🆕 Enumerate Active Windows Sessions

{% include "../../.gitbook/includes/admin-privs.md" %}

When connecting to a Windows server via GUI interface (local connection or RDP) a windows session will be created. These session can be listed using the following option

nxc smb <target> -u <username> -p <password> --qwinsta

Note that if a session if found, an attacker will be able to:

• Impersonate the primary token for that user (if credentials are stored in memory) ;
• Run tasks on behalf of that user.

Sometimes you'll end up having to hunt for a specific user which can be done filling the username you are looking for:

nxc smb <target> -u <username> -p <password> --qwinsta username