Enumerating users and groups on Windows.
In this video, we're going to be exploring the process of how
to identify the current user, you
have access to on a Windows system.
We'll also learn more about user accounts.
How to enumerate other user accounts on a Windows system
as well as groups.
All right, so why is this information important?
Well, again, going back to the previous video
after gaining initial access to a target system,
it's always important to learn more about the system.
And one additional piece of information
that's very important to know is what
user account you have access to, as well
as the privileges that you currently have access to
and the other user accounts on the system.
So why is this important?
Well, firstly, you won't need to get an idea of what privileges
you have.
Are you an elevated user?
Are you the administrator?
Do you have NT Authority system privileges?
That will essentially tie-in, again, to privilege escalation.
So for example, if you are the administrator user,
then you don't need to perform privilege escalation.
So this is very, very important.
Another reason why this is so important
is primarily because if you gain access to a Windows system
and you identify other user accounts on that system that
are part of the local administrators group,
you can again then tailor your attacks
to that specific account or you can try and gain access
to that specific user account and consequently gain
administrative or elevated privileges.
So enumerating users and groups on Windows
is really, really important.
So what type of information are we looking for?
Well, firstly, we want to enumerate
our current user and the privileges
that we currently have access to.
We also need to identify additional user information
like the password policy, the password age, when
this user's password expires?
Important information like that.
We also need to enumerate other user accounts on the system,
as well as the groups that are currently on the system
and trying to identify interesting groups that might
have interesting privileges.
And of course, most importantly, we
need to be able to enumerate the user accounts that
are members of the built-in administrator group.
So the built-in administrator group
is essentially as the name suggests.
An administrator group that, again, essentially provides
administrative privileges to any members
that are part of that group.
So for example, if we gain access to a Windows system
and we currently have access as a non-privileged user
account called Bob and we identify another user
account called Alice, and we also
learned that Alice is part of the local administrators group,
then we could potentially try and gain access
to the Alice user account, to obtain
administrative privileges.
So again, that's just an example.
This is a very, very important phase
of performing local enumeration on Windows.
So the way I'm going to be demonstrating this
is through a lab environment.
So we are going to be utilizing the same lab
environment that we used in the previous video.
So again, it's linked to this video.
All you need to do is start it.
And the first step will, of course,
involve exploiting the system or gaining access to it.
And we can then take a look at how
to enumerate users and groups.
So I'll see you within the lab environment.
All right, so I'm back in the lab environment.
And similarly to the previous video,
you will be provided with the target IP address.
So given the fact that this is the same--
this is the same lab environment we used in the previous video,
all we need to do is load up MSFconsole
and we can exploit the HTTP file server.
So I'm just going to open up my terminal
and I'll just zoom in here.
So I can say MSFconsole and we'll give this
a couple of seconds to start up, and we can
search for the Rejetto exploit.
Here we are.
So I'll just say search rejetto, and we're
going to be using this exploit.
So I'll just say use 0, because that
is the idea of the exploit.
There we are.
And we can set the arrows option to the target IP as follows.
And of course, in your case, it's going to be different.
So just adapt accordingly.
And then I'll type in exploit and we
should obtain a meterpreter session on the target system.
So I'll give this a couple of seconds.
All right, so it looks like we get the meterpreter session,
fantastic.
So again, I'm going to be going through this
both through meterpreter, as well as manually
through a command shell.
So again, if you're using a meterpreter session,
you can enumerate information about the current user
by typing and get user ID.
In this case, we can see that we're
logged on as the administrator user, which
means that we have elevated privileges right out
of the box, right?
So again, that will tie into whether or not
we need to perform privilege escalation, and in this case,
we don't need to do that.
So again, you can see how this information all
ties into the next phases of the post exploitation methodology.
We can also enumerate the current privileges we have,
all the current privileges associated
with the administrator user.
And that will tell us whether we have elevated privileges
and, in this case, you can see we
have the entire gamut of privileges that you typically
associate with a privileged user.
We can also enumerate an additional piece of information
and that is the currently logged on users, right,
as well as users who have logged on in the past.
And if you're doing this through the Metasploit Framework,
one of the interesting modules you can use
is a post exploitation module that will essentially
display all information pertinent to the current users
that are logged on, as well as users
that previously logged on.
So I'm just going to put this in the background, that
can be done by typing in background
or using the keyboard combination Control and Z.
And we can search for that post exploitation module.
So I'll just say searched for logged_on,
and this is the module here.
So I'll just say use 0.
And because this is a post exploitation module,
we can set the session option to our session ID.
So if I list out my sessions, you
can see that meterpreter is running on session--
on this session ID 1.
So I'll say set SESSION 1, and I can then hit run.
We'll give this a couple of seconds.
And it will enumerate the information
that we're looking for.
So firstly, it'll tell us the currently
logged on users, in this case, the administrator user, which
is us and this is the session that we are currently logged on
to.
And then, of course, the other piece of information
is the recently logged on users.
And in this case, it looks like we haven't had any other user
accounts logging in apart from the administrator account.
These other accounts are network and service accounts
right over here.
So they're not really user accounts.
All right, so that is how to perform user and group
enumeration with meterpreter.
And of course, there's a plethora of other modules
that you can utilize.
However, in this case, I will not be going through them.
So we can navigate back into our meterpreter session.
So I'll say sessions 1 and we'll open up a command shell
session.
All right, and let's take a look at how we can perform
the enumeration manually.
So we'll give this a couple of seconds.
It should open or provide me with a command shell session.
There we are.
And I'll just zoom in a little bit here.
So again, if you want to enumerate your current user,
you can do that by saying, who am I?
That's fairly simple.
It'll provide you with the actual host
name and the current user, so administrator.
We can also display the privileges that we have
as we did with meterpreter.
And this can be done by saying, whoami/priv.
And this will tell us the privileges that we have.
But in the case of the Windows command itself,
it'll provide us with additional information regarding
what each of these privileges is used for and the state.
So you can see for all of these privileges the state is
set to enable, which makes sense because this
is the administrator account.
And if we take a closer look at some of these privileges,
you can see like SeBackupPrivilege.
That's used to back up files and directories.
We can also take a look at a few others that
are quite interesting here like take ownership
of files and other objects.
You can see that is the SeTakeOwnershipPrivilege, which
means that this account can take ownership
of files or other objects.
It can load and unload device drivers.
It can change the system time.
All of the functionality that you typically associate
with an administrator account.
Now if I currently had access through a non-privileged user
account, the privileges displayed
would actually be quite fewer and you'd only
see a few privileges associated with that specific user
account.
Now if we wanted to list out the currently logged on users,
we can also do that through the Windows command prompt
or command session by saying query and user.
And that'll tell us the currently logged on user.
So you can see that the administrator user is currently
logged on, and it'll tell us that the state is active
and the log on time is specified here.
This is very, very important, especially after gaining access
to a target system.
It's a really, really wise to check and see
whether any other users are logged on to the system
as that could be a potential vector for detection.
And if you're not careful, you could actually
get detected really easily.
So always be cognizant of who is logged
on the system in addition to yourself.
All right.
Now if we wanted to identify the user accounts
on the system or all other user accounts on the system,
we can do that by saying net users.
So net users will display all other accounts
on this particular system.
So in this case, you can see that we only
have the administrator and the guest account,
which again is fine.
If there are any other user accounts,
you'll be able to see them listed out here, OK?
So that is how to list out all the user
accounts on the system.
Now, if you wanted to learn more about a particular user
like the administrator user that we currently have access to,
we can say net user administrator.
And of course, you can just substitute that
with the username or the user account
that you'd like to learn more about.
So this will essentially tell you--
provide you with additional information regarding
that specific user account like the username, the full name
if it was specified, the comment.
And, in this case, it tells us that this
is the built-in account for administering the computer
or domain.
The country region code, whether the account is active,
whether the account expires, when the password was last set,
that's very important.
Does the password expire?
In this case, it's set to never, which is a good thing.
Because, again, if we're able to identify
the password of this user account, then
it means that the administrator user will never
be prompted to renew their password,
therefore, we don't need to obtain the new password
or crack the new password if it is changed.
You can also see whether the password is
required, of course, for the administrator account,
it is required.
Can the user change the password?
Yes, they can.
It'll then provide you with additional information
regarding the logon itself.
So whether there is a logon script
configured to run when a user logs on,
the user profile, the home directory when
the user last logged on and, of course, the log on hours.
So if you're working within a company or your
performing a pentest on a company environment,
they typically have policies to restrict log on hours.
And that is usually set in accordance
to when employees are typically working on a system.
So they could set it to--
they could set the log on hours to 8:00 AM to maybe 5:00 PM.
And after that, users will not be able to log in.
So that's a security feature that you need to be aware of.
It also tell you the local group membership.
So this will tell you what groups this user account
is a part of.
And it makes sense that the administrator user
is part of the local built-in administrators group, right,
which I mentioned within the slides.
So that's something that you need
to take into consideration.
And of course, we can do this for the-- we can do this
for the other user accounts.
So if I say net users and say net user guest, for example.
They'll display information for the guest account here.
So you can see that, in this case,
the most important piece of information
is whether the account is active and it's
set to no, which means on this system the guest account has
been disabled or is not active.
And as a result, we really cannot use it.
And of course, if we were performing a real penetration
test, there would be other user accounts on the system.
And we could identify additional information regarding them.
We can also enumerate a list of all other groups on the system
or really all groups on the system,
and that can be done by saying net local group.
And you can see that these are all the local groups
on the system.
So for example, we have the administrators group,
which have already explained.
We then have backup operators, and these are really
tied into services or these particular groups
are used for to essentially provide specific users
with specific privileges.
An example of this would be remote desktop users.
So this group if a user is part of the remote desktop users
group, then it means that, again, they
have the permissions or privileges
to log onto a system via RDP or the remote desktop protocol.
And of course, we then have the standard users group here,
which again is used to or essentially contains
user accounts that are just standard users
without any additional privileges.
The same thing goes for the guest group here.
If there is a guest account, then they
will be part of the guest group.
However, in this case, we know that the administrator account
is part of the local building administrators group.
Now if we didn't know that, we could identify other members
that are part of the local administrators group
by typing in net local group administrator.
And in this case, we need to specify the name correctly.
So net local group administrators because that
is the name of the group.
There we are.
And you can see that the only member of this group
is the administrator account.
And this is a very important command
because it'll tell you what other user accounts are
part of this group.
And that will give you an idea as to what
account you can try and attack or gain access to
in order to obtain administrative privileges.
And you can see that is highlighted under the comment
here.
So administrators have complete and unrestricted access
to the computer or domain.
So that means that any member of the administrators group
will have, essentially, all the privileges
required to have unrestricted access
to the target system or domain.
All right, so that is how to perform user and group
enumeration on Windows.
And that is going to conclude the practical demonstration
side of this video.
All right, so now that we've been able to identify
all the user accounts on the Windows system as well as
the groups, and we've been able to learn more
about how to enumerate information regarding
a specific user and a specific group.
We can move on to the next step, which is enumerating
network information on Windows.
So I'll be seeing you in the next video.