Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 42 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Otherarrow Identifying Windows Home vs Pro?
EH-Net
May 19, 2013, 08:28:54 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Identifying Windows Home vs Pro?  (Read 2968 times)
0 Members and 1 Guest are viewing this topic.
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« on: January 18, 2012, 10:24:43 AM »

I was wondering if there was a way to remotely differentiate between Windows Home and Windows Pro.  Scanning via, say nmap, only tells me if it's Windows XP vs Windows 7, etc.  The whole purpose of this is to not only create an updated and detailed database of all of PC's on the network, but to know which ones I need to upgrade to Pro so that they can be added to a Windows domain.
Logged

GSEC, eCPPT, Sec+
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #1 on: January 18, 2012, 11:02:26 AM »

If you have a list of host names/IPs in a text file, you could loop through that and execute systeminfo via psexec and redirect the output to a text file. The info you're looking for would be in the "OS Name" and/or "OS Version" fields.

You might just want to check out OpenAudit, which will also inventory software, etc.
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
tturner
Sr. Member
****
Offline Offline

Posts: 432


View Profile WWW
« Reply #2 on: January 18, 2012, 11:14:54 AM »

How about

Code:
wmic /node:machinename /user:username os get | find "Windows Home"

(or whatever the home string looks like, don't have access to one at the moment)

I did something similar in the past looking for a list of machines with specific hotfix (WMIC QFE) by creating a ping sweep and outputting results to a txt file containing just the ip addresses and using that as a source for the WMIC command by replacing machinename above with @ip_addresses.txt

*Edit* or Dynamik's solution would work too. Different strokes... I like WMIC a lot Smiley

Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog  @tonylturner http://bsidesorlando.org
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #3 on: January 18, 2012, 11:39:14 AM »

@dynamik: I've had the pstools downloaded for awhile, just obviously haven't looked through them enough haha.  Is "systeminfo via psexec" the same as the psinfo tool?  I ran a quick test with psinfo and it looks to give me what I need, but was wondering if psexec's systeminfo gives more/different info.

Thanks for the suggestions dynamik and tturner!  I think either one of these will suit my needs, and I'll look into OpenAudit as well.  An updated software inventory is something else I need too as I'm working my way through SANS 20 critical security controls.
Logged

GSEC, eCPPT, Sec+
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #4 on: January 18, 2012, 04:28:29 PM »

I like WMIC a lot Smiley

Yea, for sure. I just couldn't remember what the query was and didn't feel like searching Tongue

Is "systeminfo via psexec" the same as the psinfo tool? 

It certainly appears very close. I guess that simplifies things a bit...

I ran a quick test with psinfo and it looks to give me what I need, but was wondering if psexec's systeminfo gives more/different info.

systeminfo is a built in utility. Just type it in at the command prompt and see what you get. psexec was only recommended in conjunction in order to execute it on remote systems.

Now that I look at it, systeminfo /? shows that you can use it on remote systems too. I guess I failed all over this thread Shocked
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
hell_razor
Jr. Member
**
Offline Offline

Posts: 90


View Profile
« Reply #5 on: January 18, 2012, 04:34:23 PM »

nmap -sS -p 445 --script=smb-os-discovery.nse target_ip
Logged

A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #6 on: January 18, 2012, 04:56:41 PM »

I guess I failed all over this thread Shocked

lol Noo, you got me going on my way Smiley  I've been playing around with psexec/systeminfo all day and will probably go this route as I'm more comfortable with this than WMIC.  JGamblin replied on Twitter as well:

Quote
psexec systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

Now my issue is that the network didn't have any standard in configuring new PC's so there is no standard/common admin account to use to query machines for system information.  That's over 200 machines Undecided

While writing this reply, hell_razor replied...

...thanks!  I gave that a shot on some of the machines here and it works pretty well!  There were a few that it wouldn't report whether it was Home or Pro, but most did.  This will help a lot until I can get around to all of the computers and setup a standard admin account (unless there's another way??)...
« Last Edit: January 18, 2012, 04:58:49 PM by lorddicranius » Logged

GSEC, eCPPT, Sec+
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #7 on: January 18, 2012, 05:04:19 PM »

Are you not using Active Directory?
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #8 on: January 18, 2012, 05:28:36 PM »

Not presently Sad  Updating the network is one of the reasons I was specifically hired for, but management doesn't want to play nice (if it's not broken, then why "fix" it).  So as I'm making plans for the upgrade to the network on paper, I'm showing my manager all the ways it'd save time and money as I go through my day to day duties (most recently an issue with an Excel update that caused most users issues when printing graphs).

I understand that each of these will float out of his memory as time goes, so at the same time I'm taking note of all these things I talk to him about so that I can present them all in one big presentation at a later date...for the bigger impact.
Logged

GSEC, eCPPT, Sec+
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.072 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.