Grandpa_Initial_Foothold_WIN

Initial enumeration as the nt authority\network user, Continuing Post Enumeration

System

---

c:\windows\system32\inetsrv> systeminfo
 
host name:                 GRANPA
os name:                   Microsoft(R) Windows(R) Server 2003, Standard Edition
os version:                5.2.3790 Service Pack 2 Build 3790
os manufacturer:           Microsoft Corporation
os configuration:          Standalone Server
os build type:             Uniprocessor Free
registered owner:          HTB
registered organization:   HTB
product id:                69712-296-0024942-44782
original install date:     4/12/2017, 5:07:40 PM
system up time:            0 Days, 0 Hours, 2 Minutes, 32 Seconds
system manufacturer:       VMware, Inc.
system model:              VMware Virtual Platform
system type:               X86-based PC
processor(s):              1 Processor(s) Installed.
                           [01]: x86 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz
bios version:              INTEL  - 6040000
windows directory:         C:\WINDOWS
system directory:          C:\WINDOWS\system32
boot device:               \Device\HarddiskVolume1
system locale:             en-us;English (United States)
input locale:              en-us;English (United States)
time zone:                 (GMT+02:00) Athens, Beirut, Istanbul, Minsk
total physical memory:     1,023 MB
available physical memory: 801 MB
page file: Max Size:       2,470 MB
page file: Available:      2,336 MB
page file: In Use:         134 MB
page file location(s):     C:\pagefile.sys
domain:                    HTB
logon server:              N/A
hotfix(s):                 1 Hotfix(s) Installed.
                           [01]: Q147222
network card(s):           N/A

• Microsoft(R) Windows(R) Server 2003, Standard Edition
• 5.2.3790 Service Pack 2 Build 3790
• X86-based PC
• hotfix: Q147222

Networks

---

c:\windows\system32\inetsrv> netstat -ano
 
Active Connections
 
  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       668
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING       960
  TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING       404
  TCP    0.0.0.0:5859           0.0.0.0:0              LISTENING       4
  TCP    10.10.10.14:80         10.10.14.6:50698       ESTABLISHED     4
  TCP    10.10.10.14:139        0.0.0.0:0              LISTENING       4
  TCP    10.10.10.14:1030       10.10.14.6:9999        ESTABLISHED     2152
  TCP    127.0.0.1:1028         0.0.0.0:0              LISTENING       1936
  UDP    0.0.0.0:445            *:*                                    4
  UDP    0.0.0.0:500            *:*                                    404
  UDP    0.0.0.0:1027           *:*                                    732
  UDP    0.0.0.0:4500           *:*                                    404
  UDP    10.10.10.14:123        *:*                                    752
  UDP    10.10.10.14:137        *:*                                    4
  UDP    10.10.10.14:138        *:*                                    4
  UDP    127.0.0.1:123          *:*                                    752
  UDP    127.0.0.1:1029         *:*                                    752

127.0.0.1:1028

Users & Groups

---

c:\WINDOWS\Temp> net user 
 
User accounts for \\GRANPA
 
-------------------------------------------------------------------------------
Administrator            ASPNET                   Guest                    
Harry                    IUSR_GRANPA              IWAM_GRANPA              
SUPPORT_388945a0         
The command completed successfully.
 

• ASPNET
• Harry
• IUSR_GRANPA
• IWAM_GRANPA
• SUPPORT_388945a0

c:\WINDOWS\Temp> net localgroup
 
Aliases for \\GRANPA
 
-------------------------------------------------------------------------------
*Administrators
*Backup Operators
*Distributed COM Users
*Guests
*HelpServicesGroup
*IIS_WPG
*Network Configuration Operators
*OWS_209498277_admin
*Performance Log Users
*Performance Monitor Users
*Power Users
*Print Operators
*Remote Desktop Users
*Replicator
*TelnetClients
*Users
The command completed successfully.