Overview

These commands are typically used during the post-exploitation phase of information gathering. Once access to a host is obtained, further information about the target itself is required for persistence and privilege escalation

Linux Host Enumeration

# listening ports
ss -tulnp

# view commands that this account has access to
# anything with NOPASSWD could be an avenue for privilege escalation
sudo -l

# scheduled tasks
crontab -l

Windows Host Enumeration

# view listening ports with service PID
netstat -ano

# search running tasks for specific PID
tasklist | findstr <pid>

# view netwrok configuration
ipconfig /all

# scheduled tasks
schtasks