Let's quickly cover some automated enumeration tools.
And I'm just going to show you the list that I've got put out here.
So we have executable.
These are files that we can either just upload right off the bat or we can compile using something like
Visual Studio and then upload and all of these will work with Windows one piece being probably my favorite
but there's also a tool called seat belt.
There's a tool called Watson.
There's a tool called sharp up.
Now these all do generally the same thing on the power shells side.
There is a tool called Sherlock which is actually the predecessor to Watson.
There's a tool called Power Up which is the same thing as sharp up but it's written in power shell as
opposed to C sharp.
There's a tool called Jaws which is awesome as well.
And a couple of my favorites which are this Windows exploit suggestion which is actually a Python script
you run locally on your attack machine and exploits the gesture from Metis boy.
So I'm going to cover some more of these tools and details here in just a second.
And then in the next video we're going to cover running one of these tools or two of these tools and
see what happens when they just don't work.
What are we going to do.
Well these other categories come into play.
These are really nice tools but there is a reason there's an assortment of tools because sometimes you're
executable is don't work.
Sometimes your power show doesn't work.
Sometimes they both don't work.
So what are you gonna do when the tools that you rely on just aren't working.
Well luckily there's so many tools out there.
We're gonna figure it out.
So you can take a screenshot of this.
I'm going to upload or put in the resources literally every single thing you see here.
I'll put a link to in the resources that way you have everything.
But let me go ahead and go to my attack machine and let's just talk through some of this stuff really
quick.
So when peace when peace is a great great great tool so you see when peace hear the window's privilege
escalation awesome script is what it stands for.
It is awesome.
There's nothing else to say about it.
Besides it's awesome.
Now this does run requiring a dot net of four.
So if there is not a 4.0 or greater on the machine that you're tacking on this just is not going to
work.
Now there is a bat file that you can try to see if it works for it.
That's another option is this one piece bat the executable works really well also.
So that's one option.
And the nice thing about it too is this book the hack tricks that X Y Z is just yet another great resource
that you can do.
You can come in here and it's just a checklist for for Windows privacy.
Now it says hey first thing we want to look for is the kernel vulnerable.
Well we haven't gotten to kernel exploits yet.
It's coming soon but let's just open this in a new tab and see what they're asking about.
It says Hey search for exploits for your vulnerabilities here and how do we do that.
Well.
System Info.
Well that one looks familiar.
This looks familiar right.
Getting the OS name OS version doing the W and I see with the QF e to see the installed patches on the
machine even tells you some of the tools down here that you might run against this.
The local XP suggestion is one from medicinally Sherlock and Watson are two that we just talked about.
So those are some things that you can do to come through here and look.
And it talks about all the different types of enumeration that you can run through your checklist even
coming through here.
Hey look logging in a V enumeration user privileges network information.
There's so many things to check for on this the privacy checklist right.
The nice thing about it is this tool does it all for you and it does all this for you and so do the
rest of the tools really.
They're all very much the same in what they do and they're all very awesome in their own way.
So things like Sherlock.
Sherlock is a power show script that looks for common vulnerabilities.
It's not as complete in my opinion as one piece.
And what you need to do is you just need to run these against your machines see what works for you.
Honestly the best place to run these is against your own computer or a computer you have in a lab environment.
If you've got a Windows machine running it doesn't hurt to run it.
There's nothing malicious going on.
It's just doing checks.
And I'll show you one against mine that I ran for one piece because when piece isn't going to work on
the box that we're doing by really do love one piece another one from Rostam Alice is Watson.
Watson is just another great tool updated to include.
You can see twenty nineteen vulnerabilities so more updated than Sherlock and Sherlock is now deprecated.
The only issue that I have with Watson is it comes in SLA and file meaning Visual Studio and meaning
we have to vide it with a we have to compile it and we have to know the dot net version running on the
machine.
So it makes it a little bit more difficult to run this.
Not that it's not a great tool is just a little more difficult.
Power exploit which we're actually going to focus on power up in this course is a great great tool.
You're gonna see this come up again even though it's going to come up right now in the section you're
going to see some of these tools come up again as we enumerate other boxes.
So just because you don't get to use them right now don't fret you're going to see it over and over
again.
Another one that's coming out is the jaws just another Windows enumeration script also runs and power
Shell does a lot of the same thing.
