Post-exploitation host/domain survey using native Windows commands.

DomainEnumeration.bat

whoami & hostname & ipconfig /all & net user /domain 2>&1 & net group /domain 2>&1 & net group "domain admins" /domain 2>&1 & net group "Exchange Trusted Subsystem" /domain 2>&1 & net accounts /domain 2>&1 & net user 2>&1 & net localgroup administrators 2>&1 & netstat -an 2>&1 & tasklist 2>&1 & sc query 2>&1 & systeminfo 2>&1 & reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" 2>&1

gpresult /z

• net view
• new view /domain
• net user %USERNAME% /domain
• nltest /dclist

set

ARP -a

Route print

net localgroup "Remote Desktop Users"
netstat -ano