Login

**NINZA** · 05-14-2020, 08:13 AM

0			0

Hello friends! Today we are going to take another CTF challenge known as Bsides London 2017. The credit for making this vm machine goes to “Hacker House” and it is another boot2root challenge in which our goal is to get root to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.7 but you will have to find your own)
Let’s do an nmap scan for port enumeration.
nmap -p- -sV 192.168.0.7
1
nmap -p- -sV 192.168.0.7
[Image: 1.png?w=687&ssl=1]

We find port 80 to be open, port 80 is running http.
So we first open 192.168.0.7 in our browser.
[Image: 2.1.png?w=687&ssl=1]

We find a hint to use rafting directory, it is a wordlist that is used to enumerate directories. So we enumerate the directories using raft-large-directories for further information.
dirb

[To see content please register here]

.0.7 raft-large-directories
1
dirb

[To see content please register here]

.0.7 raft-large-directories
[Image: 3.png?w=687&ssl=1]

Now we enumerate the directories with common wordlist and find a directory called cgi-bin/.
dirb

[To see content please register here]

.0.7 -w
1
dirb

[To see content please register here]

.0.7 -w

As the dirb scan gave us a forbidden error on cgi-bin/ directory. We try to look through the files inside cgi-bin
dirb

[To see content please register here]

-N 403
1
dirb

[To see content please register here]

-N 403

We open the links found using dirb, one of those links contains a login page.
[Image: 4.png?w=687&ssl=1]

We take a look at the source code and find a hexadecimal string.
[Image: 5.png?w=687&ssl=1]

We decode it using xxd and find a base64 encoded string. After decoding it we found that the base64 string starts from Y so we select the string from Y and found a hexadecimal string inside a flag. We decode it and find a string.
[Image: 6.png?w=687&ssl=1]

We use this string as password to login through the login page, we use username as admin.
[Image: 7.png?w=687&ssl=1]

Even after login we don’t find anything on the login page, so we move to the links provided by the dirb scan.
We found one page that looks like a blank page.
[Image: 8.png?w=687&ssl=1]

When we take a look at the source page, we found that it is xml based page that may be vulnerable to XML Entity Injection(XXE).
[Image: 9.png?w=687&ssl=1]

We use burpsuite to capture request of that page and then send it to repeater, we then use XXE to exploit the system.
[Image: 10.png?w=687&ssl=1]

We find that only /etc/passwd is visible in plain text, to get the rest of the files we need to php base64 filter. So we get apache.conf file to know about the system.
[Image: 11.png?w=687&ssl=1]

Now we decode the base64 encoded string and save it in a file ‘bsides-apache.conf’.
[Image: 12.png?w=687&ssl=1]

Now when we check the configuration to find information about the system.
[Image: 13.png?w=687&ssl=1]

Now we use XXE to get the rest of the configuration files.
[Image: 14.png?w=687&ssl=1]

We decode the base64 encoded string and then save it as bsides-default.conf.
[Image: 15.png?w=687&ssl=1]

Now we take a look at the configuration file, we get the location of the cgi configuration file.
[Image: 16.png?w=687&ssl=1]

Now we use XXE to get the configuration file for CGI files.
[Image: 17.png?w=687&ssl=1]

We decode the base64 encoded string and save it as bsides-cgi.conf
[Image: 18.png?w=687&ssl=1]

Now we take a look at the cgi configuration file and find the location of load file that we dirb scan showed us.
[Image: 19.png?w=687&ssl=1]

Now we download the load file using XXE to find more information about the file.
[Image: 20.1.png?w=687&ssl=1]

We decode the base64 encoded string and save it as bsides-load.
[Image: 20.png?w=687&ssl=1]

Now we check the file type and find it is an elf executable file.
file bsides-load
1
file bsides-load
[Image: 21.png?w=687&ssl=1]

We use strings to check the content of the file and find that it is compressed using UPX.
strings bsides-load
1
strings bsides-load
[Image: 22.png?w=687&ssl=1]

Now we use UPX to decompress the file
upx -d bsides-load
1
upx -d bsides-load
[Image: 23.png?w=687&ssl=1]

