OK.
Now we're on to an user enumeration we're back on our machine.
Let's just go ahead and type in shall on this and we can look at the different types of users first
let's start with ourselves.
We could to say something like Who am I and you could see on this machine where I guess at pool.
So this means that we are not the system level user.
That's OK.
We can also look at our privileges say who on my site prefer and this will provide some information
and all of this might not make any sense right now.
This will come back into play later when we talk about token impersonation and how we can utilize that
firm different perspectives one from what we call potato attacks either juicy potato rotten potato etc.
or even just standard token impersonation.
We'll talk about that in privileges and how they work.
So it's very interesting but we'll dive into it later.
Just know this who am I.
Proof of command exists and that it allows us to look at different packages that we have available to
us.
So last we can do.
Who am I.
Slash groups we can look at what groups were involved in so you can tell that this user is not part
of any sort of administrative group.
We just look to be part of standard users.
Nothing going on here.
That's exciting for us.
But you never know we might be part of an administrative group and we might have rights and even though
we say I guess at pool maybe it was mis configured and we actually have added rights to begin with.
So it's always good to look at the groups that were belonging to.
Now we could type in something like net user.
And that will show us the users on this machine.
So you could see that they're actually just really two users.
They have a guest account but we have administrator and then this badass user while we're honest service
is what we actually landed on.
So we're not on a real user account.
We just happen to be a part of a service that's running which is the IRS service.
So what's happening here is we're taking over a service but there are these user accounts so maybe we
can move laterally into a user account and then escalate into administrator or maybe we can just escalate
directly into an administrator account.
We don't know quite yet but it's good to know what's out there and how we can take advantage of it possibly.
We could also look at specific users like we want to say net user Travis and we can see information
about Mabus we can see when their password is last set when it expires.
All of this is just extra information.
Right.
And you could see what group memberships they have.
Same thing with the Net user of administrator.
We can take a look at this and you can see what group memberships they have.
Well look they're part of the administrators where this Babs user is just part of the users group.
So if we were to take over this Babbitt's user it's still what matter because we wouldn't be escalated
fully we would just be at a same level user that we're at.
There might be more information maybe there's a password store to file or something on that user that
we didn't have access to as the current user.
But for now it's not an admin user we can identify what avid user we could possibly take over just by
doing quick user enumeration like this.
So the other thing that we can look at are the local groups so we could try and get local groups sometimes
it works sometimes it doesn't.
You could see here we don't have a log on session that actually exists.
So it's not gonna work for us but maybe we know a local group that does exist like administrators that
we can say hey I want to look at the administrators group maybe there are a bunch of users and we just
want to see who's part of that group.
Well we could find out the membership quite easily.
Here we see its administrator and that's all we have to focus on.
So that's really it for now.
Again a lot of these are and come back into play later on I'm just trying to get you introduced to the
basics and kind of get you introduced into what you should be looking for system related user related.
And the next we're going to focus on network related so we're going to dig into some network enumeration
and move on from there.
So I'll catch you over in the next video.