Skip to content
HackIndex logo

HackIndex

Windows Network Reconnaissance Post-Exploitation

4 min read Jul 14, 2026

After landing on a Windows target, map the internal network to identify reachable hosts, active services, and trust relationships before attempting lateral movement. All of this runs from the compromised host using built-in Windows tools and lightweight binaries — no need to route traffic through your attack box.

Network interfaces and routing

Establish your network position first. Multiple interfaces often indicate a pivot point between network segments.

PS C:\Users\Guest\Desktop> # All interfaces, IPs, and DNS servers
PS C:\Users\Guest\Desktop> ipconfig /all
 
PS C:\Users\Guest\Desktop> # Routing table (identify other reachable subnets)
PS C:\Users\Guest\Desktop> route print
PS C:\Users\Guest\Desktop> netstat -r
 
PS C:\Users\Guest\Desktop> # ARP cache (recently contacted hosts — free host discovery)
PS C:\Users\Guest\Desktop> arp -a
 
PS C:\Users\Guest\Desktop> # Active DNS cache (shows recently resolved hostnames)
PS C:\Users\Guest\Desktop> ipconfig /displaydns

The ARP cache is one of the fastest ways to find live hosts without scanning — it shows every host the target has communicated with recently. The routing table reveals subnets the target can reach directly, which are your pivot targets. Multiple routes to different subnets means this host is multi-homed and likely a useful pivot point.

Active connections and listening ports

PS C:\Users\Guest\Desktop> # All active connections with process IDs
PS C:\Users\Guest\Desktop> netstat -ano
 
PS C:\Users\Guest\Desktop> # Listening ports only (local services)
PS C:\Users\Guest\Desktop> netstat -ano | findstr LISTENING
 
PS C:\Users\Guest\Desktop> # Match PIDs to process names
PS C:\Users\Guest\Desktop> netstat -anob
 
PS C:\Users\Guest\Desktop> # PowerShell equivalent
PS C:\Users\Guest\Desktop> Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | Select-Object LocalAddress, LocalPort, OwningProcess
PS C:\Users\Guest\Desktop> Get-NetUDPEndpoint | Select-Object LocalAddress, LocalPort, OwningProcess

Listening ports that are not exposed externally (not visible in your initial nmap scan) are internal services. These are prime targets — they may be administration interfaces, databases, or legacy services with weaker security than the externally-facing attack surface.

Internal host discovery

Use the target host to scan the internal network. Native tools are slower but generate less noise and require no file transfer.

PS C:\Users\Guest\Desktop> # Ping sweep — slow but reliable
PS C:\Users\Guest\Desktop> 1..254 | ForEach-Object {$ip = "192.168.1.$_"; if (Test-Connection -ComputerName $ip -Count 1 -Quiet -TimeoutSeconds 1) {Write-Host "$ip is up"}}
 
PS C:\Users\Guest\Desktop> # SMB host discovery via NetBIOS (fast)
PS C:\Users\Guest\Desktop> net view
PS C:\Users\Guest\Desktop> net view /domain
 
PS C:\Users\Guest\Desktop> # DNS enumeration of domain computers (AD environments)
PS C:\Users\Guest\Desktop> nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN
PS C:\Users\Guest\Desktop> nslookup -type=SRV _kerberos._tcp.$DOMAIN
 
PS C:\Users\Guest\Desktop> # List domain computers via net (requires domain access)
PS C:\Users\Guest\Desktop> net group "Domain Computers" /domain
 
PS C:\Users\Guest\Desktop> # ARP scan — fastest for local subnet
PS C:\Users\Guest\Desktop> arp -a

Port scanning from the target

When you need to scan internal hosts for specific services, use a lightweight static binary transferred to the target rather than PowerShell-based scanners, which are slow and noisy.

PS C:\Users\Guest\Desktop> # PowerShell port scanner (slow — use for targeted checks only)
PS C:\Users\Guest\Desktop> $ports = @(22,80,135,139,443,445,1433,3306,3389,5985,5986,8080)
PS C:\Users\Guest\Desktop> foreach ($port in $ports) {
$conn = New-Object System.Net.Sockets.TcpClient
$async = $conn.BeginConnect('192.168.1.10', $port, $null, $null)
$wait = $async.AsyncWaitHandle.WaitOne(200, $false)
if ($conn.Connected) { Write-Host "$port open" }
$conn.Close()
}
 
PS C:\Users\Guest\Desktop> # Nmap static binary (transfer to target first)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\nmap.exe -p 22,80,135,139,443,445,1433,3389,5985 192.168.1.0/24 --open
 
PS C:\Users\Guest\Desktop> # Specific host targeted scan
PS C:\Users\Guest\Desktop> C:\Windows\Temp\nmap.exe -sV -p- 192.168.1.10

Domain and Active Directory recon

In domain environments, built-in commands expose the full domain structure without any additional tools.

PS C:\Users\Guest\Desktop> # Domain controller discovery
PS C:\Users\Guest\Desktop> nltest /dclist:$DOMAIN
PS C:\Users\Guest\Desktop> nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN
 
PS C:\Users\Guest\Desktop> # Current domain info
PS C:\Users\Guest\Desktop> net accounts /domain
PS C:\Users\Guest\Desktop> nltest /domain_trusts
 
PS C:\Users\Guest\Desktop> # Domain admins
PS C:\Users\Guest\Desktop> net group "Domain Admins" /domain
 
PS C:\Users\Guest\Desktop> # Domain controllers
PS C:\Users\Guest\Desktop> net group "Domain Controllers" /domain
 
PS C:\Users\Guest\Desktop> # Full domain user list
PS C:\Users\Guest\Desktop> net user /domain
 
PS C:\Users\Guest\Desktop> # Trust relationships
PS C:\Users\Guest\Desktop> nltest /domain_trusts /all_trusts

SMB shares and accessible resources

PS C:\Users\Guest\Desktop> # Shares on current host
PS C:\Users\Guest\Desktop> net share
 
PS C:\Users\Guest\Desktop> # Shares on a remote host
PS C:\Users\Guest\Desktop> net view \\192.168.1.10
PS C:\Users\Guest\Desktop> net view \\192.168.1.10 /all
 
PS C:\Users\Guest\Desktop> # Mount and inspect a share
PS C:\Users\Guest\Desktop> net use Z: \\192.168.1.10\SHARE
PS C:\Users\Guest\Desktop> dir Z:\
net use Z: /delete
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-SmbShare
PS C:\Users\Guest\Desktop> Get-SmbConnection

Accessible SMB shares on domain systems often contain scripts, deployment files, and configuration data with credentials. Pay particular attention to SYSVOL and NETLOGON shares on domain controllers — group policy scripts and login scripts frequently contain hardcoded credentials.

With your internal network mapped and target hosts identified, the next step is lateral movement. See Pass-the-Hash and Pass-the-Ticket, PsExec and SMB Lateral Movement, and WinRM and PowerShell Remoting.