Question

After compromising a standard user workstation in a Windows domain, a penetration tester wants to enumerate other hosts and identify which remote systems expose accessible file shares to plan lateral movement. The tester wants to avoid dropping additional tooling on the host and prefers living-off-the-land binaries. Which built-in command sequence BEST accomplishes discovering domain hosts and then enumerating their shared resources?

Accepted Answer

Use 'net view /domain' to list domain hosts, then 'net view \<hostname>' against discovered systems to enumerate their shared resources

Answer

Run 'ipconfig /all' to identify the local subnet, then 'arp -a' to list every share on the network

Answer

Execute 'net user /domain' to list all domain accounts, then 'net accounts' to reveal each host's mounted shares

Answer

Use 'nslookup -type=SRV _ldap._tcp' to locate shares and 'whoami /priv' to map them to hostnames