Manual Enumeration Techniques

Systematic reconnaissance to find privilege escalation vectors

What You'll Discover

🔧 Try This Right Now

Run a quick system enumeration to identify potential attack vectors:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
whoami /priv
net user %username%
wmic qfe list brief

You'll see: OS version (for kernel exploit matching), your privileges, group memberships, and installed patches (for missing patch identification).

Skills You'll Master

Understanding Manual Enumeration

Manual enumeration is a systematic process of gathering information about a Windows system to identify privilege escalation paths. You're looking for misconfigurations, missing patches, weak permissions, and stored credentials. Every command tells you something about the attack surface.

System Information

Start with understanding what you're working with:

# Full system information
systeminfo

# OS and architecture
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

# Hostname and domain
hostname
echo %USERDOMAIN%

# Installed patches (for kernel exploit matching)
wmic qfe list brief
wmic qfe get Caption,Description,HotFixID,InstalledOn

# Environment variables (may reveal installed software paths)
set

User and Group Enumeration

Understanding user context and available accounts:

# Current user context
whoami
whoami /priv
whoami /groups
whoami /all

# Local users
net user
net user administrator

# Local groups
net localgroup
net localgroup administrators
net localgroup "Remote Desktop Users"

# Currently logged on users
query user
qwinsta

Network Information

Network configuration reveals pivot opportunities and listening services:

# IP configuration
ipconfig /all

# Routing table
route print

# ARP cache (other hosts on network)
arp -a

# Listening ports and connections
netstat -ano
netstat -ano | findstr LISTEN

# Firewall rules
netsh advfirewall show currentprofile
netsh advfirewall firewall show rule name=all

Running Processes and Services

Processes reveal installed software and potential targets:

# Running processes
tasklist
tasklist /v
tasklist /svc

# Services
sc query
sc query state= all
wmic service get name,displayname,pathname,startmode

# Find unquoted service paths
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows\\" | findstr /i /v """

# Service permissions (requires accesschk from Sysinternals)
# accesschk.exe -uwcqv "Authenticated Users" * /accepteula

Scheduled Tasks

Scheduled tasks may run as SYSTEM and execute writable scripts:

# List scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /fo TABLE

# Check for tasks running as SYSTEM
schtasks /query /fo LIST /v | findstr /i "SYSTEM"

# PowerShell alternative
Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq "SYSTEM"}

Installed Software

Installed applications may have known vulnerabilities:

# Installed software
wmic product get name,version
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s

# 32-bit apps on 64-bit
reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s

# Program Files directories
dir /b "C:\Program Files"
dir /b "C:\Program Files (x86)"

Tools and Techniques

Credential Hunting

Search for stored credentials and sensitive files:

# Saved credentials
cmdkey /list

# Search for password in files
findstr /si "password" *.txt *.xml *.ini *.config
findstr /spin "password" *.*

# Common credential locations
type C:\Windows\Panther\Unattend.xml
type C:\Windows\Panther\Unattended.xml
type C:\Unattend.xml
type %WINDIR%\repair\SAM
type %WINDIR%\repair\system

# IIS configuration
type C:\inetpub\wwwroot\web.config
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config

# Registry stored passwords
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul

Registry Enumeration

Registry keys that enable privilege escalation:

# AlwaysInstallElevated (allows .msi to run as SYSTEM)
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# AutoRuns (persistence locations)
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# Service registry keys
reg query "HKLM\SYSTEM\CurrentControlSet\Services" /s

# UAC settings
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"

PowerShell Enumeration

PowerShell provides additional enumeration capabilities:

# PowerShell version and execution policy
$PSVersionTable
Get-ExecutionPolicy

# List drives
Get-PSDrive

# Find writable directories in PATH
$env:PATH.split(';') | ForEach-Object { $path = $_; try { [io.file]::OpenWrite("$path\test.txt").close(); Remove-Item "$path\test.txt"; Write-Host "Writable: $path" } catch {} }

# Search for interesting files
Get-ChildItem -Path C:\ -Include *.txt,*.xml,*.config,*.ini -File -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern "password"

# List services with unquoted paths
Get-WmiObject win32_service | Select-Object Name,PathName | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }

Real-World Attack Scenarios

Defensive Countermeasures

Frequently Asked Questions

🎯 Manual Enumeration - Locked In!

You now have a systematic approach to enumerating Windows systems using only built-in commands. No tools to upload, no detection from AV - just native Windows commands that reveal everything you need.

Ready to automate with WinPEAS and PowerUp →