After decompressing the file we check the strings and find that it read a file and decrypts the file using the hex value of “WannaCry?”
[Image: 24.png?w=687&ssl=1]

Now we use radare to reverse engineer the file and find that it can run files that are encrypted with hex value of ‘WannaCry?’
[Image: 25.png?w=687&ssl=1]

Now we create a hex value of ‘WannaCry?’. We use od to convert it into hex and sed to remove the space between values.
echo -n "WannaCry?" | od -A n -t x1 |sed 's/ *//g’
1
echo -n "WannaCry?" | od -A n -t x1 |sed 's/ *//g’
[Image: 26.png?w=687&ssl=1]

We create a reverse shell first to exploit the system. We create pipe files to execute our command.
[Image: 27.png?w=687&ssl=1]

Now we create a 32-bit shared object file using gcc and convert it to a binary file using the hex value of ‘WannaCry?’ as key with openssl.
gcc -m32 -shared -fPIC -o exploit.so exploit.c
openssl aes-128-cbc -K 'key’ -iv 0 -e -in exploit.so -out exploit.bin
1
2
gcc -m32 -shared -fPIC -o exploit.so exploit.c
openssl aes-128-cbc -K 'key’ -iv 0 -e -in exploit.so -out exploit.bin
[Image: 28.png?w=687&ssl=1]

Now we upload the file to the server, dirb scan gave us a link that can be used to bin files. After upload file we get the location of the file where it is uploaded. The name of our file also changes after we upload it.
[Image: 29.png?w=687&ssl=1]

We copy the new file name and use the load file to run our shell.
[Image: 30.png?w=687&ssl=1]

We setup our listener using netcat, as soon as we execute the shell we get the reverse shell.
[Image: 31.png?w=687&ssl=1]

Now we find files with suid bit set and find a file in /home/level1/ called shisu
find / -perm -4000 2>/dev/null
1
find / -perm -4000 2>/dev/null
[Image: 32.png?w=687&ssl=1]

We move to the directory and run the command and find that it is an executable file.
file shisu
[Image: 33.png?w=687&ssl=1]

When we run the file we find that it runs the command ps.
[Image: 34.png?w=687&ssl=1]

We are unable to read debugging symbols in gdb so we use objdump to reverse engineer the file and found that the file has a string copy after which it removes the top 10 bytes in stack.
objdump -M intel -d shisu
1
objdump -M intel -d shisu
[Image: 35.png?w=687&ssl=1]

We now use gdb to add a breakpoint before it removes the memory from the stackpoint. We use python to print 500 ‘A’. Then we check the stack and find it is overwritten with A’s.
[Image: 36.png?w=687&ssl=1]

Now this file maybe vulnerable to buffer overflow. After fuzzing a few times we find that at 516 bytes of data we can overwrite the EIP and we get a segmentation fault.
[Image: 37.png?w=687&ssl=1]

So we now use this to exploit this vulnerability and get a privileged shell.
Now we run the file along with a 516 byte of shellcode and we get a privileged shell.
[Image: 38.png?w=687&ssl=1]

Now we use id command and find that we are root user now.
[Image: 39.png?w=687&ssl=1]

In Part 2 of this article, we have covered Recent Activity, Deleted File Search, Mismatch File Search, Memory Viewer, and Prefetch Viewer. This article will cover some more features/ functionalities of OSForensics.
To Read Part 2 of this article click

[To see content please register here]

.
Raw Disk Viewer
On a drive, data is generally stored in file system files and directories but when it comes to forensics we need a deeper inspection of drives we can have a piece of evidence within the raw sectors of the drive, image. These sectors are not accessible through the Operating system but we can access the raw sectors through OS Forensic’s Raw Disk Viewer.
Raw Disk Viewer includes text/hex searching, highlighting of relevant disk offsets, and decoding of known disk structures (such as MBR, GPT)
Source:

[To see content please register here]

To start with open OSF and click on Raw Disk Viewer
[Image: 1.png?w=687&ssl=1]

From the disk drop down to select the Evidence we want to investigate.
[Image: 2.png?w=687&ssl=1]

Click on the config button and make the required changes. We can specify the sector range limit, highlight the file types by different colors, include/exclude file system objects.
[Image: 3.png?w=687&ssl=1]

To look for a particular file/sector/offset click on Jump To button, we can see a screen to select any particular file or offset.
[Image: 4.png?w=687&ssl=1]

To get the details of any particular file select file and browse the file.
[Image: 5.png?w=687&ssl=1]

Click on open and then OK, the file will open in HEX for investigation.
[Image: 6.png?w=687&ssl=1]

Click on the decode button to get the details of the file. This will provide the cluster number and sector of the file.
[Image: 7.png?w=687&ssl=1]

Right click on the file to get all the available options of the file/offset/cluster.
[Image: 8.png?w=687&ssl=1]

Click on Search button, a screen will appear where we can search for Hex or Text and continue. This will search the particular text or Hex within the raw sectors and will display the result.
[Image: 9.png?w=687&ssl=1]

Click on bookmark button on the main screen of Raw Disk Viewer. we can create the bookmarks for the relevant evidence.
[Image: 10.png?w=687&ssl=1]

Create a new bookmark by specifying its start offset and end offset. We can differentiate the bookmark through its color.
[Image: 11.png?w=687&ssl=1]

The bookmark saved will get listed.
[Image: 12.png?w=687&ssl=1]

If we click on the bookmark the offset range will get highlighted on the main screen and will mark the starting of the offset with a flag and color of the flag is that of the bookmark.
[Image: 13.png?w=687&ssl=1]

This concludes the Raw Disk Viewer.
Registry Viewer
Registry viewer enables to investigate the registries of evidence.
To start with open the registry viewer, we can select the drive/evidence we want to work on. All the registry files in that particular drive/evidence will get listed on the right side.
[Image: 14.png?w=687&ssl=1]

Double Click on any file and we can navigate to the registries and can get all the details.
[Image: 15.png?w=687&ssl=1]

This concludes Registry Viewer
File System Browser
File system browser enables us to navigate to the Drive/Evidence.
[Image: 16.png?w=687&ssl=1]

We can navigate through all the files/directories and perform multiple activities. In file system browser we have the other options of OSF as well like File search, Mismatch search, Create Index, Create signature. Some of these features we have already talked about and some of them we will discuss in coming articles.
[Image: 17.png?w=687&ssl=1]

We can check the “Show Deleted File” option by clicking on Tools > Option > Show Deleted File.
[Image: 18.png?w=687&ssl=1]

The deleted files/directories (if any) will also get listed and will be marked with a red cross.
[Image: 19.png?w=687&ssl=1]

This concludes the File System Browser.
Passwords
Passwords feature enable us to retrieve the password-related information of the evidence. These passwords could be passwords stored within the browser, Windows Login Passwords, WE can also create a rainbow table by making the multiple combinations of the passwords and retrieve the passwords from the rainbow table. Under OSF passwords also have an option to decrypt an encrypted file.
To start with open OSF and select passwords
[Image: 20.png?w=687&ssl=1]

The first tab is to Find Passwords & Keys, this will allow recovering the stored password from the browser, outlook, windows auto logon passwords, etc. We can either do the live acquisition of current machine or Scan Drive and select any drive or evidence.
Click on the Config button, check the passwords you want to recover. Select the decryption settings based on requirements, we can include our dictionary file or can use an automatic dictionary. If credentials are known we can provide windows login credentials and click OK.
[Image: 21.png?w=687&ssl=1]

Click on Acquire passwords button to start the process.
[Image: 22.png?w=687&ssl=1]

All the passwords/product keys will get listed.
[Image: 23.png?w=687&ssl=1]

The below image is the passwords acquisition of the Current Machine for better understanding as the evidence we were working on doesn’t any stored wireless network.
[Image: 24.png?w=687&ssl=1]

Select Windows Login Password , select the Drive/evidence and click Acquire passwords
All the information will get listed. If there is any saved password it will get listed also we can get info about it also we can get NT hash and LM Hash of the password from which we can recover the password.
[Image: 25.png?w=687&ssl=1]

We have an option to generate a rainbow table. This is used to create a list of passwords with different combinations and permutations. We can choose from the different options/combinations from the drop down. More huge and complex the inputs are the longer the time it will take.
[Image: 26.png?w=687&ssl=1]

