OPSECTLAS you are here: Foothold (Windows)
next-move engine

You have Foothold (Windows)

8 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. Run these within the first 60 seconds of getting a shell.

    Who am I? What privileges do I have?

    whoami
    whoami /all
    whoami /priv         # SeImpersonatePrivilege = check Potatoes NOW

    System information

    systeminfo
    systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix"

    Network

    ipconfig /all
    netstat -ano
    route print

    Users and groups

    net user
    net user <USER>
    net localgroup
    net localgroup administrators

    Running processes

    tasklist /v
    wmic process get name,executablepath,processid

    Installed software

    wmic product get name,version
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr "DisplayName\|DisplayVersion"

    Scheduled tasks

    schtasks /query /fo LIST /v | findstr /C:"Task To Run" /C:"Run As User" /C:"Status"
    schtasks /query /fo LIST 2>nul | findstr TaskName

    Services

    wmic service get name,startname,pathname | findstr /i /v "C:\\Windows"
    sc query