cd ..
2025-12-04 / Log: enumerating_processes_services

Enumerating Processes & Services (Windows)

Host: INE Labs Diff: [EASY]
#Windows#Post-Exploitation#Enumeration#Processes#Services#Scheduled Tasks

Enumerating Processes & Services (Windows)

Classification: Host & Network Penetration Testing / Post-Exploitation
Target: Windows host (Meterpreter via Rejetto HFS)

1. Executive Summary

After exploiting Rejetto HFS, we enumerate the host’s running processes, Windows services and scheduled tasks — identifying privileged/abusable services and persistence opportunities.

2. Processes

ps

Running processes (1)

Running processes (2)

Searching for a specific PID.

Specific PID

Migrating into an x64 process for a stable x64 session.

migrate <pid>

Migrating to an x64 process

3. Services

shell
net start
sc query

Running services (1)

Running services (2)

More detail (ExitCode, ProcessId, StartMode, State, Status) via WMIC.

wmic service list brief

Service details

Mapping services to their hosting processes.

tasklist /svc

Processes with their services (1)

tasklist /svc (2)

4. Scheduled Tasks

schtasks /query /fo LIST /v

(Best piped to a file given the volume.)

schtasks — scheduled tasks

5. Notes

Services running as SYSTEM with weak permissions (unquoted paths, writable binaries) and scheduled tasks are prime privilege-escalation and persistence targets.