Browse the file path where we want to save the table and if required modify the parameters. Click on create a rainbow table button to start with the process.
Depending on the complexity the process will start.
[Image: 27.png?w=687&ssl=1]

Password through a rainbow table. If the password is within the rainbow table we have created and we have the NT hash and LM Hash we can recover the passwords (however this ). TO achieve this we need to add the folder of the Rainbow table under “Select Rainbow Table” and can either enter the raw hash or can browse the file which may contain the hash, if the password is present within the rainbow table, we will get the password.
In the image we are browsing the file “hash.txt”, we have saved in windows login password (shown above)and the rainbow table we have created.
[Image: 28.png?w=687&ssl=1]

Click on recover Password/s button to start the process, if the password present in Hash.txt is found in the rainbow table we will get the result.
[Image: 29.png?w=687&ssl=1]

In the above, we haven’t found the password as it must be not present inside the table. Also, these tables have certain limitations and have a success rate of 95 % (approx). There are other methods as well for the recovery of passwords we will be discussing on other articles.
This concludes Passwords.
For more on OSForensics wait for the next article.

This is a very handy little application. It’s been developed by the QEMU team. The software is very useful when dealing with virtualization, Qemu-img is available for both Windows and Linux. Its function is to give you the ability to change the format of a given virtual disk file to the majority of the popular virtual disk formats that are used across platforms. Let’s say you are using the virtual box in Windows and want to migrate the virtual disk to be used on a mac, in parallels, you can use this simple program to achieve this with minimum effort.
Our purpose of writing about this today is slightly different from Qemu-img’s mainstream usage, we want to focus on how we can use this application to convert a virtual disk image, whole or split into a .raw file that can be used with most of the popular forensic frameworks that are available.
Let’s start up Qemu-img on our Linux machine
At the terminal prompt type “qemu-img –h”
This will show you all the options that can be used with qemu-img

Right at the end of the information that is presented after the command given above is used, we can see all the formats supported by this application.
Here is a list of all the formats that are compatible with Qemu-img
[Image: 2.PNG?w=687&ssl=1]

Now let’s see how this application comes in handy for use in forensics.
In a situation where a virtual disk is part of the acquisition and further dedicated analysis is required, the virtual disk can be converted into the .raw format.
Let’s begin.
Since our goal is to analyze the virtual disk, we are using the image file from Windows 7 installed on VMWare. The file in question is in .vmdk format.
Just a heads up, when you convert a virtual disk file to a .raw file, the size of the converted file can be quite big, so make sure you have enough space.
Here is our .vmdk file
[Image: 3.PNG?w=687&ssl=1]

For ease of use, we have placed the .vmdk file in a folder named Qmeu on the desktop. The terminal is opened from within the folder.
At the terminal prompt type “qemu-img convert -f vmdk -O raw Windows\ 7.vmdk win7.raw”
A breakdown of the command that we just gave:
qemu-img convert is invoking the convert function of qemu-img.
-f is the format of the input file, which in this case is .vmdk
-O is the format of the output file that we want, a .raw file.
Windows\ 7.vmdk is the name of the input file that we have in our folder.
win7.raw is the name we have given the output file with its file extension.

Give it a few minutes and check the folder, you will find the converted file.
As you can see, the size of the .raw file is 10.7 GB and the size of the .vmdk file was 6.0 GB, that’s quite a jump in size!
[Image: 5.PNG?w=687&ssl=1]

We can now use Foremost to carve the .raw file to see what’s inside.
At the terminal type “foremost -t jpeg, png -i win7 -o output”

With this command, we are carving the .raw file for .jpeg and .png files which will be collected in a folder named output. If you have any doubts about foremost you can refer to

[To see content please register here]

article.
As you can see, our .raw file has been successfully carved, the results are visible below
[Image: 7.png?w=687&ssl=1]

We have successfully carved a .raw file made from a virtual disk, now let’s mount the .raw file to view its contents. We will be using a Windows for this operation.
Now we will mount this .raw file using FTK Imager to see its contents. The image mounting option can be found under the File menu. Navigate to the .raw file from within the mounting menu.
[Image: 8.PNG?w=687&ssl=1]

Select Mount, leave the other options as they are and the file will appear on the Mapped Image List.
[Image: 9.PNG?w=687&ssl=1]

Next, we navigate to My Computer and we can see that the .raw has been mounted as a partition.
[Image: 10.PNG?w=687&ssl=1]

The windows file system can be seen within and explored for content.
[Image: 11.PNG?w=687&ssl=1]

Qemu-img is a very simple application with high potential. It can be a very valuable tool in your forensic toolkit due to its large list of compatible formats. It will make sure that the format of the acquired image does not keep you from using your forensic tool of choice to run your investigation or carve out data.
We hope you enjoy using this tool.
Have fun and stay ethical.

