> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/01-reconnaissance.md).

# 01 Reconnaissance

After getting the initial access to a Windows environment, the commands are used for the Reconnaissance.

{% tabs %}
{% tab title="Operating System" %}

```
# Systeminfo
systeminfo
hostname 

# Hotfix info
wmic qfe get Caption,Description,HotFixID,InstalledOn

# Read Environment Variable
Get-ChildItem Env: | ft Key,Value

# Installed Software
reg query HKEY_LOCAL_MACHINE\SOFTWARE
```

{% endtab %}

{% tab title="User" %}

```
# To see what tokens we have 
whoami /priv

# What users/localgroups are on the machine?
net users
Get-LocalUser | ft Name,Enabled,LastLogon
net localgroups
Get-LocalGroup | ft Name
net localgroup Administrators
Get-LocalGroupMember Administrators | ft Name, PrincipalSource
net user morph3
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"

# Crosscheck local and domain too
net user morph3 /domain
net group Administrators /domain
```

{% endtab %}

{% tab title="Network" %}

```
# Connected drives
net use
wmic logicaldisk get caption,description,providername

# Network information
ipconfig /all
route print
arp -A

# Recursive string scan
findstr /spin "password" *.*
findstr /i /s "password" *.* 
gci  -recurse –include *.txt | select Fullname 

# Search for writeable directories
dir /a-r-d /s /b
dir abc.txt /s /p 

# Running processes
tasklist /SVC

# Network connections
netstat -ano

```

{% endtab %}

{% tab title="Dumping Windows Credentials" %}
{% embed url="<https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit/dumping-windows-credentials>" %}
{% endtab %}
{% endtabs %}

{% embed url="<https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide>" %}