Here is a quick little command to discover the command lockout policy of your domain. This is useful when performing password attacks. The worst thing that you could do to lose credibility is to DoS your client by locking out all of their user accounts.

C:\> net accounts /domain

The request will be processed at a domain controller for domain TEST.
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          Unlimited
Minimum password length:                              0
Length of password history maintained:                None
Lockout threshold:                                    10
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        BACKUP
The command completed successfully.

Enjoy!

To continue, here a nice way to port scan from the command line. This is an Ed Skoudis trick.

The problem is that the windows telnet client horribly handles connections, and is severely limited when trying to use it in scripts. The fix is to use ftp instead. It is built in to windows, and has some functionality that allows us to overcome some of the limitations that exist in the telnet client.

Port Scanner

C:\> for /L %i in (1,1,1024) do echo Checking port %i: >> ports.txt & echo open

<target_id> %i > ftp.txt & echo quit >> ftp.txt & ftp -s:ftp.txt 2>> ports.txt

How it works

Create a basic loop for the range of ports you want to scan

for /L %i in (1,1,1024)

Echo out a message indicating what port is being scanned, and output it into a file called ports.txt

do echo Checking port %i: >> ports.txt

Now echo the ftp command:  open <ip> <port> into a file called ftp.txt

& echo open <target_id> %i > ftp.txt

Issue the FTP command: quit  into that same file

& echo quit >> ftp.txt

Open the ftp client, using the text within ftp.txt as its list of commands. This does the actual scan attempt.

& ftp -s:ftp.txt

Redirect standard error int ports.txt file. This is where the results will go. The status of the return error will determine if the port is open.

2>> ports.txt

Truly clever. Hats off to Ed Skoudis.

Okay. Continuing on with the series. Now that we have  mapped the network, we need to enumerate users on the active hosts. Often times you will be preforming a Penetration Test on a windows machine. In the event that the machine has RestrictAnonymous set, you may find it difficult to enumerate users using your null session. It is important to note that this does not make it impossible! tools like enum rely upon the null session enumeration option,  therefore RestrictAnonymous = 2 ruins the use of that tool (and others like it). I am going to show you a method to brute force usernames in a different manner. For this you will need two tools, sid2user, and user2sid. You can get them here.

Step 1: Establish a Null Session

C:\> net use \\<target_ip> "" /u:""

It is important to note that although RestrictAnonymous is set to 2, that does not prevent null sessions. It simply prevents the enumeration of users via null sessions.

Step 2: Determine Target Machine’s name

There are many methods to get this. Here is one:

C:\> nbtstat -a <target_ip>

Step 3: Aquire SID

C:\> user2sid \\<target_ip> <machine_name>

This will return to us the machines SID (Security Identifier). The SID is a unique number for each user/system. It follows the following format:

S-[Revision-Level]-[Authority Level]-[Domain-or-Computer-number]-[RID]

Example (brackets added for clarity): S-[1]-[5-21]-[165875785-1005667432-441284377]-[1023]

The RID is the number which represents the user ID. We use this to get their usernames.

Step 4: Aquire Admin account name

500 is the admin account, which allows us to identify the true admin even if the account name has been renamed. With that being known, you can manually determine the admin using sid2user.

C:\> sid2user \\<target_ip> <SID_with_RID_set_to_500>

For example, the SID with the RID set to 500 would look like:

S-1-5-21-165875785-1005667432-441284377-500

Step 5: Aquire Other Users

C:\> for /L %u in (1000,1,1015) do @sid2user \\<target_ip> <SID_without_RID> %u

This loop will brute force usernames by retrieving the usernames associated with RIDs 1000-1015. You can change this according to your needs.

There you go! now you can go on to password cracking, etc!

for \L %i in (1,1,255) do @ping -n 1 x.x.x.%i | find "Reply"

how it works

for \L %i

%i in (1,1,255)

do @ping -n 1 x.x.x.%i

| find "Reply"

The results will show you the lines of a ping command containing the IP of hosts on the subnet. I.E

Reply from 192.168.1.2: bytes=32 time<1ms TTL=128

Reply from 192.168.1.15: bytes=32 time<1ms TTL=128

Reply from 192.168.1.117: bytes=32 time<1ms TTL=128

Enjoy!