> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/windows-discovery/windows-os-enumeration.md). # Windows OS Enumeration ## General System Information ### Systeminfo Shows both hardware and software related information ```batch C:\>systeminfo Host Name: Offsec-Machine OS Name: Microsoft Windows 10 Pro OS Version: 10.0.19041 N/A Build 19041 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Multiprocessor Free Registered Owner: Offsec ... ``` ## Environment variables Show all environment variables with `set` ```bat set ```
Example run ```bat C:\> set ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\Offsec\AppData\Roaming asl.log=Destination=file CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files CommonProgramW6432=C:\Program Files\Common Files COMPUTERNAME=Offsec-Machine ComSpec=C:\WINDOWS\system32\cmd.exe DriverData=C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer FPS_BROWSER_USER_PROFILE_STRING=Default HOMEDRIVE=C: HOMEPATH=\Users\Administrator LOCALAPPDATA=C:\Users\Offsec\AppData\Local LOGONSERVER=\\Offsec-Machine NUMBER_OF_PROCESSORS=8 OneDrive=C:\Users\Offsec\OneDrive OS=Windows_NT Path=C:\Windows\system32;C:\Windows; ... ```
To show only variables that match certain letters (user in this case) ## Installed Programs ### List via cmd.exe To list the installed programs via `wmic` ```bat wmic product get name,version ``` To list all installed programs/applications from the registry ```bat reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall ``` ### List via PowerShell To list the installed programs via PowerShell and the [Win32\_Product](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394378\(v=vs.85\)) class ```powershell Get-CimInstance -Class Win32_Product | Select-Object Name, Version, Vendor ``` To list non-Microsoft programs via PowerShell ```powershell Get-CimInstance -Class Win32_Product | Where-Object {$_.Vendor -ne 'Microsoft Corporation'} | Select-Object Name, Version, Vendor ``` ## Logged on users ### Get Logged on Users from cmd.exe Different ways to list logged on users from `cmd.exe` [quser](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser) displays information about user sessions on a Remote Desktop Session Host server. ```batch quser.exe ``` [qwinsta](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/qwinsta) displays information about sessions on a Remote Desktop Session Host server. ```bat qwinsta.exe ``` ### Get Logged on Users from PowerShell Different ways to get logged on users from PowerShell: With `Get-CimInstance` and the [Win32\_LoggedOnUser](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-loggedonuser) class ```powershell Get-CimInstance -ClassName Win32_LoggedOnUser | Select Antecedent -Unique ``` Note that this command shows all sessions, even those that have been closed since the last time the computer rebooted! Another way is to use `Get-Process` with the `-IncludeUserName` parameter which **requires elevation** ```powershell Get-Process -IncludeUserName | Select-Object UserName, SessionId | Sort-Object SessionId -Unique ``` ## OS Version ### From cmd.exe You can show the Windows OS version with `ver` ```batch C:\>ver Microsoft Windows [Version 10.0.19045.4894] ``` ### From PowerShell ```powershell PS C:\> $PSVersionTable.BuildVersion Major Minor Build Revision ----- ----- ----- -------- 10 0 19041 4894 ``` ```batch C:\>set user USERDOMAIN=Origo USERDOMAIN_ROAMINGPROFILE=Origo USERNAME=Surf USERPROFILE=C:\Users\Surf ``` ## Processes ### Process info with Get-Process List all running processes and get info such as name and process ID ```powershell Get-Process ``` Get a lot of information on a specific process name ```powershell Get-Process | Select-Object * ``` ### Process info with wmic List process name together with process ID and parent process ID ```batch wmic process get name,parentprocessid,processid ``` Get commandline for specific process ID ```batch wmic process where processid=4766 get commandline ``` ## Scheduled Tasks ### Scheduled tasks info via schtasks.exe List all scheduled tasks, add `/v` for verbose output ```batch schtasks.exe /query ``` Get detailed information of a specific task ```batch schtasks.exe /query /tn /v /fo list ``` ## Services ### Service info via Get-CimInstance List **all** services with their state and pathnames using [Win32\_Service](https://powershell.one/wmi/root/cimv2/win32_service) ```powershell Get-CimInstance -ClassName win32_service | Select Name,State,PathName ``` List **running** services with their pathnames using [Win32\_Service](https://powershell.one/wmi/root/cimv2/win32_service) ```powershell Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} ``` ### Service info via Get-Service List all services ```powershell Get-Service ``` Get status of a specific service ```powershell Get-Service | Select-Object * ``` ### Service info via sc.exe List service status information including service type, state and PID for all services ```batch sc.exe queryex type=service state=all ``` The same, but for a specific service ```batch sc.exe queryex ``` To list the configuration of a specific service including start type, binary name and display name ```batch sc.exe qc ```
Example run Example for Windows Defender service (WinDefend) ```bat C:\>sc.exe qc WinDefend [SC] QueryServiceConfig SUCCESS SERVICE_NAME: WinDefend TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25050.5-0\MsMpEng.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Microsoft Defender Antivirus Service DEPENDENCIES : RpcSs SERVICE_START_NAME : LocalSystem ```
To list the privileges' of a specific service ```batch sc.exe qprivs ```
Example run Example for Windows Defender service (WinDefend) ```bat C:\>sc.exe qprivs WinDefend [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: WinDefend PRIVILEGES : SeImpersonatePrivilege : SeBackupPrivilege : SeRestorePrivilege : SeDebugPrivilege : SeChangeNotifyPrivilege : SeLoadDriverPrivilege : SeSecurityPrivilege : SeShutdownPrivilege : SeIncreaseQuotaPrivilege : SeAssignPrimaryTokenPrivilege : SeTcbPrivilege : SeIncreaseBasePriorityPrivilege : SeSystemEnvironmentPrivilege : SeTakeOwnershipPrivilege ```
### Service info via tasklist.exe List all processes and their related services ```batch tasklist.exe /svc ``` ## Shares ### Shares info via net.exe List local shares via net.exe ```batch net.exe view \\localhost ``` List all local shares, including the default ones ```batch net.exe view /all \\localhost ``` ## Resources **Get-CimInstance** - Microsoft Learn: **Sc.exe query** - Microsoft Learn: **Sc qc** - Microsoft Learn: **Sc queryex** - Microsoft Learn: **schtasks** - Microsoft Learn: **set** - Microsoft Learn: **systeminfo** - Microsoft Learn: **tasklist** - Microsoft Learn: **ver** - Microsoft Learn: