GPEN · Question #417
You are pen testing a Windows system remotely via a raw netcat shell. You want to get a listing of all the local users in the administrators group, what command would you use?
The correct answer is C. Net localgroup administrators. The Windows 'net localgroup' command queries local group membership, making it the correct tool for listing administrators during post-exploitation.
Question
You are pen testing a Windows system remotely via a raw netcat shell. You want to get a listing of all the local users in the administrators group, what command would you use?
Options
- ANet account administrators
- BNet user administrators
- CNet localgroup administrators
- DNet localuser administrators
How the community answered
(56 responses)- A4% (2)
- B2% (1)
- C84% (47)
- D11% (6)
Why each option
The Windows 'net localgroup' command queries local group membership, making it the correct tool for listing administrators during post-exploitation.
'Net accounts' manages password and lockout policies at the account level and does not display group membership information.
'Net user' lists all local user accounts or details for a specific user, but it does not filter or display users by group membership.
The 'net localgroup administrators' command enumerates all members of the local Administrators group on a Windows system, which is exactly the information needed during post-exploitation reconnaissance. It is a built-in Windows command available without additional tools and works reliably from a remote command shell.
'Net localuser' is not a valid Windows net subcommand and will return a syntax error if executed.
Concept tested: Windows net localgroup command for administrator enumeration
Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc725622(v=ws.11)
Topics
Community Discussion
No community discussion yet for this question.