The Nen-Book
LinkedinTwitterMediumGithubHTB
  • Whoami
  • Walkthroughs & Writeups
    • My CTF Methodology
    • Hack The Box Machines
      • Administrator
      • Escape two
      • Cicada
      • HTB Permx Machine(CVE-2023–4220 Chamilo LMS)
    • Intigriti 1337Up 2024
      • Intigriti 1337Up 2024-CTF OSINT Challenges
      • Intigriti 1337Up Live 2024-CTF Web Challenges
    • CyCTF Quals 2024
      • OSINT Challenges CyCTF Quals 2024
      • Old Friend OSINT Challenge CyCTF 2024 Quals Writeup
    • PicoCTF
      • PicoCTF 2024 Web Exploitation Challenges
      • PicoCTF 2024 General Skills Challenges
      • PicoCTF 2021 Web Exploitation Challenges Walkthrough
      • PicoCTF 2019 Web Exploitation Challenges
  • Web_AppSec
    • Web_Recon
    • SQli
    • ATO
    • Backend_Technology_Tricks
    • XSS
    • SSRF
    • CSRF
    • XXE
    • SSTI
    • Insecure_Deserialization
    • Open_Redirects
    • Information_Disclosures
    • Rate_Limiting
    • Clickjacking
    • Broken Access Control & IDORS
    • Bash_Scripting
    • Authentication_Vulnerabilities
    • App_Logic_Errors
  • Network & AD Pentesting
    • Scanning & Enumeration
    • Active_Directory
      • AD_Overview_&_ Lab Build
      • AD_Initial_Attack_Vectors
      • AD_Post-Compromise_Enumeration
      • AD_Post-Compromise_Attacks
    • Buffer_Overflow_Attacks
    • Web_Applications
    • Privilege_Escalation
  • Cloud_Security
    • AWS Pentesting
  • APISec
    • API_Recon
    • Broken_Access_Control & Info_Leaks
  • Code_Review
    • Source_Code_Review_101
    • Code Review Tools
  • Bug_Hunting
    • Picking_A_BugBounty_Program
    • Writing_A_Good_Report
  • MITRE ATT&CK
    • Introducing the ATT&CK Framework
    • MITRE Engenuity
    • Threat-Informed Defense
Powered by GitBook
On this page
  • Network Enum
  • Firewall Enum

Was this helpful?

Edit on GitHub
  1. Network & AD Pentesting

Privilege_Escalation

PreviousWeb_ApplicationsNextCloud_Security

Last updated 5 months ago

Was this helpful?

first thing we need know which user we are currently using by commands: whoami and net user to get more details(Windows ) and on linux we can use id command for more details or reading passwd file

cat /etc/passwd

then we need know which machine we are on and what it can do so we can check it’s name by hostname command in both linux and Windows

but we need more info about the OS and Kernal so we will use systeminfo(Windows) command what concern us here is (OS Name,OS Version,System Type)

systeminfo

in Linux use uname -a

uname -a
or 
cat /etc/issue

Network Enum

Ok so now we know some info about the OS then we start to look for running processes in order to find any process that u can deal with and at the same it uses higher privileges on Windows :

tasklist /svc

it shows u the procesess that are running on the same account not the higher priv

on linux :

ps aux

since we control a machine in internal network we need to scan the network for new interesting hosts or ports and perform pivoting

in windows :

ipconfig /all
route print
netstat -ano

in linux:

for Open Ports:

ss -anp

Firewall Enum

Untitled
Untitled
Untitled
Untitled
Untitled
Untitled
Untitled
Untitled
Untitled
Untitled
Untitled