whoami /all
whoami /user
systeminfo
net accounts
net user
net user /domain
net user <USERNAME>
Get-LocalUser
Get-LocalGroup
Get LocalGroupMember <GROUP>
Get-Process
tree /f C:\Users\
tasklist /SVC
sc query
sc qc <SERVICE>
netsh firewall show state
schtasks /query /fo LIST /v
wmic qfe get Caption,Description,HotFixID,InstalledOn
driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object 'Display Name', 'Start Mode', Path
Using the tasklist command to look at running processes will give us a better idea of what applications are currently running on the system.
tasklist /svc
Display All Environment Variables
set
View Detailed Configuration Information
systeminfo
wmic qfe
// PowerShell
Get-HotFix | ft -AutoSize
Installed Programs
wmic product get name
// Powershell
Get-WmiObject -Class Win32_Product | select Name, Version
Display Running Processes
The netstat command will display active TCP and UDP connections which will give us a better idea of what services are listening on which port(s) both locally and accessible to the outside.
netstat -ano
Listing Named Pipes with Pipelist
pipelist.exe /accepteula
After obtaining a listing of named pipes, we can use Accesschk to enumerate the permissions assigned to a specific named pipe by reviewing the Discretionary Access List (DACL), which shows us who has the permissions to modify, write, read, or execute a resource.
accesschk.exe /accepteula \\.\Pipe\lsass -v
Check all named pipes that allow write access
accesschk.exe -w \pipe\* -v
User & Group Information
Logged-In Users
query user
Current User
echo %USERNAME%
whoami
Current User Privileges
whoami /priv
Current User Group Information
whoami /groups
Get All Users
net user
Get All Groups
net localgroup
Details About a Group
net localgroup administrators
Get Password Policy & Other Account Information
net accounts
Show hidden Files and Folders
dir /a // show hidden folders
dir /a:d // show all hidden directories
dir /a:h // show all hidden files
cmd /c dir /A // show hidden folders
cmd /c dir /A:D // show all hidden directories
cmd /c dir /A:H // show all hidden files
powershell ls -force // show all hidden files
User Handling
Adding Users to Groups
net user <USERNAME> <PASSWORD> /add /domain
net group "Exchange Windows Permissions" /add <USERNAME>
net localgroup "Remote Management Users" /add <USERNAME>
Get-History
(Get-PSReadlineOption).HistorySavePath
type C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
reg save hklm\system system
reg save hklm\sam sam
reg.exe save hklm\sam c:\temp\sam.save
reg.exe save hklm\security c:\temp\security.save
reg.exe save hklm\system c:\temp\system.save
C:\Windows\System32\inetsrv>appcmd.exe list apppool /@:*
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString