> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enumeration Checklist

> Windows privilege escalation enumeration: identity, system info, users, network, services, and credential hunting via CMD and PowerShell.

## CMD Enumeration

### Identity

```cmd theme={"dark"}
whoami
whoami /priv
whoami /groups
echo %USERNAME%
hostname
```

### System Information

```cmd theme={"dark"}
systeminfo
ver
wmic os get Caption,Version,BuildNumber,OSArchitecture
```

### Users & Groups

```cmd theme={"dark"}
net user
net user %USERNAME%
net localgroup
net localgroup administrators
```

### Network

```cmd theme={"dark"}
ipconfig /all
route print
arp -a
netstat -ano
```

### Running Processes

```cmd theme={"dark"}
tasklist /v
```

### Services

```cmd theme={"dark"}
sc query
wmic service get name,displayname,pathname,startmode
```

### Scheduled Tasks

```cmd theme={"dark"}
schtasks /query /fo LIST /v
```

### Drives

```cmd theme={"dark"}
wmic logicaldisk get name
```

### Installed Updates / Kernel Exploits

```cmd theme={"dark"}
wmic qfe
```

***

## PowerShell Enumeration

### Identity

```powershell theme={"dark"}
whoami
whoami /priv
whoami /groups
$env:USERNAME
$env:COMPUTERNAME
```

### System Information

```powershell theme={"dark"}
Get-ComputerInfo
Get-CimInstance Win32_OperatingSystem | select Caption,Version,BuildNumber,OSArchitecture
Get-ChildItem Env:
```

### Users & Groups

```powershell theme={"dark"}
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember "Administrators"
```

### Network

```powershell theme={"dark"}
Get-NetIPAddress
Get-NetRoute
Get-NetTCPConnection
```

### Installed Software

#### 64-bit Programs

```powershell theme={"dark"}
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select DisplayName,DisplayVersion,Publisher
```

#### 32-bit Programs

```powershell theme={"dark"}
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select DisplayName,DisplayVersion,Publisher
```

### Processes

```powershell theme={"dark"}
Get-Process
```

### Services

```powershell theme={"dark"}
Get-Service
Get-CimInstance Win32_Service | select Name,DisplayName,PathName,StartMode
```

### Scheduled Tasks

```powershell theme={"dark"}
Get-ScheduledTask
```

### Drives

```powershell theme={"dark"}
Get-PSDrive -PSProvider FileSystem
```

### Hotfixes / Patches

```powershell theme={"dark"}
Get-HotFix
```

### Defender Status

```powershell theme={"dark"}
Get-MpComputerStatus
```

### Loot & Credential Hunting

```powershell theme={"dark"}
# Search documents (possible credentials)
Get-ChildItem -Path C:\Users\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

# PowerShell command history (very important!)
(Get-PSReadlineOption).HistorySavePath
```

```shellscript theme={"dark"}
# Search for documents containing "pass" string (CMD)
findstr /SIM /C:"pass" *.ini *.cfg *.xml
```