Local

Privs

whoami /privs

whoami /all

Process

ps

Seatbelt

Seatbelt.exe -group=system

On Havoc

bofbelt

On Sliver

seatbelt -p C:\\Windows\\System32\\werfault.exe -- "-group=user"

SharpUp

On Havoc

dotnet inline-execute /home/jay/prolabs/cybernatics/SharpUp.exe audit

On Sliver

execute-assembly /home/jay/prolabs/cybernatics/SharpUp.exe audit
sharpup audit

PrivescCheck

Import-Module ./PrivescCheck.ps1
Invoke-PrivescCheck

Scheduled Task


Get-ScheduledTask

# Get the scheduled task
$task = Get-ScheduledTask -TaskName "OpenEmail"

# Get the action associated with the task
$action = $task.Actions | Select-Object -First 1

# Extract the executable path from the action
$executablePath = $action.Arguments.Split('"')[1]

# Output the executable path
Write-Output "Executable Path: $executablePath"

Network Enumeration

netstat -na
arp -a
systeminfo | findstr Domain
Get-ADUser -Filter *
Get-ADUser -Filter * -SearchBase "CN=Users,DC=THMREDTEAM,DC=COM"
Get-ADUser -Filter * -SearchBase "OU=THM,DC=THMREDTEAM,DC=COM"
wmic /namespace:\\root\securitycenter2 path antivirusproduct
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct
Get-Service WinDefend
Get-MpComputerStatus | select RealTimeProtectionEnabled
 Get-MpThreat
Get-NetFirewallProfile | Format-Table Name, Enabled
Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled False
Get-NetFirewallRule | select DisplayName, Enabled, Description
Test-NetConnection -ComputerName 127.0.0.1 -Port 80
(New-Object System.Net.Sockets.TcpClient("127.0.0.1", "80")).Connected
Get-NetFirewallRule | findstr "port"
Get-EventLog

Applications Enumeration

wmic product get name,version
Get-ChildItem -Hidden -Path C:\Users\kkidd\Desktop\
  • Lists all services that are currently running on the machine.
net start
  • Retrieves information about a specific service (THM Demo), showing its name and path to the executable.
wmic service where "name like 'THM Demo'" get Name,PathName
Get-Process -Name thm-demo
netstat -noa |findstr "LISTENING" |findstr "3212"

Domain Joined

Powerview

Powerview Enumeration