OPSECTLAS you are here: Windows
Windows

Decision Tree: Shell on Windows → What First?

reference

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

reached from Foothold (Windows)

needsFoothold (Windows)

You have a shell on a Windows host (a user session, maybe a meterpreter session). Get your bearings, automate the sweep, then escalate.

start Shell on Windows, a user session (maybe a meterpreter session)

  1. 1
    Immediate Situational Awareness (whoami /priv, systeminfo, patch level)
  2. 2
    WinPEAS (automate the whole enumeration sweep)
  3. 3
    Check your token and services
    • SeImpersonatePrivilege → Potato Attack Chain (a service account? Potato to SYSTEM)
    • Service Misconfigurations (weak service perms, unquoted service paths)
  4. 4
    Hunt for credentials
    • Registry Password Hunting (autologon, VNC, PuTTY secrets)
    • Stored Credentials (cmdkey, Credential Manager, config files)
  5. 5
    Token Impersonation · Incognito (reuse a token you can already reach)
connected
follows
PrivEsc Summary (Pointers)