Situational Awareness

Network Information

• Gathering Network information is important
• we can find that a host is dual-homed and that may allow us to move laterally into another part of the network that we could not access previously.
• always look at routing tables to view information about the local network and networks around it
• view the ARP cache for each interface and view other hosts the host has recently communicated with.

COMMANDS

• Get Interface, ip, dns info
  • ipconfig /all
• ARP Table
  • arp -a
• Routing Table
  • route print

Enumerating Protections

• modern envs will have some AV, EDR service to monitor, alert on and block threats.
• these tools can interfere with the enumeration process
• if using public PoCs, these can be blocked.
• Hence, we enumerate protections and craft custom payloads or modify tools before compiling them
• 

Commands

• Check windows defender status
  • Get-MpComputerStatus
• List AppLocker Rules
  • Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
• Test AppLocker Policy (check if cmd.exe is allowed by current user)
  • Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone