Last but not least, and we're going to only touch on this for a very short amount of time before we
start moving on, because we can actually do this in more detail in the upcoming skills. We want to
take a look at some of the cached or stored credentials on the actual system itself without
going too far into actually doing like a hash dump, because we've covered hash dump already
and we know how to perform that. So just real quick, while we're still in command prompt, I
want to do a command key with a forward slash list. And what this is going to tell us is currently
stored credentials on the actual system itself. As we zoom in on this, we can see what the actual
target is. Basically it's a Microsoft account type is generic user, and that's the user for it. And
it's for that login. And we can get this for basically all the different services that are
running either locally or remote on the system. The reason this one's not too populated is because
it's a dummy machine that we're using as practice. Now, and I'm not going to run this on a live
system because I've already had my hand slapped on that with a target live system before. Now,
you also may be asking another very important question, and I'm glad you brought this up. And
that is, why are we running a lot of these using command prompt commands instead of using PowerShell?
And that's a very key question that we're finally going to address because I know it's been burning
your minds up to this point. Permissions. Basically up to this point, even though we
have gained access to the system and we are logged in as learner on that system with administrative
privileges, we're doing this under the idea that we may not always be logged on as an administrator.
So we're trying to restrict ourselves to user permissions and get as much information as
possible in the purposes of enumeration. So imagine that you've already got dummy.exe to run
on a target system, but it's a regular domain user. You might not be able to get a lot of
information that you want using PowerShell because it requires elevated privileges,
but you want to perform enumeration to see what possibilities exist out there for you for
potentially elevating your access later on. The enumerations we've done up to this point for
information gathering after even though we're in the target system is basically for us to be able to
run it as the lowest or least privileged user on that particular system because you're not always
going to bust into an administrator account. And if you do, the first thing you should really
be worried about is maintaining persistence and creating a backdoor for yourself
as quickly as possible because you don't know if that domain administrator is going to log
out right away or not. Stuff that we're going to cover later, but I wanted to show you
basically information gathering for the enumeration of this particular operating system
and keep it at a level to where it can be performed regardless of which user you're
imitating when you actually break into that actual system with MetaPreator.