Enumerar permisos de usuarios
whoami /all → Muestra TODOS los grupos y privilegios asociados al usuario actual (muy útil para detectar posibles escalaciones de privilegio).
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
l4mpje@BASTION C:\Users\L4mpje>whoami /all
USER INFORMATION
----------------
User Name SID
============== ==============================================
bastion\l4mpje S-1-5-21-2146344083-2443430429-1430880910-1002
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
====================================== ================ ============ ========================
==========================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled
by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled
by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled
by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled
by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled
by default, Enabled group
NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled
by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled
by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled net user → Lista todos los usuarios locales.
net user nombre_usuario → Muestra detalles de un usuario en específico (si tiene habilitada la contraseña, cuándo caduca, etc.).
net localgroup → Lista los grupos locales (como Administrators, Remote Desktop Users, etc.).
net localgroup Administrators → Muestra quién pertenece al grupo de Administradores.
whoami /priv → muestra los permisos asociados al usuario actual
Last updated