in cortado/rtas/enum_commands.py [0:0]
def main():
sample_size = 6
slow_commands = ["gpresult.exe /z", "systeminfo.exe"]
commands = [
"ipconfig /all",
"net localgroup administrators",
"net user",
"net user administrator",
"net user /domain" "tasklist",
"net view",
"net view /domain",
"net view \\\\%s" % _common.get_host_ip(),
"netstat -nao",
"whoami",
"hostname",
"net start",
"tasklist /svc",
"net time \\\\%s" % _common.get_host_ip(),
"net use",
"net view",
"net start",
"net accounts",
"net localgroup",
"net group",
'net group "Domain Admins" /domain',
"net share",
"net config workstation",
]
commands.extend(slow_commands)
sample = min(len(commands), sample_size)
if sample < len(commands):
random.shuffle(commands)
log.info("Running {} out of {} enumeration commands\n".format(sample, len(commands)))
for command in commands[0:sample]:
log.info("Running `{command}`")
if command in slow_commands:
code, _, _ = _common.execute_command(command, shell=True, timeout_secs=15)
else:
code, _, _ = _common.execute_command(command, shell=True)
log.info(f"Retcode for `{command}`: {code}")