I'm skipping had just a little bit going a little fast here because I want to talk about this one here.
Now Windows XP suggestion dot pi is a great tool.
So let me scroll down just a little bit and show you the usage you can see that we just update the database
that it has.
So it has a database that's out there pulls it down from it.
If there's any dependencies will install those but we use the system info all we do is do a System Info
grab that put it into a text file and then it goes in here and it checks things for vulnerabilities
and it tells us hey it might be vulnerable to this this this or this.
I mean that's great.
It's just a another vulnerability checker something that we can use to check ourselves.
And the last one I've got here is Seat belt seat belt is another SL on file meaning you have to compile
So if we go back into our PowerPoint little presentation the only one we didn't cover is the exploit
suggestion from medicinally very similar to what the rest of these do.
It's just running off a split and we'll see how that works we'll see how the windows explains adjuster
works here very very shortly.
So again don't fret if you don't see all these right now.
I'm going to pull up really quick.
Also this is just a win piece I ran on my machine as a non privilege user.
So we've got an account here as my wife.
And we're just going to say hey here's a non privileged account and I'm going to show you everything
just to.
I'm just to show you some of the cool stuff.
So it's in color it's nice and neat and it shows you a hey here's the legend if it's red.
Something is mis configured or if it's green it's well configured and then it's got the different things
here and it says we're looking for information on this computer here it is it's Windows 10 machine here's
your system info right.
Windows 10.
Here's the hostname.
Here's the architecture.
Here are the hot fixes.
So remember the W M I see CUFI it's pulling that for you and it's saying hey you're bad.
You haven't updated this in a little bit.
And we're actually running Watson from Rostam mouth.
So you just saw that tool came through here and it's got a couple potential vulnerabilities that could
allow for escalation.
It says Hey what's the power shell setting.
These are important to know especially if you're going to run any sort of power shell type vulnerabilities
against the machine.
It's good to know if you're on Version 2 if that's enabled version 5 is enabled or if you're only on
Version 5 or version to come through here you see more information what protections are on any cache
credentials what are the user environment variables.
These are all really good.
Let's scroll down just a little bit drive information you can see what drives are attached to this machine.
What a the information is here.
So all the things we've covered right are just in here UAC status users information where they have
access and then it just goes it goes all through this.
So current token privileges which we're going to cover later if there's any clipboard tax to logged
in users are who the RTP sessions are.
So this is really really really nice.
I won't go through the whole thing.
I will scroll down to the bottom.
So here.
Windows credentials.
And it looks for all different kinds of credentials and it's been doing this in password files and other
things but look it's looking in the windows vault credential manager.
Are there any credentials anywhere that we can find.
And this is kind of what I was telling you like hey we're going to look for.
We're gonna look for things in the credentials look looking for safe Wi-Fi all the things we just talked
about a few minutes ago.
Here it is is checking that is checking for browser information any sort of thing.
It looks like there may be some saved log ins at in the cookies for Chrome so maybe there is a vulnerability
there.
So these are all the things that looks at looks at processes there's so much that they kind of skipped
over here.
But I want you just to run this on your own.
Go download it run it on your own if you need help getting to the executable I can show you where that's
at too.
Before we take off here but if you see the Wynn piece there's the bat file and the wind piece.
See if you click on it.
Now you see there's an SL in here.
But don't worry about that.
They actually do provide the executable so if you click on one piece right here and you click on Ben
you're always looking for Ben X 64 X 86 depending on your architecture.
And then we're gonna go ahead and click on X 64 because that's what most of us are on.
You download the one piece that you see and you just run it.
So it's as easy as that.
It stays up today.
Look the last commit was seven days ago.
So that's that's awesome.
So you just want to make sure that you run this.
It's not going to do any damage to your computer you can.
I would recommend running it as a low privilege user if you run it as a high privilege user you're gonna
see all kinds of Christmas tree colors going off in your.
Your scan.
So I would run it as a lower pivot user but in the next video we're gonna do is we're going to try to
use a couple of these tools.
You're gonna see them fail and then we're gonna use a couple of tools that actually work for us and
it's just going to prove the concept of you can't know about too many tools and you should have a wide
array of tools in your in your tool belt.
So we're gonna see all about that next video and we're going do a little bit more enumeration get towards
popping our first shell or popping our first privacy in this course.
So I will catch you over in the next video.