Elusive Thoughts: Windows Hackers Command Reference

Windows Command Reference for Pen-testers

This part of the blog is dedicated to Windows commands that can be used from Penetration Testers (yea who is your tester?) and Information Security Administrators. In this page I will periodically post Windows tiny simple scripts and commands that a Penetration tester or a Security Administrator can use to:

1. Perform Administration Security tasks (e.g do patch enforcement, silently uninstall software e.t.c).
2. Run Vulnerability Scans (e.g Identify null sessions, test for LANMAN services e.t.c).
3. Do pivoting (e.g after compromising a machine use windows tools to escalate e.t.c).

Test for installed patches

In order to run WMIC you just open up a command prompt and type wmic and you imminently get an interactive command shell with root accesses.

Identifying the windows security patches using WMIC

wmic qfe get description,installedOn

Note: This produces a long list of Windows Patches and when they were installed and exports the results in stdout. That way you know exactly how to attack the workstation or perform remediation to a workstation.

Identifying windows services

sc query type= service (running services)
sc query type= service state= inactive (exist but don't run)
sc query type= service state= all (running and not running)

Identifying windows startup programs

This commands are reporting the start up programs:

wmic startup
wmic startup list full
wmic startup list brief
wmic startup list system

Note: This commands produces a list with all start up programs along with their registry keys, a program description and program name. The options shown above give you various output. Very interesting when doing malware behavioral analysis.

wmic /node:machinename startup list full
wmic STARTUP GET Caption, Command, User

Note: Remotely list startup apps

Identifying windows network cards

WMIC can also give you lots of information about the network cards and drivers:

wmic nicconfig list

Note: That will give you a list of all network drivers

wmic nicconfig where IPEnabled='true'

Note: That will give you a list of IP interfaces.

wmic nicconfig where index=9 call enablestatic("192.168.16.4"), ("255.255.255.0")

Note: This will update static IP address

wmic nicconfig where index=9 call setgateways("192.168.16.4", "192.168.16.5"),(1,2)

Note: This will Change network gateway

wmic nicconfig where index=9 call enabledhcp

Note: This will enable DHCP.

wmic service where caption="DHCP Client" call changestartmode "Disabled"
wmic service where caption="DHCP Client" call changestartmode "Automatic"
wmic service where caption="DHCP Client" call changestartmode "Manual"

Note: This will enable DHCP make disable, automatic or manual the service.

wmic /node:machinename nicconfig where Index=1 call EnableDHCP

Note: Remotely change IP to use DHCP

wmic /node:machinename nicconfig where Index=1 call EnableStatic ("172.16.10.10"), ("255.255.0.0")

Note: Remotely change the IP to a static IP (Index is Interface#)

Handle Windows Process life-cycle

The above sets of commands lets you handle all type of process manipulation:

wmic process
wmic process list brief
wmic process list full
wmic process list system

Note: The above commands list processes in a windows machine.

wmic /record:processes.xml process list brief
wmic /record:processes.xml process list full
wmic /record:processes.xml process list system

Note: After the command runs, your results are stored in xml format. That's the only format supported, but this is a handy record of what you typed, when you typed it, and the results you got.

wmic process where name='process_name.exe'
wmic process where name='process_name.exe' list brief
wmic process where name='process_name.exe' list full
wmic process where name='process_name.exe' list system
wmic process where name='process_name.exe' delete

Note:The above let you commands search/kill and create processes based on their name.

wmic process | more

Note: Displays all processes per screen page

wmic process | findstr "process name"

Note: The above command searches a process name, or process information per line.

wmic /output:wmic.html process list full /format:hform

Note: List running processes and output to HTML/XSL form.

wmic /node:machinename process list brief /every:1

Note: Remotely list running processes every second

wmic process where name="cmd.exe" call getowner
wmic process where name="cmd.exe" call getownersid

Note: Get Process Owner or OwnerSID.You can use that to migrate using metasploit to some useful process.

ICMP and DNS network sweeping

After taking over a windows box you can use it as a pivot, but what happens if it is a restricted box and you cannot download or upload any tools? Well the following commands will do the job:

for /L %I in (1,1,254) DO @ping -n 1 192.168.1.%I | findstr "TTL=128" >> pinglog.txt

Note: This command sequence will ping sending only one package and report this machine that have a none zero TTL field. The output of the loop will be stored in a file named pinglog.txt.

for /L %I in (1,1,254) DO @nslookup 192.168.1.%I | find "Name:" >> dnslog.txt

Note: This command sequence will perform a reverse DNS lookup using the local DNS server (an external dns server can be sued also). The output will be stored in a log file called dnslog.txt

pathping targethost (for a single host only)
for /L %I in (1,1,254) DO @pingpath -n 192.168.1.%I >> traceping.txt

Note: This command combines functions of Ping and Tracert. Pathping will first list the number of hops required to reach the address you are testing and then send multiple pings to each router between you and the destination. After that, it computes results based on the packets returned from each router. Because pathping displays the degree of packet loss at any given router or link, you can determine which routers or subnets might be having network problems. Note that the whole process may consume 5-10 minutes because many pings are being sent. There are switches to modify the process and these can be seen by entering "pathping /?" in the command prompt.The command sequence above will map the whole network along with their routes (this is going to be verbose).

for /L %I in (1,1,254) DO @echo -Route: %I- >> trace.txt & @pathping -n 1 192.168.1.%I >> trace.txt

Note: This will do a simple trace routing of the whole local network.

Windows network connection monitoring

netstat -nab 3 >> netstat.txt

Note: This will perform an infinite loop with all listening ports and the executable engaged with a refresh rate of 3 seconds. More specifically:

Option: -n

Displays addresses and port numbers in numerical form

Option: -a

Displays all connections and listening ports

Option: -b

Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

Important Note: This tool is very good for identifying malware behavior that does not alter any system functions, because in case you try to disinfect a rootkit it will not be much of a help :).

Handling Windows Users

The following examples displays a list of all user accounts for the local computer (some commands do that along with other useful information):

net user
wmic useraccount
wmic useraccount list brief

The following example displays information about the user account someuser:

net user someuser

The following example adds a user account for a user whose full name is Jay Jamison and whose user account name is jayj, with logon rights from 8 A.M. to 5 P.M., Monday through Friday (no spaces in time designations), a mandatory password (Cyk4^g3B), and the user's full name:

net user jayj Cyk4^g3B /add /passwordreq:yes /times:monday-friday,8am-5pm /fullname:"Jay Jamison

or

Simple add user: net user someuser /add

net user miked /time:M-F,08:00-17:00

Note: Sets the logon time (8 A.M. to 5 P.M.) for miked by using 24-hour notation:

net user miked /time:M-F,8AM-5PM

Note: Sets the logon time (8 A.M. to 5 P.M.) for miked by using 12-hour notation:

net user anibals /time:M,4AM-5PM;T,1PM-3PM;W-F,8:00-17:00

Note: Specifies logon hours of 4 A.M. until 5 P.M. on Monday, 1 P.M. until 3 P.M. on Tuesday, and 8 A.M. until 5 P.M. Wednesday through Friday for anibals:

wmic /node:remotecomputer computersystem get username

Note: Determine user currently logged in remotely.

List Event Logs

wmic ntevent list brief --- Brief takes a while, full takes even longer
wmic nteventlog where (description like "%secevent%") call clearevent

List Services

wmic service list brief

Delete ARPCache

netsh int ip delete arpcache

Auditing the security policies

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista Displays information about and performs functions to manipulate audit policies.For examples of how this command can be used, see the Examples section in each topic.

Auditpol /get /user:{S-1-5-21-1443922412-3030960370-963420232-51} /category:"System","Detailed Tracking","Object Access"

Reboot or Shutdown a box

wmic os where buildnumber="2600" call reboot -- Get build# from OS Info (see below)
shutdown -r -f -t 2
shutdown -s -f -t 4

Reference:

Pages

Windows Hackers Command Reference