Hello! Welcome to the next lesson in our module on Privilege Escalation.
In our previous lessons, we built a solid foundation for post-exploitation on Linux systems. You learned how to enumerate sudo rules and exploit SUID binaries to gain root access. This process of methodical enumeration followed by targeted exploitation is the core of a penetration tester's mindset.
Today, we pivot from Linux to the Windows operating system. While the high-level methodology remains the same—enumerate, identify, exploit—the specific commands, tools, and vulnerabilities are entirely different. This lesson focuses squarely on the crucial first step: enumeration. Once you have a foothold on a Windows machine, your first objective is to understand the environment, map out your surroundings, and hunt for weaknesses.
By the end of this 60-minute lesson, you will be able to perform both manual and automated enumeration on a compromised Windows host to gather the intelligence needed for privilege escalation.
1. Manual Enumeration: The Ground-Up Approach
Just as with Linux, knowing how to perform enumeration with built-in system commands is a fundamental skill. It's stealthy, reliable (the tools are always there!), and builds a deep understanding of the OS. In Windows, this means using cmd.exe or PowerShell to run a series of commands to gather information about users, the system configuration, network status, and running processes.
The following video from HackerSploit provides an excellent, practical walkthrough of the most important manual enumeration commands. We will break it down into logical sections.
Windows Post Exploitation - Local Enumeration
This video, 'Windows Post Exploitation - Local Enumeration', will be our guide for this section. It demonstrates the essential commands you'll use on nearly every Windows engagement.
I'll ask you to watch specific segments of this video throughout this section. For now, you can get it ready.
User and System Information
Your first questions upon landing on a machine should be: "Who am I?", "What are my privileges?", and "What kind of system is this?".
Windows Post Exploitation - Local Enumeration
Watch the following segments to see how to gather basic user, group, system, and patch-level information.
Please watch from 02:58 to 12:12. Pay close attention to these key commands and their purpose: whoami /priv and whoami /groups: To check your user's privileges and group memberships. Look for interesting privileges like SeImpersonatePrivilege or membership in groups like Administrators or Remote Desktop Users. net users and net user <username>: To list all local users and inspect the details of a specific user. net localgroup <groupname>: To see who belongs to a specific group. systeminfo: To get the OS version, architecture, and domain information. wmic qfe get HotFixID,Description: To list installed security patches (HotFixes). This is critical for finding missing patches that correspond to known vulnerabilities.
The information from systeminfo and wmic qfe is what you would feed into a tool like Windows Exploit Suggester to find potential kernel exploits, a common privilege escalation vector.
Running Processes and Services
Next, you need to know what's running on the system. This can reveal third-party applications, custom software, or security products that you might need to bypass.
Windows Post Exploitation - Local Enumeration
This short segment shows how to list all running processes and their associated services.
Watch from 12:12 to 13:28. The command shown is tasklist /svc.
When analyzing the output of tasklist, you're looking for anything that isn't a standard Windows process. Names that suggest custom applications or known-vulnerable software are prime targets for further investigation.
Network and Security Configuration
Understanding the machine's network configuration and security posture is vital. Are there other networks it's connected to? Is a firewall or antivirus active?
Windows Post Exploitation - Local Enumeration
Finally, let's look at enumerating network interfaces, connections, and the status of local security controls.
Watch from 13:16 to 18:26. Focus on these commands: ipconfig /all: To check for multiple network interfaces, which could be gateways to other internal networks. netstat -aano: To see all listening ports and active connections. This helps you understand what services are running and accessible. sc query windefend: To check the status of Windows Defender. netsh advfirewall show allprofiles: To check the status of the Windows Firewall.
Test your understanding!
You've gained a low-privilege shell on a Windows Server 2016 machine. You want to see if it's missing any recent security updates to check for kernel exploits. Which command would be most effective for this?
Show answer
The most effective command is wmic qfe get HotFixID,Description or simply wmic qfe. This command lists all the installed Windows updates (HotFixes), which you can then compare against known vulnerabilities for that OS version to see what's missing. While systeminfo also shows HotFix information, wmic qfe is often more detailed and easier to parse.
2. Automated Enumeration: Speed and Scale with WinPEAS
Manual enumeration is essential, but it can be slow. To work efficiently, penetration testers rely on automated scripts that run hundreds of checks in seconds. These scripts, often called "privilege escalation awesome scripts," are designed to find common misconfigurations and vulnerabilities automatically.
There are many great tools for this, like PowerUp, Seatbelt, and SharpUp. You can read about them in this article from StationX under the "Automated Tools" section.
How to Use Windows Privilege Escalation for Hacking
This article, 'How to Use Windows Privilege Escalation for Hacking', provides a good overview of the most popular automated enumeration tools.
Read the section titled 'Automated Tools'. This will introduce you to several key scripts and give you a sense of the landscape. We will be focusing on WinPEAS for our practical example.
For this lesson, we will focus on WinPEAS, one of the most popular and comprehensive enumeration scripts available. It's a C# executable that performs a vast number of checks and presents the results in a color-coded format, making it easy to spot potential vulnerabilities.
Running WinPEAS and Interpreting the Output
The typical workflow is to transfer the winPEAS.exe file to the target machine (e.g., via a web server or a Meterpreter upload command) and then execute it from the command line.
The real skill is not in running the tool, but in interpreting its output. The next video demonstrates how to run WinPEAS and, more importantly, how to sift through the results to find actionable intelligence.
Windows Enumeration With winPEAS
This video, 'Windows Enumeration With winPEAS', will walk you through getting the tool onto a target and analyzing its findings. This is a critical skill for modern penetration testing.
Please watch from 05:05 to 25:14. The video is packed with information, so focus on these key parts: Uploading and Running (05:05 - 10:27): Observe how the presenter gets the winPEAS.exe binary onto the target machine and executes it. Analyzing the Output (10:27 - 21:47): This is the most important section. Pay attention to how the color-coding highlights interesting findings. The presenter analyzes several key sections that you should always check: System Information & Vulnerabilities: Identifies the OS build and suggests potential kernel exploits. Credential Checks: Searches for cached credentials, credentials in the registry (like AutoLogon), and sensitive files. Services Information: Looks for insecure service permissions and unquoted service paths—two major privilege escalation vectors we will exploit in the next lesson. Unattended Files: Finds unattended.xml files which can contain administrator passwords in plaintext or Base64. Actioning a Finding (21:38 - 25:14): The presenter finds a password in an unattended file and uses it to log in as an administrator. This is a perfect example of turning enumeration results into privilege escalation.
WinPEAS automates almost all the manual checks we did earlier and many, many more. The Hacking Articles resource (LINK) provides an exhaustive list of what WinPEAS checks for under its "WinPEAS" section, which is a useful reference.
Conclusion
You have now learned the foundational process for post-exploitation enumeration on a Windows host. You've seen how to gather critical system intelligence both manually, using the operating system's own tools, and automatically, using powerful scripts like WinPEAS. This information-gathering phase is the most critical part of privilege escalation; without it, you're just guessing.
Key Takeaways:
- Enumeration is systematic: Whether on Linux or Windows, the goal is to systematically collect information about users, privileges, system configuration, software, and network settings.
- Manual commands build foundations: Commands like
whoami,net user,systeminfo, andnetstatare your bread and butter. They are always available and provide critical initial information. - Automation provides speed and depth: Tools like WinPEAS are indispensable for quickly performing hundreds of checks and flagging common misconfigurations with easy-to-read, color-coded output.
- The goal is to find an anomaly: You are hunting for anything out of the ordinary—a missing patch, weak service permissions, a password in a file—that you can leverage for your next move.
Next Lesson Preview:
In this lesson, you saw WinPEAS flag several potential vulnerabilities, including "insecure service permissions" and "unquoted service paths." These are not just theoretical findings. In our next lesson, we will dive deep into these two common misconfigurations and learn exactly how to exploit insecure service permissions and unquoted service paths to escalate privileges on Windows.