This article is about Post Exploitation using the WMIC (Windows Management Instrumentation Command Line). When an Attacker gains a meterpreter session on a Remote PC, then he/she can enumerate a huge amount of information and make effective changes using the WMI Command Line.
To do this, we will first get the meterpreter session on the Remote PC which you can learn from

[To see content please register here]

. After gaining the session, escalate its privilege to Administrator which you can learn from

[To see content please register here]

.
WMIC command line can be accessed through the windows cmd. To access that type “shell” in the meterpreter shell.
Now let’s look at the wmic commands and their working
WMIC
This command shows the global options which are used in the wmic command. WMIC Global Options are used to set properties of the WMIC environment. With the combination of global options and the aliases than we can manage the system through the wmic environment.
wmic /?
1
wmic /?
[Image: 1.png?w=687&ssl=1]

Get System Roles, User Name, and Manufacturer
We can enumerate lots of information about the Victim System including its Name, Domain, Manufacturer, Model Number and Much more through the computer system alias of wmic command.
We are adding the following filters to get a specific result.
Roles: It gives all the roles that the victim system play like Workstation, Server, Browser etc.
Manufacturer: It gives the manufacturer of the system, sometimes there are certain vulnerabilities in a particular model of a particular model. So we can use this information to search for any direct vulnerabilities.
UserName: It gives the username of the system which is proven very helpful as we can differentiate between administrators and normal users
[/format: list]: To sort the output in a list format.
wmic computersystem get Name, domain, Manufacturer, Model, Username, Roles /format:list
1
wmic computersystem get Name, domain, Manufacturer, Model, Username, Roles /format:list
[Image: 2.png?w=687&ssl=1]

Get the SIDs
To enumerate these SIDs we will use group alias of wmic.
wmic group get Caption, InstallDate, LocalAccount, Domain, SID, Status
1
wmic group get Caption, InstallDate, LocalAccount, Domain, SID, Status
As shown in the below image here we have found the Account Name, Domain, Local Group Member status, SID and their status.
[Image: 3.png?w=687&ssl=1]

Create a process
We can create many processes on the victim’s system using the process alias of wmic command.
This is helpful in running any backdoor or fill up the memory of the victim’s system.
Syntax: wmic process call create “[Process Name]”
wmic process call create "taskmgr.exe"
1
wmic process call create "taskmgr.exe"
As you can see in the below screenshot that this command not only create a process but also gives the “process id” so that we can manipulate that process according to our need.
Note: if the process creates a window like Task Manager, cmd, etc. then this command will open up that window on the victim’s system and create suspicion in the mind of the victim.
[Image: 7.png?w=687&ssl=1]

Change Priority of a Process
We can change the priority of any process running on the victim’s system with the help of process alias of wmic command.
This is an important feature because it can be used to manipulate processes as we can increase the priority of any process of our choice or decrease the priority of any process. Decreasing the priority of any process can result in the crashing of that particular application and increasing may crash the overall system.
wmic process where name="explorer.exe" call setpriority 64
1
wmic process where name="explorer.exe" call setpriority 64
[Image: 8.png?w=687&ssl=1]

Terminate a process
We can terminate a process running on the victim’s system with the help of process alias of wmic command.
wmic process where name="explorer.exe" call terminate
1
wmic process where name="explorer.exe" call terminate
[Image: 9.png?w=687&ssl=1]

Get a list of Executable Files
We can get a list which contains the location of the executable files other than that of windows.
wmic PROCESS WHERE "NOT ExecutablePath LIKE ‘%Windows%’" GET ExecutablePath
1
wmic PROCESS WHERE "NOT ExecutablePath LIKE ‘%Windows%’" GET ExecutablePath
[Image: 10.png?w=687&ssl=1]

