> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/windows-discovery/windows-file-enumeration.md).

# Windows File Enumeration

## Locate flag files

Locate flag files with the `where` command

```
where /R C:\ flag*
```

The filename is case-insensitive.

## List file permissions

### List file permissions via icacls.exe

To check the permissions of a file or directory

```batch
PS C:\Users\dave> icacls "C:\xampp\apache\bin\httpd.exe"
C:\xampp\apache\bin\httpd.exe BUILTIN\Administrators:(F)
                              NT AUTHORITY\SYSTEM:(F)
                              BUILTIN\Users:(RX)
                              NT AUTHORITY\Authenticated Users:(RX)

Successfully processed 1 files; Failed processing 0 files
```

Common permissions codes

<table><thead><tr><th width="115">Mask</th><th width="297">Permissions</th></tr></thead><tbody><tr><td>F</td><td>Full access</td></tr><tr><td>M</td><td>Modify access</td></tr><tr><td>RX</td><td>Read and execute access</td></tr><tr><td>R</td><td>Read-only access</td></tr><tr><td>W</td><td>Write-only access</td></tr></tbody></table>

## Resources

**icacls** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls>

**where** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/where>