Before exploiting a Windows system, you need to understand what you're working with. Enumeration is the process of gathering information about the system, users, permissions, and potential vulnerabilities. The better your enumeration, the more likely you'll find an escalation path.
Order Matters
Start with low-noise enumeration (whoami, systeminfo) before running automated tools like WinPEAS. Get the basics first, then go deep.
System Information
Check .NET Versions
Many exploitation tools require specific .NET versions. Check what's installed: dir C:\\Windows\\Microsoft.NET\\Framework*
User Information
Understanding Privileges
Network Information
Services and Processes
Unquoted Paths
Look for service paths with spaces that aren't quoted. Example: C:\\Program Files\\My App\\service.exe should be quoted. If not, we can potentially hijack it.
Installed Software
Interesting Files
Registry Credentials
Enumeration Methodology
Windows Enumeration Flow
1
Who Am I?whoami /all - get user, groups, privileges
2
System Infosysteminfo - OS version, patches, domain
3
Users/Groupsnet user, net localgroup - enumerate accounts
4
Networkipconfig, netstat - network config and connections
5
Servicessc query, wmic - find potential service exploits
6
SoftwareInstalled programs - outdated vulnerable apps
7
CredentialsSearch files and registry for passwords
8
AutomatedRun WinPEAS for comprehensive checks
Knowledge Check
Key Takeaways
- whoami /all shows your privileges - check for SeImpersonate
- systeminfo reveals patch level and potential kernel exploits
- Services with unquoted paths or weak permissions are escalation vectors
- Always search registry and files for stored credentials
- net localgroup Administrators shows who has admin access