When approaching a Windows system during an engagement, the first objective is simple: understand the environment before interacting with it.

This walkthrough focuses on structured system and network enumeration, highlighting how much information can be gathered without exploiting a single vulnerability.

Starting with Network Identification

The first step was to identify the system's position within the network.

ipconfig

This revealed the internal addressing scheme:

IPv4 Address: 192.168.132.x  
Subnet Mask: 255.255.255.0  
Default Gateway: 192.168.132.x

Even at this stage, we establish:

  • The system is part of a private network
  • The /24 subnet suggests a typical small-to-medium environment
None

Verifying System Context

Before moving further, I checked system time and environment context.

date /t
time /t

This helps correlate logs later and understand whether the system is actively used or part of a lab environment.

None

SMB Activity and Workstation Statistics

Next, I inspected workstation-level network statistics.

net statistics workstation

The output showed:

  • Minimal SMB activity
  • No read/write operations
  • No network errors

This suggests either a controlled environment or low user interaction at the time.

None

Identifying Logged-in Users

Understanding who is actively using the system is critical.

PsLoggedon.exe

This revealed:

Active User: MSEDGEWIN10\IEUser

This immediately gives a foothold for:

  • User-level targeting
  • Credential-based attacks
  • Session hijacking (in real environments)
None

Logon Sessions and Authentication Context

To go deeper, I enumerated logon sessions.

LogonSessions.exe

Key observations:

  • Authentication: NTLM
  • SID: SYSTEM-level context (S-1-5-18)
  • No domain controller references

This confirmed that the system is operating in a WORKGROUP, not a domain environment.

None

Enumerating Shares and Sessions

Next, I checked for shared resources.

net share

Available shares included:

  • ADMIN$
  • C$
  • D$
  • IPC$
  • backup
  • HR
  • public

The presence of backup and HR shares is particularly interesting, as these often contain sensitive data.

net session

No active sessions were found, indicating no current remote connections.

None

Process Enumeration

To ensure there were no suspicious processes running:

pslist.exe

The system showed only standard Windows processes:

  • System
  • smss
  • csrss
  • winlogon

No anomalies were observed, indicating a clean baseline.

None

Network Activity Analysis

To understand real-time communication:

netstat -e

This confirmed:

  • Active packet transmission
  • No errors or dropped packets
None

Open Ports and Active Connections

A deeper look into network connections:

netstat -ano

Revealed:

  • Port 135 (RPC)
  • Port 445 (SMB)
  • Dynamic RPC ports
  • Active outbound HTTPS connections

The exposure of SMB (445) is always significant, as it is one of the most targeted services in Windows environments.

None

Routing and Network Structure

To map network paths:

netstat -r

This confirmed:

  • Default route via 192.168.132.x
  • Local subnet communication
None

External Communication Insight

Further inspection of connections showed:

  • Multiple outbound HTTPS connections
  • States such as ESTABLISHED, TIME_WAIT, CLOSE_WAIT

This indicates the system is actively communicating with external infrastructure.

NetBIOS Enumeration

To gather host-level identity:

nbtstat -n

Findings:

  • Hostname: MSEDGEWIN10
  • Workgroup: WORKGROUP
  • NetBIOS services active
None

Deep Network Configuration

For a complete overview:

ipconfig /all

This revealed:

  • Network adapter details
  • MAC address
  • DHCP configuration
None

DNS Cache — A Hidden Goldmine

One of the most valuable steps in enumeration:

ipconfig /displaydns

This exposed:

icpanel.hackcrack.io → 192.168.132.x

This is critical because:

  • It reveals previously accessed domains
  • It can expose internal or external infrastructure
  • It provides pivot points for further investigation
None

Clearing DNS Cache

To verify control over the system:

ipconfig /flushdns
ipconfig /displaydns

The cache was successfully cleared, confirming command execution and system interaction.

None

Key Takeaways

This exercise demonstrates that even without exploitation, a large amount of valuable information can be gathered:

  • Internal network structure
  • Active users
  • Shared resources
  • Open services
  • External communication
  • Cached domain intelligence

Final Thoughts

Enumeration is often underestimated, but in real-world scenarios, it is one of the most critical phases of any engagement.

The difference between a failed attack and a successful compromise often lies not in exploitation skills — but in how well the attacker understands the environment.

This walkthrough reinforces a simple principle:

The more you know about the system, the less you need to guess.