Before we get too far underway, I do want to show you a neat little command. We're going to be taking
a look at the actual desktop of the system we're attacking, that BWAP Windows 10. We simply do
that by typing in screen share inside of the regular meter reader prompt. Now, it's going to
think about this for a second and open it up inside of a web browser. You may think, well,
that's just a screenshot, but it is actually streaming and I can prove it. We're going to go
and change over to the test manager view inside of the 10. You can see that, bam, it did it inside
of our player inside of Kali. It uses just the regular default browser that is set up inside
of Kali. Now, the one thing I want to stress about this first is that it takes up a lot of resources,
as you can see with the process viewer up at the top of Kali, as far as resources go. So,
use this sparingly. I only use it just in case I need to verify that I didn't do something like
open up the Windows versioning information for the user to see on the target system.
Now, going and closing that, you can see that we're back inside of our meter reader and it
will close out to where we can actually go inside and do more commands here momentarily,
but it will take a second. If it doesn't do it right away, just hit control C and you're out
of it and no other worries. Now, with all that being said, it's time for us to start getting
some basic system information about the system itself and its current configuration. Now,
we're not going to spend too much time on this because there's other skills that we're going
to be going into. I just want to introduce the highlights before we start digging into
individual categories here. First and foremost, one of the things that we want to take a look at
is getting basic system information and configuration. We can do this either through
meter reader or shell. Now, I'm going to be showing you through shell, which is the command prompt.
The reason I like to stay in shell or PowerShell whenever I'm doing a session attack like this
is because I need to be more familiar with the commands themselves and it makes it a little bit
easier on me as well too. When you run meter reader commands, you got to stay within that
basic meter reader command syntax that you're used to for that. Inside of shell,
it runs just like command prompt, except for the fact that you can press up and down for some
reason. Now, right out of the gate here, just do remember it's being basic like running command.
So, you can start off with system info. Now, we did earlier sysinfo inside of meter reader.
The difference being when we run this here, it will generate a more detailed versioning of what
the system is comprised of as far as details go. For instance, as we zoom in, you can see that
we have Windows 10 Pro detailed down along with the OS version, what type of build, product ID,
along with all the times that was related to the install date, the last boot time, etc. It even
goes so far as to give us hardware specifications that we could use for information later on
concerning actual drivers, along with directory listings and everything like that. But what I
want to go down to here is right here, and it shows us the actual hotfixes that are installed
on the specified system. We start to get an idea now of what vulnerabilities are open to us,
because as we learned in previous skills, we can actually go through here and do a vulnerability
assessment. Now, the vulnerability assessment only works as far as what permissions that we have
to scan that system. This goes a little bit deeper in our understanding of the system,
and you would be able to get domain information from here as well too, along with down here at
the bottom, knowing your full-on network information. So, the more NICs and things
that you have like that, the more information you get for IP configuration, along with if it's a
Hyper-V server, or if it's running Hyper-V for those different virtual machines out there. So,
if we did this on the actual Adept Lab itself, as we logged into, you would see all the different
OSs that were running, like Kali. We go a little bit further to get more detail about the operating
systems hotfixes by going in and using WMIC commands, W-M-I-C, W-M-I-C, as some people
pronounce it. And this is a little bit more into the hotfixes area that we will touch on later,
and it also highlights the fact that we can use WMIC commands inside of shell versus inside of
meterpreter. So, when you run this, sorry, no slash W-M-I-C-Q-F-E, and when you run this,
you get a more detailed version of the actual hotfixes that are installed, along with whenever
they were ran and installed, the last update that was on it. Let me zoom in for you real quick.
Here, you can see that we have KB5066130. It was installed by the actual system itself,
which means Windows Update is enabled on this system. And it was done on October 15, 2025,
and you can go through and get more information about that by doing your due diligence research
for those different hotfixes. But it's pretty self-explanatory and gives you more detailed
information about the patches that are installed on the system outside of what versioning windows
you have and what comes with the loaded on there. And the last couple of things we're going to hit
on in here are understanding what's available to us inside of the local security policy.
Now, there's different and multiple different ways to be able to slice this orange,
but what I really want to point out is that when you run GP commands for global policy or
group policy, that those include the local security policy as well, and that's something
to keep in mind. So, in this particular instance, we can run GP result slash R, and this will tell us
information pertaining to what policies are applied to the actual local system itself,
along with information pertaining to those policies. For instance, by looking at this one,
we can see there are no applied group policy objects because it's P&A, and it gives us
information about the actual system, and then the user is a part of the following security groups.
So, not only are we local administrator, you can also tell by more detailed explanation here,
what accounts that you're built into as well, and if you're a part of a domain account,
because if this system is part of the domain, this command right here will let you know inside
of this output. Now, let's say you want to get a little bit more detailed in terms of
what settings are done inside of that group policy. So, GP result slash V will do a verbose
output of different settings within those group policies that are applied. So, as I zoom in here,
you can see that, like for instance, Internet Explorer security, Internet Explorer programs,
et cetera, et cetera. If there were any policies applied to the system, you would see what
specifically is being brought down from local security policy outside of default. The same
with group policy objects that have been changed as well. And lastly, in this portion of the skill,
I want to show you that you can actually dig into the registry itself, but this is going to require
a little bit of knowledge of where the registry is actually sitting at. So, we can see here that
I'm doing a reg query command inside of the shell, and I'm going all the way down to current
version run, and I'm doing a slash S on it. And this slash S is going to tell us what keys are
in there and basically do an expansion. Otherwise, it would just tell us what folders are in there.
Here, you can see inside of current version run that we have security health and the actual
settings for that as far as like where it's going to for file execution. What we're taking a look at
here is the actual run commands for when a system starts up. You could do run once, you could do
other startup mechanisms, but this would be a place for you to use those basic run reg edit
commands inside a shell to make any changes that you want to make sure that you have persistence
inside of the actual target system.