Sysinternals

Sysinternals utilities help manage, troubleshoot and diagnose Windows systems and applications.

AccessChk
Process Monitor
Sigcheck
TCPView
PsExec

Distribute Sysinternals from Kali

Download Sysinternals

Use Impacket. See File Transfer.

wget -O ./impacket-share/SysinternalsSuite.zip https://download.sysinternals.com/files/SysinternalsSuite.zip
unzip SysinternalsSuite.zip -d ./SysinternalsSuite

Upload

copy \\x.x.x.x\myshare\SysinternalsSuite.zip c:\<some path>\SysinternalsSuite.zip
powershell -c "Expand-Archive SysinternalsSuite.zip ."

AccessChk

accesschk.exe -accepteula -uws "Everyone" "C:\Program Files"

Process Monitor

Advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and includes rich and non-destructive filtering, event properties such as session IDs and user names, process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and more. Helps understand how a process interacts with the file system and Windows registry, identify flaws like Registry hijacking and DLL hijacking.

procmon.exe -accepteula

Sigcheck

Inspect the application manifest

sigcheck.exe -accepteula -a -m C:\Windows\System32\<filename>.exe

TCPView

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.

PsExec

On Kali, use command impacket-psexec. See Impacket.

Execute processes on remote systems. PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software.

Some anti-virus scanners report that one or more of the tools are infected with a “remote admin” virus. None of the PsTools contain viruses, but they have been used by viruses, which is why they trigger virus notifications.

Download PsExec: https://docs.microsoft.com/en-us/sysinternals/downloads/psexec

psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-r servicename][-h][-l][-s|-e][-x][-i [session]][-c executable [-f|-v]][-w directory][-d][-<priority>][-a n,n,...] cmd [arguments]
psexec.exe -accepteula \\<hostname> cmd.exe