Windows
Table of Contents
Disclaimer: These are my personal notes, published "as-is"
without warranty or guarantee of any kind. Use at your own risk. Licensed
CC BY-NC-SA 4.0.
Commands #
General #
Get Windows version:
Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumber
Walk through all files in the C drive, one screen at a time:
tree c:\ /f | more
List all subdirectories contents within another subdir:
Get-ChildItem -Path C:\Users\Administrator\Downloads -Recurse
List permissions of a specific directory. See the icacls reference for output including other options like grant:
icacls c:\windows
List running services:
Get-Service | ? {$_.Status -eq "Running"}
Get-Service | ? {$_.Status -eq "Running"} | fl # shows extra info
Manage a service named wuauserv. sdshow output is in SDDL:
sc qc wuauserv # query
sc stop wuauserv # stop (needs elevated privs)
sc sdshow wuauserv # view service perms
Show service permissions:
Get-ACL -Path HKLM:\System\CurrentControlSet\Services\wuauserv | Format-List
Enable WSL:
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
Query registry key:
reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
AD get user attributes/privs (ref):
Get-ADUser -Identity htb-student # specific user
whoami /priv # current user
AD list domain admins:
Get-ADGroup -Identity "Domain Admins" -Properties * | select DistinguishedName,GroupCategory,GroupScope,Name,Members
NTLM Hash Cracking #
Use [[Responder]] to get the NTLM hash then crack it with John.
echo "Administrator::RESPONDER:81c52155620d80d0:47825D3134646498212FAB22A2AD671A:0101000000000000804556E0679ED8014716E858CCE2CFFA00000000020008003800510058004E0001001E00570049004E002D0043005A0030004A00360039004D004F004B0046004D0004003400570049004E002D0043005A0030004A00360039004D004F004B0046004D002E003800510058004E002E004C004F00430041004C00030014003800510058004E002E004C004F00430041004C00050014003800510058004E002E004C004F00430041004C0007000800804556E0679ED801060004000200000008003000300000000000000001000000002000006324F7C1510A87EC0E2018FD19F16F33670CCF4EAA7FE82ECAF9D8C3B518653C0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00330036000000000000000000" > hash.txt
john -w=/usr/share/wordlists/rockyou.txt hash.txt
Notes #
General links #
- RDP from Linux using
rdesktop
- Critical Windows services
- General Windows components
- SysInternals can be accessed from Explorer or Command prompt.
Authentication #
- Part of workgroup = auth via local Windows database.
- Part of a domain = auth via Active Directory.
LFI #
- LFI Payloads e.g.
../../../../../../../../windows/system32/drivers/etc/hosts
WinRM Session #
evil-winrm -i $IP -u administrator -p password