During an internal penetration test, you have gained a shell on a Windows server. Now, you aim to perform enumeration to identify domain users for potential lateral movement. What command should you use to list all users in the domain?
The net user /domain command is used to enumerate all user accounts in the domain from a Windows command line. In the context of a penetration test, after gaining a shell on a Windows server, if the server is a part of a domain, this command can be utilized to gather information about the users in that domain. This knowledge could then be leveraged to attempt lateral movement. dsquery is indeed used to query the directory service for various types of objects, but it requires specifying the object type, which is not reflected in the provided answer options. Get-LocalUser is a PowerShell cmdlet to retrieve local user accounts, not domain users. netstat displays network statistics and is unrelated to user enumeration.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is lateral movement in cybersecurity?
Open an interactive chat with Bash
What does the command 'net user /domain' do?
Open an interactive chat with Bash
What are the differences between 'dsquery' and 'net user /domain'?