hackalex
ES
Menu

Pasos Recomendados

Technical note

  • systeminfo
  • Usar wesng <systeminfo.txt>
  • cmdkey /list
  • whoami /all
  • unattend.xml
  • ipconfig
  • env / Get-ChildItem -Path Env:
  • netstat -ano (puertos abiertos)
  • Ver Documents del usuario pwneado
  • wmic qfe
  • Tirar Inveigh
  • Hacer net user (a veces nxc no detecta RDP activado)
  • net user <user>
  • TIRAR MIMIKATZ
  • Ver objetos borrados en AD:
powershell
Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects -Properties lastKnownParent,whenChanged | Format-Table Name,DistinguishedName,whenChanged,lastKnownParent
terminal
ldapsearch -x -H ldap://172.16.139.3 -D 'divanov@ad.trilocor.local' -w 'Dimitris2001' -b "CN=Deleted Objects,DC=ad,DC=trilocor,DC=local" -E '1.2.840.113556.1.4.417' "(isDeleted=TRUE)" distinguishedName sAMAccountName lastKnownParent