Get Folder Properties
To extract the basic information about a folder on the victim’s system we can use fsdir alias of the wmic command line.
It can enumerate the following information about a folder:
Compressed, CompressionMethod, Creation Date, File Size, Readable, Writable, System File or not, Encrypted, Encryption Type and much more.
wmic FSDIR where "drive='c:' and filename='test" get /format:list
1
wmic FSDIR where "drive='c:' and filename='test" get /format:list
[Image: 11.png?w=687&ssl=1]

Get File Properties
To extract the basic information about a file on the victim’s system we can use datafile alias of the wmic command line.
It can enumerate following information about a file:
Compressed, CompressionMethod, Creation Date, File Size, Readable, Writable, System File or not, Encrypted, Encryption Type and much more.
Syntax: wmic datafile where=’[Path of File]’ get /format:list
wmic datafile where name='c:\\windows\\system32\\demo\\demo.txt' get /format:list
1
wmic datafile where name='c:\\windows\\system32\\demo\\demo.txt' get /format:list
[Image: 12.png?w=687&ssl=1]

Locate System Files
Extract paths of all the important system files like temp folder, win directory and much more.
wmic environment get Description, VariableValue
1
wmic environment get Description, VariableValue
From given below image you can read variable value with their given description.
[Image: 13.png?w=687&ssl=1]

Get a list of Installed Applications
We can get a list of applications or software installed on the victim’s system
wmic product get name
1
wmic product get name
[Image: 14.png?w=687&ssl=1]

Get a list of Running Services
We can fetch the list of services which are running and services which start automatically or not.
wmic service where (state="running") get caption, name, startmode, state
1
wmic service where (state="running") get caption, name, startmode, state
From given below image you can observe startmode either as “Auto” or as “Manual” and state “Running” for given services.
[Image: 16.png?w=687&ssl=1]

Get Startup Services
We can enumerate startup services using startup alias for all the services that run during the windows startup.
wmic startup get Caption, Command
1
wmic startup get Caption, Command
[Image: 17.png?w=687&ssl=1]

Get System Driver Details
We can enumerate Driver Details like Name, Path and Service Type using the sysdrive alias.
This command gives the path of the driver file, its status (Running or Stopped), Its Type (Kernel or File System)
wmic sysdriver get Caption, Name, PathName, ServiceType, State, Status /format:list
1
wmic sysdriver get Caption, Name, PathName, ServiceType, State, Status /format:list
[Image: 19.png?w=687&ssl=1]

Get OS Details
We can enumerate the location of the victim by using the time zone in which the system is set, this can be extracted using the OS alias.
We also get the Last Boot Update Time and The Number of Registered Users and Number of Processors and information about Physical & Virtual Memory, all using os alias.
wmic os get CurrentTimeZone, FreePhysicalMemory, FreeVirtualMemory, LastBootUpdate, NumberofProcesses, NumberofUsers, Organization, Registereduser, Status /format:list
1
wmic os get CurrentTimeZone, FreePhysicalMemory, FreeVirtualMemory, LastBootUpdate, NumberofProcesses, NumberofUsers, Organization, Registereduser, Status /format:list
[Image: 20.png?w=687&ssl=1]

Get the Motherboard Details
We can use the baseboard alias of the wmic command line to enumerate the motherboard details of the victim’s system. Things we can enumerate are Motherboard Manufacturer, Serial Number, and Version
wmic baseboard get Manufacturer, Product, SerialNumber, Version
1
wmic baseboard get Manufacturer, Product, SerialNumber, Version
[Image: 21.png?w=687&ssl=1]

Get BIOS Serial Number
We can use the bios alias of the wmic command line to enumerate the bios details of the victim’s system.
wmic bios, get serialNumber
1
wmic bios, get serialNumber
From given below image you can check bios serial number that we have enumerated of victim’s system.
[Image: 22.png?w=687&ssl=1]

