Difference between revisions of "Windows Commands"
Jump to navigation
Jump to search
| Line 42: | Line 42: | ||
<pre>sid2user \\<target> 5 <target_sid> <N></pre> | <pre>sid2user \\<target> 5 <target_sid> <N></pre> | ||
<pre>for /L %i in (1000, 1, 1050) do @sid2user \\<target> 5 <target_sid> %i</pre> | <pre>for /L %i in (1000, 1, 1050) do @sid2user \\<target> 5 <target_sid> %i</pre> | ||
==Exploitation== | |||
===Finding client-side programs=== | |||
<pre>dir /s "c:\Program Files"</pre> | |||
<pre>dir /s /b "c:\Program Files\*.exe"</pre> | |||
===Service interaction=== | |||
sc query & | |||
Starting telnet | |||
<pre>sc query tlntsvr | |||
sc config tlntsvr start= auto | |||
sc start tlntsvr</pre> | |||
Starting terminal services | |||
<pre>sc query termservice | |||
sc config termservice start= auto | |||
sc start termservice | |||
===Users and groups=== | |||
Adding a user to the telnet users group | |||
<pre>net user <username> <password> /add | |||
net localgroup TelnetClients /add | |||
net localgroup TelnetClients <username> /add | |||
===Firewall interaction=== | |||
Opening the firewall for telnet | |||
<pre>netsh firewall add portopening protocol = TCP port = 23 name = telnet mode = enable scope = custom addresses = <address></pre> | |||
===Registry interaction=== | |||
Enabling terminal services | |||
<pre>reg add "hklm\system\currentcontrolset\control\terminal server" /v fdenytsconnections /t reg_dword /d 0</pre> | |||
Revision as of 16:23, 16 July 2008
Recon
nslookup
- Types of record: NS, A, HINFO, MX, TXT, CNAME, SOA, RP, PTR, SRV
nslookup <site>
- Interactive mode:
nslookup > [name or ip] > server [server ip] > set type=any > ls -d [target_domain] [> filename] > view [filename]
- No recurse:
> set norecurse > set recurse
Scanning
tracert
Parameters
- -d -- don't resolve names
- -h <N> -- max number of hops (default 30)
- -j <hostlist> -- use loose source routing
- -w <N> -- wait for Nms before timing out (default 4000)
Null session
- Establishing a null session
net use \\<target> "" /u:""
- Pulling credentials
enum -U <target> enum -G <target>
- user2sid
- Outputs in the form S-X-Y-target_sid-RID
user2sid \\<target> <machine_name>
- sid2user
- Requires spaces instead of dashes
sid2user \\<target> 5 <target_sid> <N>
for /L %i in (1000, 1, 1050) do @sid2user \\<target> 5 <target_sid> %i
Exploitation
Finding client-side programs
dir /s "c:\Program Files"
dir /s /b "c:\Program Files\*.exe"
Service interaction
sc query &
Starting telnet
sc query tlntsvr sc config tlntsvr start= auto sc start tlntsvr
Starting terminal services
sc query termservice sc config termservice start= auto sc start termservice ===Users and groups=== Adding a user to the telnet users group <pre>net user <username> <password> /add net localgroup TelnetClients /add net localgroup TelnetClients <username> /add ===Firewall interaction=== Opening the firewall for telnet <pre>netsh firewall add portopening protocol = TCP port = 23 name = telnet mode = enable scope = custom addresses = <address>
Registry interaction
Enabling terminal services
reg add "hklm\system\currentcontrolset\control\terminal server" /v fdenytsconnections /t reg_dword /d 0