Hello! Welcome back to our course.
In the last lesson, you successfully used Hydra to find valid credentials and gain a shell on a target system. That's a huge step – you've achieved initial access. But what happens now? You're on the inside, likely with a simple command prompt, and you know almost nothing about the machine you've compromised. This is where post-exploitation begins.
Today's lesson focuses on that crucial next step. Our objective is to perform basic post-exploitation enumeration on a compromised host to gather system information. This is the intelligence-gathering phase inside a network. The information you find here will dictate your next moves, whether it's escalating privileges, moving to other systems, or finding the valuable data you're after.
We'll cover fundamental manual commands and introduce the concept of automated enumeration scripts for both Linux and Windows environments.
1. The Post-Exploitation Mindset: Key Questions
Once you have a shell, your primary goal is to build situational awareness. You need to answer a few fundamental questions:
- Who am I? What user account am I running as? What are my privileges?
- Where am I? What is the hostname and IP address of this machine? Is it a physical server, a VM, or a cloud instance?
- What's on this system? What is the OS version? What software is installed and what services are running? Are there any interesting files?
- Who else is here? What other users have accounts on this system? Who is currently logged in?
- What are the defenses? Is there an antivirus or firewall running?
The first and most important question is about your privilege level. Your ability to answer the other questions often depends on it.
This document, 'Post-exploitation', provides a good overview of the initial steps after compromise. We'll start by focusing on how to assess your access level.
Read the section titled 'Assessing the level of access', starting from 'The first question the attacker needs to ask...' down to '...any other uid indicates that normal Unix access controls apply.' This section explains the critical difference between a superuser (root/Administrator) and a regular user, and introduces the first commands you should always run.
2. Enumeration on a Linux Host
Let's assume your initial shell is on a Linux machine. Linux systems are rich with information stored in plain text files, which makes manual enumeration very effective.
Manual Enumeration: Living off the Land
"Living off the land" refers to using only the built-in tools available on the target system to conduct your activities. This is stealthy and effective.
Here are the core areas to investigate manually:
-
System & User Information:
whoami/id: Confirms your current user, UID, and group memberships. A UID of0means you are root.uname -a: Displays the kernel version, OS, and architecture. This is critical for finding kernel exploits.cat /etc/passwd: Lists all local users on the system.history: Shows the command history for the current user. You might find passwords, hostnames, or other sensitive information.
-
Hardware & Filesystem:
cat /proc/cpuinfo: CPU details.free -m: Memory usage.df -h: Mounted filesystems and disk space.
-
Network Configuration:
ip aorifconfig: Shows network interface configurations.netstat -antporss -antp: Lists active network connections and listening ports, along with the processes using them. This is vital for discovering other services.
The following video demonstrates some of these initial manual enumeration steps in a practical context, including searching for sensitive data in files.
Linux Red Team Privilege Escalation Techniques - Kernel Exploits & SUDO Permissions
In this clip from a HackerSploit video on privilege escalation, the presenter starts with the essential first steps of enumeration on a newly compromised Linux host.
Watch from 05:01 to 09:46. Pay attention to how the presenter checks for the .bash_history file and uses grep to recursively search for passwords in configuration files. This is a classic bug bounty technique.
Automated Enumeration Scripts
Manually running all these commands can be tedious. To speed things up, pentesters use enumeration scripts. These are typically simple shell scripts that run a battery of checks and highlight potentially interesting results. LinEnum and linPEAS are two of the most popular.
This next clip shows LinEnum in action. Notice how it automates the checks we just discussed (kernel version, user info, etc.) and looks for common privilege escalation vectors.
Linux Red Team Privilege Escalation Techniques - Kernel Exploits & SUDO Permissions
Let's see how an automated script like LinEnum can streamline our information gathering.
Watch from 15:29 to 19:17. Focus on: How the script is downloaded to the target machine (wget). How it's made executable (chmod +x). The type of information it gathers automatically, such as kernel details and, crucially, misconfigured sudo permissions.
The output of these scripts is designed to draw your attention to weaknesses.
3. Enumeration on a Windows Host
Windows enumeration is conceptually the same as Linux, but the commands are different. The command prompt and, more powerfully, PowerShell are your primary tools.
Manual Enumeration with cmd and PowerShell
Similar to Linux, we'll start with the built-in command-line tools. The video below provides a fantastic walkthrough of the essential manual enumeration commands on Windows.
Windows Post Exploitation - Local Enumeration
This HackerSploit video is dedicated to manual Windows post-exploitation enumeration. It covers the core commands you need to know.
Watch the following segments to see demonstrations of key commands: User/Privilege Info (02:58 - 07:24): whoami, whoami /priv, net users, net user [username]. System/Patch Info (08:55 - 12:00): systeminfo to find the OS version and hotfixes (patches). Processes/Services (12:00 - 13:16): tasklist /svc to see running processes and their associated services. Network Info (13:16 - 16:32): ipconfig /all, route print, and netstat -aano to map network configuration and listening ports. Security Posture (16:32 - 18:26): sc query windefend and netsh firewall show state to check the status of AV and the firewall.
For your reference, this web page provides a convenient list of many of these commands, including the powerful whoami /all which combines user, group, and privilege information.
Windows Enumeration and Exploitation
The 'Windows Enumeration and Exploitation' guide provides a great reference list for manual enumeration commands.
Review the list of commands under the 'Enumeration' heading. Compare these to what you saw in the video. The guide also introduces winPEAS, which is the Windows equivalent of the LinEnum/linPEAS scripts we saw for Linux.
Test your understanding!
You've just gained a low-privilege shell on an unknown system. You don't know if it's Windows or Linux. What is the very first command you might run to figure out the OS and your current privilege level, and what would be the different commands for each OS?
Show answer
A good first command to try is whoami. It exists on both Windows and modern Linux systems.
- If you're on Linux, the next immediate command would be
idto check your User ID (UID) and group memberships. A UID of0means you are root. Then you'd rununame -ato get detailed OS/kernel info. - If you're on Windows, after
whoami, you would runwhoami /privorwhoami /allto see your integrity level and privileges. Then you'd runsysteminfo | findstr /B /C:"OS Name"to get the OS version.
The goal is to first identify the user context and then the operating system.
4. Framework-Based Enumeration: Metasploit
If you gained your shell using the Metasploit Framework, it has its own powerful post-exploitation modules that automate enumeration. If your shell is a Meterpreter session, you get even more integrated commands.
The hashdump command, for example, is a post-exploitation action that attempts to extract password hashes from the system—a direct result of successful enumeration.
Let's briefly look at how a framework like Metasploit handles post-exploitation. This resource shows how to use Metasploit's post-exploitation modules to gather system information and dump password hashes.
Read the sections 'MSF post exploitation modules' and 'Password hash dumping'. You don't need to execute the commands, but understand that Metasploit offers modules like enum_system, enum_network, and hashdump to automate the collection of the same information we gathered manually.
Conclusion
You have now learned the fundamental process of post-exploitation enumeration. This is not a one-time task but an iterative process. The more you learn about a system, the more specific your queries become, leading you closer to your objective.
Key Takeaways:
- Post-exploitation enumeration is about building situational awareness after gaining initial access.
- The first step is always to determine who you are and what privileges you have (
id,whoami /all). - Manual enumeration ("living off the land") is a core skill using built-in commands like
uname,systeminfo,netstat, andtasklist. - Automated scripts like
LinEnumandwinPEASdrastically speed up the process by running hundreds of checks and highlighting interesting results. - Frameworks like Metasploit provide their own modules for systematic post-exploitation gathering.
Next Lesson Preview:
The information you gather during enumeration is the foundation for your next attack. In our next lesson, we will use this newfound knowledge to identify and exploit default credentials and common misconfigurations in network services. You'll see how discovering a specific service version with netstat or tasklist can lead directly to your next point of compromise.