Get Hard Disk Details
We can enumerate information about the System Hard Disk using the diskdrive alias.
We get to know the Interface Type, Manufacturer, and Model Name, all through this command.
wmic diskdrive get Name, Manufacturer, Model, InterfaceType, MediaLoaded, MediaType /format:list
1
wmic diskdrive get Name, Manufacturer, Model, InterfaceType, MediaLoaded, MediaType /format:list
[Image: 23.png?w=687&ssl=1]

Get Hard Disk Partitions Details
We can get the information about the Hard Disk Partitions using the logicaldisk alias.
We get the name, compression status, File System (NTFS, FAT) and much more all using this command.
wmic logicaldisk where drivetype=3 get Name, Compressed, Description, FileSystem, FreeSpace, SupportsDiskQuotas, VolumeDirty, VolumeName
1
wmic logicaldisk where drivetype=3 get Name, Compressed, Description, FileSystem, FreeSpace, SupportsDiskQuotas, VolumeDirty, VolumeName
From given below image you can read the description of the disk along with filesystem i.e. NTFS and available free space and many more details as per your requirement.
[Image: 24.png?w=687&ssl=1]

Get Memory Cache Details
We can get the information about the Memory Cache using Memcache alias. We can get the name, block size, purpose and much more all using this command.
wmic memcache get Name, BlockSize, Purpose, MaxCacheSize, Status
1
wmic memcache get Name, BlockSize, Purpose, MaxCacheSize, Status
From given below image you can observe here it is showing details of two cache memory.
[Image: 25.png?w=687&ssl=1]

Get Memory Chip Details
We can get the information about the RAM using the memorychip alias.
We get the Serial number of the RAM without removing the RAM or physically being near the system using this command.
wmic MEMORYCHIP get PartNumber, SerialNumber
1
wmic MEMORYCHIP get PartNumber, SerialNumber
[Image: 26.png?w=687&ssl=1]

Detect If victim system is a host OS or installed via VMware
We can enumerate information about the victim’s system that whether it is running a host operating system i.e. running by directly installing on the hard drive or running virtually using VMware or Virtual Box.
wmic onboarddevice get Desciption, DeviceType, Enabled, Status /format:list
1
wmic onboarddevice get Desciption, DeviceType, Enabled, Status /format:list
Here from given below image if you will observe the highlighted text when you see it showing VMware in the description.
[Image: 27.png?w=687&ssl=1]

User Account Management
Lock a User Account
We can restrict a local user from using its account by using useraccount alias, here we are going to lock a User Account.
wmic useraccount where name='demo' set disabled=false
1
wmic useraccount where name='demo' set disabled=false
From given below image you can observe that we had successfully locked the user account for user “demo”.
[Image: 28.png?w=687&ssl=1]

Remove Password requirement for logging
We can remove a local user’s requirement of its password for login by using useraccount alias
wmic useraccount where name='demo' set PasswordRequired=false
1
wmic useraccount where name='demo' set PasswordRequired=false
[Image: 29.png?w=687&ssl=1]

Rename a user account
We can rename a local user by using useraccount alias
wmic useraccount where name='demo' rename hacker
1
wmic useraccount where name='demo' rename hacker
[Image: 30.png?w=687&ssl=1]

Restrict user from changing a password
We can restrict a local user from changing its password by using useraccount alias
wmic useraccount where name='hacker' set passwordchangeable=false
1
wmic useraccount where name='hacker' set passwordchangeable=false
[Image: 31.png?w=687&ssl=1]

Get Antivirus Details
We can enumerate the antivirus installed on the victim’s system along with its location and version.
wmic /namespace:\\root\securitycenter2 path antivirusproduct GET displayName, productState, pathToSignedProductExe
1
wmic /namespace:\\root\securitycenter2 path antivirusproduct GET displayName, productState, pathToSignedProductExe
[Image: 32.png?w=687&ssl=1]

Clear System Logs
Wmic can be used to delete system logs using the nteventlog alias. It is a very simple command where we mention the name of the log and then using an option nteventlog and clear the log file. It can be an effective command while cleaning up after hacking any system.
Syntax: wmic nteventlog where filename='[logfilename]’ cleareventlog
wmic nteventlog where filename='system' call cleareventlog
1
wmic nteventlog where filename='system' call cleareventlog
[Image: 33.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis