Immediate Situational Awareness

reference 20 commands

Run these within the first 60 seconds of getting a shell.

Who am I? What privileges do I have?

whoami

whoami /all

whoami /priv         # SeImpersonatePrivilege = check Potatoes NOW

System information

systeminfo

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix"

Network

ipconfig /all

netstat -ano

route print

Users and groups

net user

net user <USER>

net localgroup

net localgroup administrators

Running processes

tasklist /v

wmic process get name,executablepath,processid

Installed software

wmic product get name,version

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr "DisplayName\|DisplayVersion"

Scheduled tasks

schtasks /query /fo LIST /v | findstr /C:"Task To Run" /C:"Run As User" /C:"Status"

schtasks /query /fo LIST 2>nul | findstr TaskName

Services

wmic service get name,startname,pathname | findstr /i /v "C:\\Windows"

sc query