# Windows ## Tips ### Multiple Users If there's more than one user that needs to compromised before getting root, enumerate each user as they might have access to something new that was protected before. ### Temporary Account If some info suggests that an account is only temporary, then they might have some misconfigurations or rights that other users don't have.\ Especially if they're created by a user which is in a group that has higher privileges. ## DNS ```bash # Normal DNS request dig A @ # Get all available entries dig any server.local @ # Zone transfer without domain dig axfr @ # Zone transfer with domain dig axfr @ # Subdomain scan gobuster dns -d domain.local -t 25 -w # Normal nmap scan nmap -sSU -p53 --script dns-nsec-enum --script-args dns-nsec-enum.domains=paypal.com # Metasploit auxiliary/gather/enum_dns ``` ### Attacks #### Zone Transfer DNS servers contain a *Zone* file that replicates the map of the domain.\ Only the server itself should have access to it, but if it's misconfigured anyone can request the file and get the list of all the sub-domains. ### Ports ``` 53 DNS ``` ## LDAP ```bash # Normal enumeration nmap -sT -Pn -n --open -p389 --script ldap-rootdse # Anonymous access ldapsearch -H ldap://: -b "dc=domain,dc=local" -x ldapsearch -H -x -s base namingcontexts ldapsearch -H -x -b "dc=domain,dc=local" ldapsearch -H -x -b "dc=domain,dc=local" '(objectClass=person)' ldapsearch -H -x -b "dc=domain,dc=local" '(objectClass=user)' ldapsearch -H -x -b "dc=domain,dc=local" '(objectClass=group)' # Connect and enumerate with username and password ldapsearch -H ldap:// -b "dc=domain,dc=local" -D "cn=username,dc=domain,dc=local" -w -x ldapsearch -H -D 'user@domain.local' -w -b "DC=domain,DC=local" # https://github.com/ropnop/windapsearch windapsearch.py --dc-ip -d domain.local -u "" -U ``` ### Notes #### Passwords in Result If an `ldapsearch` query comes back with users, try checking whether they have any password related options set. **Example(s)** ``` cascadeLegacyPwd: BASE64 STRING ``` #### Info Field Log of a query might contain some info in the user.\ In many CTF-s they put passwords there. ​ ### Ports ``` 389 LDAP 636 LDAPS (LDAP over SSL/TLS) ``` ## SMB ### Enumeration ```bash # Get shares smbmap -H smbmap -H -u -p # More enumeration enum4linux -U -o enum4linux -a nmap --script "safe or smb-enum-*" -p 445 # Enumerate users crackmapexec smb -u -p --users crackmapexec smb -u -p --rid-brute crackmapexec smb -u -p --groups crackmapexec smb -u -p --local-users # Null session attack smbclient -N -L \\\\ crackmapexec smb -u "" # Establishing connection smbclient // -U smbclient.py /:@ ``` ### Ports ``` 139 SMB 1.0 session services 138 SMB over UDP 445 SMB main ``` ## Kerberos ### GetNPUsers.py Impacket's `GetNPUsers.py` will attempt to harvest the non-preauth AS\_REP responses for a given list of usernames ```bash GetNPUsers.py domain.local/ -dc-ip -usersfile -format hashcat -outputfile ``` ### Kerberoasting Kerberoasting is a post-exploitation attack technique that attempts to obtain a password hash of an Active Directory account that has a Service Principal Name. ```bash GetUserSPNs.py -request -dc-ip domain.local/user -save -outputfile ``` #### Cracking The Ticket ```bash hashcat -m 13100 --force ``` #### Troubleshooting **NTLM hash disabled** Use the `-k` option as well as `-dc-host` instead of `-dc-ip`. As the latter will break the authentication and throw an error. ### References * ### Ports ``` 88 Kerberos key distribution center (KDC) ``` ## RPC ### Enumeration ```bash # USERS querydispinfo enumdomusers ## Details queryuser ## GGroups queryusergroups ## SID lookupnames ## Aliases queryuseraliases builtin # GROUPS enumdomgroups ## Details querygroup ## Members querygroupmem # SHARES netshareenumall ## Details netsharegetinfo ``` ### Establishing Connection ```bash # Null authentication rpcclient -U '' -N # With creds rpcclient -U ``` ### NIS ```bash # Install NIS tools apt-get install nis # Ping the NIS server to confirm its presence ypwhich -d # Extract user credentials ypcat –d –h passwd.byname ``` ### Ports ``` 135 RPC EPM 445 SMB 593 RPC over HTTPS ``` ## Analyse Office Files Modern `Office` documents are just zip archives with XML files so, just unzip it and look for data within the XML files. ### Unzip ```bash unzip ``` ### oletools oletools is a package of python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages ```bash # Download tools sudo pip3 install -U oletools # Extract macros olevba -c ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://security-vault.gitbook.io/hacking-methodology/reconnaissance/windows.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.