> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/windows-privilege-escalation/manual-enumeration.md).

# Manual Enumeration

System, user, network, password, and AV

## System Enumeration

List all system information:

```bash
systeminfo
```

Grep the essence from `systeminfo`:

```bash
systeminfo | findstr /b /c:"OS Name" /c:"OS Versoin" /c:"System Type"
```

Enumerate patches:

```bash
wmic qfe
```

`wmic qfe` with better format:

```bash
wmic qfe Caption,Description,HotFixID,InstalledOn
```

Enumerate disks:

```bash
wmic logicaldisk
```

`wmic logicaldisk` with better format:

```bash
wmic logicaldisk get caption,description,providername
```

List only the drive names (such as "C:" and "D:"):

```bash
wmic logicaldisk get caption
```

## User Enumeration

Enumerate the current user:

```bash
whoami
```

Enumerate the current user's privilege:

```bash
whoami /priv
```

Enumerate the current user's groups:

```bash
whoami /groups
```

Enumerate all users:

```bash
net user
```

Enumerate a specific user:

```bash
net user <username>
```

Verify the administrator group:

```bash
net localgroup administrators
```

## Network Enumeration

Enumerate network information:

```bash
ipconfig
```

`ipconfig` with more details:

```bash
ipconfig /all
```

Enumerate the ARP table:

```bash
arp -a
```

Enumerate the routing table:

```bash
route print
```

Enumerate open ports:

```bash
netstat -ano
```

## Password Hunting

Search for the keyword "password" in files with certain file extensions:

```
findstr /si password *.txt *.ini *.config
```

Search for password in registry:

```bash
reg query HKLM /f password /t REG_SZ /s
```

## AV Enumeration

Search the phase "password" in text files (in the current directory):

```bash
findstr /si password *.txt
```

Enumerate Windows Defender:

```bash
sc query windefend
```

Enumerate all running services:

```bash
sc queryex type= service
```

Enumerate firewall (older machines):

```bash
netsh firewall show state
```

Enumerate firewall (newer machines):

```bash
netsh advfirewall firewall dump
```

Enumerate firewall configuration:

```bash
netsh firewall show config
```