑Object, Name,
Version, PackageName, and InstallDate.
Once I run this,
PowerShell will get all the information requested and put it in a table for me.
Perfect.
Take a look.
We have here the name of the software that it installed,
the version, and when it was installed.
And this can be really useful for two reasons.
First, as we have the version number here,
we could search if any of the software has
vulnerabilities that we could exploit.
And also,
we can review this list to figure out if there are any
endpoint protection tools installed, like an antivirus.
And talking about antivirus,
we're going to use the Windows Common Information model to
search for any antivirus solutions installed.
For that, I will use Get‑CimInstance ‑Namespace,
then root/SecurityCenter2 ‑ClassName AntivirusProduct.
Basically, this command will use the Common Information Model,
or CIM, to search for any kind of antivirus tool.
As you can see here, in our case,
we only have the Windows Defender installed on this machine.
If this machine had something else like a McAfee antivirus,
it would show up in here.
And now, since we know Windows Defender is installed,
we can get more information about it using PowerShell.
For that, I'll use the command Get‑MpComputerStatus.
Once I run this, I'll get all the information about the Windows Defender.
And take a look, the Windows Defender is active,
and we can even see when the virus signatures were last updated.
Pretty cool, right?
This can be a really interesting red team engagement.
Since you know the exact version of the antivirus,
you can tailor your exploits so they are not detected by this specific tool.