Skip to content
HackIndex logo

HackIndex

Windows System Enumeration

3 min read Jul 14, 2026

System enumeration establishes the baseline for everything that follows. OS version, architecture, installed patches, and environment details determine which exploits are viable and which techniques apply. Run this on every Windows target before attempting privilege escalation or lateral movement.

OS version and architecture

PS C:\Users\Guest\Desktop> # Full system information
PS C:\Users\Guest\Desktop> systeminfo
 
PS C:\Users\Guest\Desktop> # Concise version
PS C:\Users\Guest\Desktop> systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix" /C:"Domain"
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> [System.Environment]::OSVersion
PS C:\Users\Guest\Desktop> $PSVersionTable
 
PS C:\Users\Guest\Desktop> # Architecture
PS C:\Users\Guest\Desktop> [System.Environment]::Is64BitOperatingSystem
PS C:\Users\Guest\Desktop> [System.Environment]::Is64BitProcess 
OS Name:                   Microsoft Windows Server 2019 Datacenter
OS Version:                10.0.17763 N/A Build 17763
System Type:               x64-based PC
Domain:                    corp.local

The build number is more reliable than the OS name for exploit matching. Build 17763 is Server 2019 / Windows 10 1809. Cross-reference with Windows Kernel Exploits to find applicable CVEs.

Installed patches and hotfixes

PS C:\Users\Guest\Desktop> # List all installed hotfixes
PS C:\Users\Guest\Desktop> wmic qfe list
PS C:\Users\Guest\Desktop> Get-HotFix | Sort-Object InstalledOn -Descending
 
PS C:\Users\Guest\Desktop> # Check for specific KB (e.g. KB for PrintNightmare patch)
PS C:\Users\Guest\Desktop> Get-HotFix -Id KB5004945
PS C:\Users\Guest\Desktop> wmic qfe | findstr KB5004945
 
PS C:\Users\Guest\Desktop> # WES-ng input — save systeminfo output
PS C:\Users\Guest\Desktop> systeminfo > C:\Windows\Temp\sysinfo.txt
PS C:\Users\Guest\Desktop> # Then transfer and run on attack box:
PS C:\Users\Guest\Desktop> # python3 wes.py sysinfo.txt

Environment variables and paths

PS C:\Users\Guest\Desktop> # All environment variables
PS C:\Users\Guest\Desktop> set
PS C:\Users\Guest\Desktop> Get-ChildItem Env:
 
PS C:\Users\Guest\Desktop> # Key variables
PS C:\Users\Guest\Desktop> $env:PATH
PS C:\Users\Guest\Desktop> $env:USERNAME
PS C:\Users\Guest\Desktop> $env:USERDOMAIN
PS C:\Users\Guest\Desktop> $env:COMPUTERNAME
PS C:\Users\Guest\Desktop> $env:TEMP
PS C:\Users\Guest\Desktop> $env:APPDATA
PS C:\Users\Guest\Desktop> $env:PROGRAMFILES
PS C:\Users\Guest\Desktop> $env:PROGRAMFILES(X86)
 
PS C:\Users\Guest\Desktop> # Check for writable directories in PATH (DLL hijacking potential)
PS C:\Users\Guest\Desktop> $env:PATH -split ';' | ForEach-Object { if (Test-Path $_) { $acl = Get-Acl $_; $acl.Access | Where-Object {$_.IdentityReference -match 'Users|Everyone|Authenticated' -and $_.FileSystemRights -match 'Write|FullControl'} | ForEach-Object {Write-Host "Writable PATH: $_"} } }

Installed software

PS C:\Users\Guest\Desktop> # 64-bit applications
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation | Sort-Object DisplayName
 
PS C:\Users\Guest\Desktop> # 32-bit applications
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation | Sort-Object DisplayName
 
PS C:\Users\Guest\Desktop> # Program Files directories
PS C:\Users\Guest\Desktop> Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | Select-Object Name
 
PS C:\Users\Guest\Desktop> # Check for interesting software
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | findstr /i "VNC Kerberos Putty Git python ruby perl"

Drives and file system

PS C:\Users\Guest\Desktop> # Logical drives
PS C:\Users\Guest\Desktop> Get-PSDrive -PSProvider FileSystem
PS C:\Users\Guest\Desktop> wmic logicaldisk get caption,description,providername
 
PS C:\Users\Guest\Desktop> # Local shares
PS C:\Users\Guest\Desktop> net share
PS C:\Users\Guest\Desktop> Get-SmbShare
 
PS C:\Users\Guest\Desktop> # Writable directories (useful for dropping tools)
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ | ForEach-Object { try { [System.IO.File]::Create("$($_.FullName)\test.tmp").Close(); Remove-Item "$($_.FullName)\test.tmp"; Write-Host "Writable: $($_.FullName)" } catch {} }

References