> ## Documentation Index > Fetch the complete documentation index at: https://docs.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # Situational Awareness Commands > Commands for reconnaissance and enumeration of target systems Most situational awareness commands require you to first set a target device using the `interact [ResourceID]` command. You can find ResourceIDs using the database query commands. ## System Information Commands ### administrators #### Description Query the interactive device for members of the device's local administrators group. #### Usage ``` administrators ``` #### Example ``` (16777221) (C:\) >> administrators [19:38:17] INFO Tasked SCCM to run Administrators. [19:38:19] INFO Got OperationId 16779666. Sleeping 10 seconds to wait for host to call home. [19:38:29] INFO No results yet, sleeping 10 seconds. [19:38:41] INFO +---------------+----------------------+-------------------+----------+ | ObjectClass | Name | PrincipalSource | Device | +===============+======================+===================+==========+ | User | DP\Administrator | Local | DP | +---------------+----------------------+-------------------+----------+ | Group | LAB\Domain Admins | ActiveDirectory | DP | +---------------+----------------------+-------------------+----------+ | Group | LAB\SCCM_SiteServers | ActiveDirectory | DP | +---------------+----------------------+-------------------+----------+ ``` ### console\_users #### Description Returns data detailing the users that have logged on to the target system. #### Usage ``` console_users ``` #### Example ``` (16777221) (C:\) >> console_users [19:39:28] INFO Tasked SCCM to show all users that have signed in. [19:39:31] INFO Got OperationId 16779667. Sleeping 10 seconds to wait for host to call home. [19:39:41] INFO +---------------------+-------------------------+-------------------------------+---------------------------+----------+ | LastConsoleUse | NumberOfConsoleLogons | SystemConsoleUser | TotalUserConsoleMinutes | Device | +=====================+=========================+===============================+===========================+==========+ | 2024-01-27 14:08:00 | 1 | win-3sflnhdib39\administrator | 495 | DP | +---------------------+-------------------------+-------------------------------+---------------------------+----------+ | 2024-01-28 22:42:35 | 1 | lab\administrator | 2435 | DP | +---------------------+-------------------------+-------------------------------+---------------------------+----------+ ``` ### sessions #### Description List active sessions on the interactive device. #### Usage ``` sessions ``` #### Example ``` (16777221) (C:\) >> sessions [19:50:29] INFO Tasked SCCM to show users currently signed in to 16777221. [19:50:31] INFO Got OperationId 16779679. Sleeping 10 seconds to wait for host to call home. [19:50:41] INFO +---------------------+----------+ | UserName | Device | +=====================+==========+ | DP\DefaultAppPool | DP | +---------------------+----------+ | DP\IUSR | DP | +---------------------+----------+ | DP\LOCAL SERVICE | DP | +---------------------+----------+ | DP\NETWORK SERVICE | DP | +---------------------+----------+ | LAB\Administrator | DP | +---------------------+----------+ | NT AUTHORITY\SYSTEM | DP | +---------------------+----------+ ``` ## Hardware Information Commands ### disk #### Description List available disk drives and space on the interactive system. #### Usage ``` disk ``` #### Example ``` (16777221) (C:\) >> disk [19:40:23] INFO Tasked SCCM to show disk information of 16777221. [19:40:24] INFO Got OperationId 16779668. Sleeping 10 seconds to wait for host to call home. [19:40:35] INFO +--------+------------------+-------------+-------------+--------------+----------------------+----------+ | Name | Description | Size | FreeSpace | Compressed | VolumeSerialNumber | Device | +========+==================+=============+=============+==============+======================+==========+ | C: | Local Fixed Disk | 53012852736 | 40399273984 | False | 5E2D550E | DP | +--------+------------------+-------------+-------------+--------------+----------------------+----------+ | D: | CD-ROM Disc | 5044094976 | 0 | False | D10C768B | DP | +--------+------------------+-------------+-------------+--------------+----------------------+----------+ ``` ### list\_disk #### Description Lists available disk drives on the interactive system. #### Usage ``` list_disk ``` #### Example ``` (16777221) (C:\) >> list_disk [19:43:02] INFO Tasked SCCM to show mounted drives on 16777221. [19:43:04] INFO Got OperationId 16779671. Sleeping 10 seconds to wait for host to call home. [19:43:17] INFO +------------------+-----------+------------+----------+ | Description | Caption | DeviceID | Device | +==================+===========+============+==========+ | Local Fixed Disk | C: | C: | DP | +------------------+-----------+------------+----------+ | CD-ROM Disc | nan | D: | DP | +------------------+-----------+------------+----------+ ``` ## System Configuration Commands ### environment #### Description List environment variables from the interactive system. #### Usage ``` environment ``` #### Example ``` (16777221) (C:\) >> environment [19:40:51] INFO Tasked SCCM to show Environment variables of 16777221. [19:40:53] INFO Got OperationId 16779669. Sleeping 10 seconds to wait for host to call home. [19:41:03] INFO No results yet, sleeping 10 seconds. [19:41:14] INFO +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+ | Caption | Description | Name | Status | SystemVariable | UserName | VariableValue | Device | +===================================+===================================+========================+==========+==================+==============================+================================================================================================================================+==========+ | \ComSpec | \ComSpec | ComSpec | OK | True | | %SystemRoot%\system32\cmd.exe | DP | +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+ | \DriverData | \DriverData | DriverData | OK | True | | C:\Windows\System32\Drivers\DriverData | DP | +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+ | \OS | \OS | OS | OK | True | | Windows_NT | DP | +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+ ``` ### ipconfig #### Description Run ipconfig on the interactive host and retrieve networking info. #### Usage ``` ipconfig ``` #### Example ``` (16777221) (C:\) >> ipconfig [19:42:23] INFO Tasked SCCM to run IPCONFIG. [19:42:27] INFO Got OperationId 16779670. Sleeping 10 seconds to wait for host to call home. [19:42:39] INFO +------------------+--------------+--------------------------------------------+----------+---------------+----------------------+-----------------------------+----------+ | InterfaceAlias | Name | InterfaceDescription | Status | IPV4Address | IPV4DefaultGateway | DNSServerList | Device | +==================+==============+============================================+==========+===============+======================+=============================+==========+ | Ethernet0 | internal.lab | Intel(R) 82574L Gigabit Network Connection | Up | 10.10.100.11 | 10.10.100.10 | 10.10.100.100; 10.10.100.10 | DP | +------------------+--------------+--------------------------------------------+----------+---------------+----------------------+-----------------------------+----------+ ``` ### osinfo #### Description Query operating system and architecture info for the interactive device. #### Usage ``` osinfo ``` #### Example ``` (16777221) (C:\) >> osinfo [19:45:22] INFO Tasked SCCM to show system info of 16777221. [19:45:25] INFO Got OperationId 16779673. Sleeping 10 seconds to wait for host to call home. [19:45:35] INFO +---------------------------------------------------+------------+------------------+----------+ | Caption | Version | OSArchitecture | Device | +===================================================+============+==================+==========+ | Microsoft Windows Server 2022 Standard Evaluation | 10.0.20348 | 64-bit | DP | +---------------------------------------------------+------------+------------------+----------+ ``` ## Process and Service Information Commands ### ps #### Description List current running processes for the interactive device. #### Usage ``` ps ``` #### Example ``` (16777221) (C:\) >> ps [19:45:52] INFO Tasked SCCM to list processes. [19:45:53] INFO Got OperationId 16779674. Sleeping 10 seconds to wait for host to call home. [19:46:04] INFO No results yet, sleeping 10 seconds. [19:46:16] INFO +---------------------+-------------+---------------------+------------------+---------------+----------+ | Name | ProcessId | CreationDate | WorkingSetSize | HandleCount | Device | +=====================+=============+=====================+==================+===============+==========+ | System Idle Process | 0 | 2024-01-30 02:48:49 | 8192 | 0 | DP | +---------------------+-------------+---------------------+------------------+---------------+----------+ | System | 4 | 2024-01-30 02:48:49 | 151552 | 1420 | DP | +---------------------+-------------+---------------------+------------------+---------------+----------+ | Registry | 100 | 2024-01-30 02:48:43 | 75931648 | 0 | DP | +---------------------+-------------+---------------------+------------------+---------------+----------+ | smss.exe | 300 | 2024-01-30 02:48:49 | 1298432 | 57 | DP | +---------------------+-------------+---------------------+------------------+---------------+----------+ | csrss.exe | 408 | 2024-01-30 02:48:50 | 6266880 | 385 | DP | +---------------------+-------------+---------------------+------------------+---------------+----------+ ``` ### services #### Description List current running services on the interactive device. #### Usage ``` services ``` #### Example ``` (16777221) (C:\) >> services [19:47:25] INFO Tasked SCCM to list services. [19:47:27] INFO Got OperationId 16779676. Sleeping 10 seconds to wait for host to call home. [19:47:38] INFO +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+ | Name | PathName | ProcessId | ServiceType | Started | Device | +==========================================+==========================================================================================+=============+===============+===========+==========+ | AJRouter | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p | 0 | Share Process | False | DP | +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+ | ALG | C:\Windows\System32\alg.exe | 0 | Own Process | False | DP | +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+ | AppHostSvc | C:\Windows\system32\svchost.exe -k apphost | 1172 | Share Process | True | DP | +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+ ``` ### software #### Description List currently installed software on the interactive device. #### Usage ``` software ``` #### Example ``` (16777221) (C:\) >> software [19:52:10] INFO Tasked SCCM to list software installed 16777221. [19:52:12] INFO Got OperationId 16779681. Sleeping 10 seconds to wait for host to call home. [19:52:23] INFO +--------------------------------------------------------------------+-----------------------+------------------+----------+ | ProductName | Publisher | ProductVersion | Device | +====================================================================+=======================+==================+==========+ | VMware Tools | VMware, Inc. | 12.0.0.19345655 | DP | +--------------------------------------------------------------------+-----------------------+------------------+----------+ | Microsoft Visual C++ 2019 X64 Additional Runtime - 14.29.30133 | Microsoft Corporation | 14.29.30133 | DP | +--------------------------------------------------------------------+-----------------------+------------------+----------+ | Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.29.30133 | Microsoft Corporation | 14.29.30133 | DP | +--------------------------------------------------------------------+-----------------------+------------------+----------+ ``` ## Network Information Commands ### shares #### Description List all available file shares on the interactive device. #### Usage ``` shares ``` #### Example ``` (16777221) (C:\) >> shares [19:51:39] INFO Tasked SCCM to list file shares. [19:51:41] INFO Got OperationId 16779680. Sleeping 10 seconds to wait for host to call home. [19:51:52] INFO +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+ | Name | Description | Path | Type | AllowMaximum | Device | +=================+==================================================================+===================+============+================+==========+ | ADMIN$ | Remote Admin | C:\Windows | 2147483648 | True | DP | +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+ | C$ | Default share | C:\ | 2147483648 | True | DP | +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+ | IPC$ | Remote IPC | | 2147483651 | True | DP | +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+ | SCCMContentLib$ | 'Configuration Manager' Content Library for site LAB (1/27/2024) | C:\SCCMContentLib | 0 | True | DP | +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+ ``` ## File System Commands ### cd #### Description Change directories on the command line. This is required for both the `ls` and `cat` commands. #### Usage ``` cd [filepath] ``` #### Example ``` (16777221) (C:\) >> cd C:\Users (16777221) (C:\Users\) >> ls [23:25:28] INFO Tasked SCCM to list files in C:\Users\. [23:25:28] INFO Got OperationId 16779694. Sleeping 10 seconds to wait for host to call home. [23:25:41] INFO +----------------------------+--------+---------------------+--------+----------+ | FileName | Mode | LastWriteTime | Size | Device | +============================+========+=====================+========+==========+ | C:\Users\Administrator | d----- | 2024-01-27 05:53:07 | 1 | DP | +----------------------------+--------+---------------------+--------+----------+ | C:\Users\administrator.LAB | d----- | 2024-02-08 07:21:12 | 1 | DP | +----------------------------+--------+---------------------+--------+----------+ ``` ### ls #### Description Will list the contents of the current directory represented on the command line. Defaults to C:. You must issue a cd command to another known directory (i.e. `cd C:\Users`) to list the contents of that Users directory and so on. #### Usage ``` ls ``` #### Example ``` (16777221) (C:\) >> ls [19:43:31] INFO Tasked SCCM to list files in C:\. [19:43:33] INFO Got OperationId 16779672. Sleeping 10 seconds to wait for host to call home. [19:43:47] INFO +------------------------------+--------+---------------------+--------+----------+ | FileName | Mode | LastWriteTime | Size | Device | +==============================+========+=====================+========+==========+ | C:\$Recycle.Bin | d--hs- | 2024-01-27 06:07:22 | 1 | DP | +------------------------------+--------+---------------------+--------+----------+ | C:\$WinREAgent | d--h-- | 2024-01-27 14:07:43 | 1 | DP | +------------------------------+--------+---------------------+--------+----------+ | C:\Documents and Settings | d--hsl | 2024-01-27 21:59:32 | 1 | DP | +------------------------------+--------+---------------------+--------+----------+ ``` ### cat #### Description Display the contents of a file on the interactive device. The command line must be configured with the path to the file contents directory. For example, if the file you want to display is in "C:\Windows\Temp", you must issue a `cd` command to configure the command line with that file path in addition to the interactive device. #### Usage ``` cat [filename] ``` #### Example ``` (16777221) (C:\) >> cd C:\Users\administrator.LAB\.ssh (16777221) (C:\Users\administrator.LAB\.ssh\) >> cat id_rsa [23:21:41] INFO Tasked SCCM to show id_rsa [23:21:43] INFO [+] Updates script created successfully with GUID 22057b18-d704-4734-ac35-2641eae96fb4. [23:21:47] INFO [+] Script with guid 22057b18-d704-4734-ac35-2641eae96fb4 approved. [23:21:49] INFO [+] Script with guid 22057b18-d704-4734-ac35-2641eae96fb4 executed. [23:22:08] INFO [+] Got result: [23:22:08] INFO -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAv0P8SG6b1AfXaWVmslD32pxVgncux1cxgNv6CnnG/OxDvAQdsBiB [... content truncated for brevity ...] -----END OPENSSH PRIVATE KEY----- [23:22:12] INFO [+] Script with GUID 22057b18-d704-4734-ac35-2641eae96fb4 deleted. ``` SCCM limits the result returned from scripts to 4KB. If the file size is larger it will be truncated or unreliable. Additionally, since scripts are used, you may need to supply alternate credentials. All situational awareness commands operate through CMPivot and may take 10+ seconds to complete as they wait for the target system to call home and execute the commands.