SAL-BOF — Local Reconnaissance

The SAL-BOF (Situational Awareness — Local) module provides commands to gather information from the local system where the agent is running. These commands should be the first you run after gaining access to a machine to understand the environment before taking any further action.

Compatible agents: Beacon, Gopher, Kharon (Windows)

arp#

Displays the system’s ARP table, revealing MAC and IP addresses of hosts the machine has recently interacted with.

arp

When to use: To identify neighboring hosts on the local network. Useful for discovering servers, gateways, and other devices without generating active scanning traffic.

cacls#

Displays the access control lists (ACLs) of a file or directory.

cacls C:\Users\Administrator\Documents
cacls C:\Windows\System32\config\SAM

When to use: To verify permissions before attempting to access, modify, or exfiltrate sensitive files. Also to look for weak permission configurations that allow privilege escalation.

dir#

Lists the contents of a directory.

dir C:\Users
dir C:\inetpub\wwwroot --subdirs

When to use: To explore the target’s file system. With --subdirs you can search for files of interest across an entire directory structure (configurations, scripts, sensitive documents).

env#

Lists all system and current user environment variables.

env

When to use: To discover valuable information such as application paths, domain names, proxy servers, database variables, tokens, or API keys that are frequently stored in environment variables.

ipconfig#

Displays the network configuration for all interfaces.

ipconfig

When to use: To identify the system’s network interfaces, IP addresses, subnet masks, gateways, and DNS servers. Essential for planning lateral movement and understanding network topology.

listdns#

Lists the system’s DNS cache.

listdns

When to use: The DNS cache reveals hostnames the machine has recently resolved, providing intelligence about the services and servers it regularly interacts with, without needing active DNS queries.

netstat#

Displays active network connections, listening ports, and associated processes.

netstat

When to use: To identify running services, established connections to other servers, and open ports. Helps discover internal services, database connections, and communications with other systems on the network.

nslookup#

Performs DNS queries to resolve hostnames.

nslookup dc01.domain.local
nslookup mail.domain.local MX
nslookup intranet.corp A 10.0.0.1

When to use: To resolve internal server names, locate domain controllers, mail servers, or internal services. Specifying a different DNS server allows discovering records not in the local cache.

privcheck#

Performs checks for potential local privilege escalation vectors. This is one of the most important commands in this module.

Run all checks#

privcheck all

Individual checks#

alwayselevated#

privcheck alwayselevated

Checks if the AlwaysInstallElevated registry keys are enabled in both HKLM and HKCU. If both are active, any MSI package will install with SYSTEM privileges, allowing immediate escalation.

autologon#

privcheck autologon

Searches for auto-logon credentials stored in the registry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon). These credentials are frequently stored in clear text.

credmanager#

privcheck credmanager

Lists credentials stored in the Windows Credential Manager. May contain passwords for applications, websites, and network resources.

hijackablepath#

privcheck hijackablepath

Identifies directories in the system PATH variable that are writable by the current user. Allows planting malicious DLLs that will be loaded by legitimate applications (DLL hijacking).

modautorun#

privcheck modautorun

Searches for auto-start entries (Run/RunOnce registry, Startup folders) whose binaries or paths are modifiable by the current user. Allows persistence or escalation by replacing the binary.

modsvc#

privcheck modsvc

Identifies Windows services whose executable binaries are modifiable by the current user. Replacing the service binary allows executing code as SYSTEM when the service restarts.

tokenpriv#

privcheck tokenpriv

Lists the current user’s token privileges, highlighting dangerous privileges such as:

• SeImpersonatePrivilege — Allows Potato-style attacks to obtain SYSTEM
• SeAssignPrimaryTokenPrivilege — Allows assigning tokens to new processes
• SeDebugPrivilege — Allows debugging any process (LSASS access)
• SeBackupPrivilege — Allows reading any system file
• SeRestorePrivilege — Allows writing any system file
• SeTakeOwnershipPrivilege — Allows taking ownership of any object

unattendfiles#

privcheck unattendfiles

Searches for unattend.xml, sysprep.xml, and similar files that may contain installation credentials in clear text or Base64 encoded.

unquotedsvc#

privcheck unquotedsvc

Detects services with unquoted binary paths containing spaces. Windows interprets these spaces as argument separators, allowing planting an executable in an intermediate path.

pshistory#

privcheck pshistory

Reads the user’s PowerShell command history. May reveal credentials, administration commands, and sensitive operations previously executed.

uacstatus#

privcheck uacstatus

Displays the current UAC (User Account Control) configuration: notification level, administrator token filtering, and policy status. Allows evaluating whether a UAC bypass is viable.

vulndrivers#

privcheck vulndrivers

Searches for known vulnerable drivers loaded on the system. Vulnerable drivers can be exploited to obtain kernel-mode code execution (BYOVD — Bring Your Own Vulnerable Driver).

When to use: Run privcheck all immediately after gaining access as a non-privileged user. The results will guide your privilege escalation strategy. Even if you’re already an administrator, it’s still useful for identifying stored credentials and understanding the system’s security posture.

routeprint#

Displays the system’s routing table.

routeprint

When to use: To understand the system’s network connectivity — which subnets are reachable, through which interfaces and gateways. Critical for planning pivoting and lateral movement.

uptime#

Displays how long the system has been running.

uptime

When to use: A long uptime suggests the machine isn’t rebooted frequently, which may indicate security updates aren’t being applied. Also helps determine access stability.

useridletime#

Displays the current user’s idle time.

useridletime

When to use: To determine if a user is actively using the machine. A long idle time indicates it’s safer to execute operations that might generate visible windows or alerts (such as askcreds).

whoami#

Displays detailed information about the current user, including SID, groups, and privileges.

whoami
whoami /all

When to use: First command to run after gaining access. Confirms the user’s identity, group memberships (Domain Admins, Local Administrators, etc.), and available privileges. The /all flag provides the full information needed to assess the current security context.

Recommended workflow#

1. whoami /all — Identify user and privileges
2. ipconfig + routeprint — Understand the network
3. env — Search for variables with sensitive information
4. netstat — Identify connections and services
5. arp + listdns — Discover neighboring hosts
6. privcheck all — Evaluate escalation vectors (if not admin)