{"id":150,"date":"2021-11-12T16:44:50","date_gmt":"2021-11-12T16:44:50","guid":{"rendered":"https:\/\/www.davincivirus.com\/?p=150"},"modified":"2021-11-12T17:38:53","modified_gmt":"2021-11-12T17:38:53","slug":"recon","status":"publish","type":"post","link":"https:\/\/www.davincivirus.com\/?p=150","title":{"rendered":"Recon"},"content":{"rendered":"\n<p><strong>Net.exe User\/Group Enumeration<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>net group \"&lt;GROUPNAME&gt;\" \/domain         **Lists all members of a group on the domain\nnet localgroup administrators           **List admins on the local machine\nnet localgroup administrators \/domain   **List administrators in the domain\nnet user &lt;username&gt; \/domain             **List details about a domain user\nnet view \\\\COMPUTERNAME \/all            **List all shares provided by a remote computer<\/code><\/pre>\n\n\n\n<p><strong>DSQuery<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dsquery * -filter \"(objectclass=trusteddomain)\" -attr * -limit 2\ndsquery * -filter \"(&amp;(objectclass=user)(samaccountname=*da*))\" -attr samaccountname -d &lt;DOMAINAME&gt;\n        <em>Object Classes\n            -computer (Attrs: description, samaccountname, name, operatingsystem, dnshostname)\n            -user (Attrs: description, samaccountname, name)\n            -trusteddomain (Attrs: flatname, trustdirection)\n            -group (Attrs: description, samaccountname, name, member)<\/em><\/code><\/pre>\n\n\n\n<p><strong>WEVTUTIL<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil qe security \/rd:true \/f:text \/q:\"*&#91;System\/EventID=4624] and &#91;EventData\/Data&#91;@Name='TargetUserName']='QUERIED_USER_NAME']\" \/c:20     (TO QUERY EVENT LOGS)<\/code><\/pre>\n\n\n\n<p><strong>Windows SA<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ipconfig \/all\ntasklist \/v\n -tasklist \/v \/s \\\\&lt;REMOTEIP> <em>(Remote usage)<\/em>\nnet user USERNAME \/domain\nnetstat -anop tcp\nwdigest (if system)\nlogonpasswords (if system)\nscreenshot (cs plugin)\nkeylogger (cs plugin)\narchitecture (dir c:\/)\ntree.com \/F \/A &lt;C:\\FILEPATH>\nnet use ((as user) mapped shares)\nnet session (active sessions::best for file\/exchange server)\nPowershell.exe get-hotfix (get patches)<\/code><\/pre>\n\n\n\n<p><strong>Linux SA<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip addr\nps -ef\nnetstat -pantu\nuname -a (linux version)\nw (who is logged in)\nlast (recently logged in users)\ncat \/etc\/fstab (mounted shares \/ creds)\ncat \/etc\/hosts (DNS entries)\nhistory (or cat histfile)<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Net.exe User\/Group Enumeration DSQuery WEVTUTIL Windows SA Linux SA<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts\/150"}],"collection":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=150"}],"version-history":[{"count":7,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts\/150\/revisions"}],"predecessor-version":[{"id":171,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts\/150\/revisions\/171"}],"wp:attachment":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=150"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=150"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=150"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}