> For the complete documentation index, see [llms.txt](https://notes.morph3.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.morph3.blog/windows/recon-initial-access.md). # Recon - Initial Access * * ## Who we are ``` whoami /fqdn whoami /upn whoami ``` ## What are our privileges and which group do we belong to ``` whoami /priv whoami /groups whoami /all ``` ## Systeminfo ``` systeminfo hostname ``` Hotfix and KB information ``` wmic qfe get Caption,Description,HotFixID,InstalledOn ``` ## Antivirus Status ``` Get-MpComputerStatus ``` ## Which users/localgroups are on the machine ``` net users net localgroups net localgroup Administrators net user morph3 ``` Crosscheck local and domain groups too ``` net user morph3 /domain net users /domain net group "Domain Admins" /domain ``` ## Network information ``` ipconfig /all route print arp -A # Network connections netstat -ano ``` Network shares ``` net view ``` ## Logged on users ``` Get-NetLoggedon -ComputerName client251 ``` ## File - Directory enumerations Recursive string scan ``` findstr /spin "password" *.* ``` To list all the files recursively ``` dir /a-D /S /B ``` Search for writeable directories ``` dir /a-r-d /s /b ``` ## Running processes ``` tasklist /SVC ``` ## Service related things To check permissions of us on service vulnsvc ``` accesschk.exe /accepteula -uwcqv morph3 vulnsvc ```