In this lesson,
we're going to focus on local user enumeration,
a fundamental step in pentesting.
Local user enumeration involves gathering details
about user accounts on a local system,
which can provide a basis for future attacks,
such as privilege escalation and credential harvesting.
Local user enumeration can be performed
using the various tools and commands
available on different operating systems.
For instance, on Windows systems,
tools like PowerShell can be extremely useful.
PowerShell commands can list users, groups,
and their associated privileges.
For example, the Get-LocalUser command
provides a list of all local user accounts on the system.
Additionally, the net user command
can be used to display detailed information
about each user as well.
Now, on compromised systems, a Meterpreter,
a component of Metasploit framework,
can also be employed for local user enumeration.
Meterpreters offer several commands for this purpose.
The getuid command reveals the user ID
of the current session, helping to understand
the privileges of a compromised account.
The ps command, which lists all running processes,
can also indicate user activities
and potential targets for privilege escalation.
For Linux systems, common commands include
cat/etc/passwd
or passwd,
and cat/etc/shadow,
which lists all user accounts
and their hashed passwords respectively.
These files contain vital information about user accounts
and their associated privileges.
This command will display a list of user accounts
along with their user IDs, group IDs,
home directories, and default shells.
By examining this information,
you can identify regular user accounts
and those with higher privileges, such as root accounts.
Now, on this screen here, I used the tail command
to capture just the bottom ten lines of the file
to show the user account parallels
in its corresponding hash value of the password.
That's how you know a password is set.
If you look, the jkelly account
does not have a password set
which is indicated by the absence of the hash value.
The id command could also be useful to display the user ID,
group ID, and group memberships of the current user.
Another useful command is net localgroup administrators,
which lists all members of the local administrators group.
Now, if you could use the net localgroup,
it will list all the different groups
for you to choose from.
So remember, local user enumeration
is a critical part of pentesting.
By using tools and commands like PowerShell, Meterpreter,
net user, and cat/etc/passwd,
you can gather essential information
about user accounts on a local system.
This knowledge helps penetration testers
identify potential targets for privilege escalation
and other attacks,
thereby uncovering significant vulnerabilities
and recommending effective mitigation strategies.