The following is a list of the major Windows operating systems and associated version numbers:
| Operating System Names | Version Number |
|---|---|
| Windows NT 4 | 4.0 |
| Windows 2000 | 5.0 |
| Windows XP | 5.1 |
| Windows Server 2003, 2003 R2 | 5.2 |
| Windows Vista, Server 2008 | 6.0 |
| Windows 7, Server 2008 R2 | 6.1 |
| Windows 8, Server 2012 | 6.2 |
| Windows 8.1, Server 2012 R2 | 6.3 |
| Windows 10, Server 2016, Server 2019 | 10.0 |
Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumbe
Some other useful classes that can be used with Get-WmiObject are Win32_Process to get a process listing, Win32_Service to get a listing of services, and Win32_Bios to get Basic Input/Output System (BIOS)
Remote Desktop Connection also allows us to save connection profiles. This is a common habit among IT admins because it makes connecting to remote systems more convenient.
<aside>
Note ⚠️
As pentesters, we can benefit from looking for these saved Remote Desktop Files (.rdp) while on an engagement.
</aside>
| Directory | Function |
|---|---|
| Perflogs | Can hold Windows performance logs but is empty by default. |
| Program Files | On 32-bit systems, all 16-bit and 32-bit programs are installed here. On 64-bit systems, only 64-bit programs are installed here. |
| Program Files (x86) | 32-bit and 16-bit programs are installed here on 64-bit editions of Windows. |
| ProgramData | This is a hidden folder that contains data that is essential for certain installed programs to run. This data is accessible by the program no matter what user is running it. |
| Users | This folder contains user profiles for each user that logs onto the system and contains the two folders Public and Default. |
| Default | This is the default user profile template for all created users. Whenever a new user is added to the system, their profile is based on the Default profile. |
| Public | This folder is intended for computer users to share files and is accessible to all users by default. This folder is shared over the network by default but requires a valid network account to access. |
| AppData | Per user application data and settings are stored in a hidden user subfolder (i.e., cliff.moore\AppData). Each of these folders contains three subfolders. The Roaming folder contains machine-independent data that should follow the user's profile, such as custom dictionaries. The Local folder is specific to the computer itself and is never synchronized across the network. LocalLow is similar to the Local folder, but it has a lower data integrity level. Therefore it can be used, for example, by a web browser set to protected or safe mode. |
| Windows | The majority of the files required for the Windows operating system are contained here. |
| System, System32, SysWOW64 | Contains all DLLs required for the core features of Windows and the Windows API. The operating system searches these folders any time a program asks to load a DLL without specifying an absolute path. |
| WinSxS | The Windows Component Store contains a copy of all Windows components, updates, and service packs. |
C:\htb> tree "c:\Program Files (x86)\VMware"
Folder PATH listing
Volume serial number is F416-77BE
C:\PROGRAM FILES (X86)\VMWARE
├───VMware VIX
│ ├───doc
│ │ ├───errors
│ │ ├───features
│ │ ├───lang
│ │ │ └───c
│ │ │ └───functions
│ │ └───types
│ ├───samples
│ └───Workstation-15.0.0
│ ├───32bit
│ └───64bit
└───VMware Workstation
├───env
├───hostd
│ ├───coreLocale
│ │ └───en
│ ├───docroot
│ │ ├───client
│ │ └───sdk
│ ├───extensions
│ │ └───hostdiag
│ │ └───locale
│ │ └───en
│ └───vimLocale
│ └───en
├───ico
├───messages
│ ├───ja
│ └───zh_CN
├───OVFTool
│ ├───env
│ │ └───en
│ └───schemas
│ ├───DMTF
│ └───vmware
├───Resources
├───tools-upgraders
└───x64
There are 5 types of Windows file systems: FAT12, FAT16, FAT32, NTFS, and exFAT. FAT12 and FAT16 are no longer used on modern Windows operating systems. We will touch upon the FAT32 and exFAT file systems for this training, but our main focus will be the NTFS file system.
Pros of FAT32: