Skip to main content

windows command

query status of a service
windows> sc query <service_name> state query qc

change startup type to demand (a manually started service). this will change the service startup to manual which can be started later
windows> sc config tlntsvr start= demand

turn service on
windows> sc start tlntsvr

to add a user
windows> net user [username] [passwd] /add

add a local grp to host
windows> net localgroup [grp name] /add

add a user to the local grp
windows> net localgroup [grp name] [username] /add


change the value to 0 to allow RDP connection from blocked (1) to allowed (0). on most windows rdp service is started but system is configured to deny terminal service connection from rdp client. this setting is controlled by a regstry key called fdenyconnections. add will overwrite exisitng settings. /v value that needs to be changed.
windows> reg add "hklm\system\currentcontolset\control\terminal\server"/v fdenytsconnections /t reg_dword /d 0

see all the valriable
windows> set

see specific variable
windows> set [variable_name]

see who is logged in/username
windows> set username

see where the shell searches for cmd to run
windows> set path

see where the o/s is installed and running from
windows> set systemroot or cd %systemroot%

list local grp
windows> net user

list local grp
windows> net localgroup

list memeber of local admin grp
windows> net localgroup administrator

show current fw config
windows> netsh firewall show config  OR
windows> netsh advfirewall firewall

disable the fw completely
windows> netsh firewall set opmode disable/enable

allows to pull the service name using wmic
windows> wmic service where (displayname like "%[whatever]%") get name

Comments

Post a Comment

Popular posts from this blog

VM 9 : PHP Include And Post Exploitation

Walkthrough 1.        https://medium.com/@Kan1shka9/pentesterlab-php-include-and-post-exploitation-walkthrough-8a85bcfa7b1d 2.        Ine [] 3.        http://megwhite.com.au/pentester-lab-bootcamp-walkthrough-php-include-post-exploitation/ 4.        http://fallensnow-jack.blogspot.com/2014/07/pentester-lab-php-lfi-post-exploitation.html Notes: root@kali:~# nmap 10.0.0.12 Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-30 12:23 EDT Nmap scan report for 10.0.0.12 Host is up (0.00035s latency). Not shown: 999 filtered ports PORT    STATE SERVICE 80/tcp open   http MAC Address: 08:00:27:1F:12:24 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.31 seconds root@kali:~# Enumerating port 80 Run dirb root@kali:~# dirb http://10.0.0.12/ ----------------- DIRB v2.22 By The Dark Raver...
1 comment
Read more

VM 15: Kioptix 2014

Walkthru Notes 2nd approach  using nc via web using php reverse shell 3rd approach   w/o metasploit =================== walkthru: 1.  Updating OpenFuck Exploit(764) but it didnt work here @ https://paulsec.github.io/blog/2014/04/14/updating-openfuck-exploit/ 2. ============== Notes: 80/tcp open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) MAC Address: 08:00:27:82:89:F9 (Oracle VirtualBox virtual NIC) Running: FreeBSD 9.X|10.X OS CPE: cpe:/o:freebsd:freebsd:9 cpe:/o:freebsd:freebsd:10 OS details: FreeBSD 9.0-RELEASE - 10.3-RELEASE PORT     STATE SERVICE VERSION 8080/tcp open  http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) |_http-server-header: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 |_http-title: 403 Forbidden MAC Address: 08:00:27:82:89:F9 (Oracle VirtualBox...
Post a Comment
Read more

Penetration Testing Framework 0.57

Network Footprinting (Reconnaissance) The tester would attempt to gather as much information as possible about the selected network. Reconnaissance can take two forms i.e. active and passive. A passive attack is always the best starting point as this would normally defeat intrusion detection systems and other forms of protection etc. afforded to the network. This would usually involve trying to discover publicly available information by utilising a web browser and visiting newsgroups etc. An active form would be more intrusive and may show up in audit logs and may take the form of an attempted DNS zone transfer or a social engineering type of attack. http://www.vulnerabilityassessment.co.uk/
Post a Comment
Read more