> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/local-enumeration/windows.md). # Windows


HELP	`help` `help <COMMAND>` `<COMMAND> ?` `<COMMAND> /?`
Hostname	`hostname`
Sistema Operativo, Versione, Architettura	`systeminfo` `[environment]::OSVersion.Version`
Username	`echo %USERNAME%` `whoami` `whoami /user` (also SID) `whoami /groups`
SID	`wmic useraccount get domain,name,sid` `wmic useraccount where name="<NAME>" get sid` `wmic group get name,sid`
Privileges	`whoami /priv` (also with System cmd) To enable privileges (DOWNLOAD) `.\EnableAllTokenPrivs.ps1`
Users	`net user` `net user <USER>` (user info, also groups he/she is in) `Get-LocalUser` Create new user `net user <USER> <PASSWORD> /add` `New-LocalUser -Name "<USER>" -Password (ConvertTo-SecureString "<PASSWORD>" -AsPlainText -Force)`
Groups	`net localgroup` `net localgroup <GROUP>` (info on who is part of it) `Get-LocalGroup` `Get-LocalGroupMember <GROUP>` `whoami /groups` Create new group `net localgroup <GROUP> /add` `New-LocalGroup -Name "<GROUP>"` Assigning a user to a group `net localgroup <GROUP> <USER> /add` `Add-LocalGroupMember -Group "Administrators" -Member "<USER>"`
Descriptions	`Get-LocalUser` (users) `Get-WmiObject -Class Win32_UserAccount` (domain users) `Get-WmiObject -Class Win32_OperatingSystem \| select Description` (machine)
Account policy	`net accounts`
Other connected users	`query user` `qwinsta`
File/Directory permissions	`icacls` `icacls <PATH> /grant <USER>:f` `icacls <PATH> /remove <USER>:f` (DOC: f= FullAccess, W=Write, R=Read)
Execution Policy	`Get-ExecutionPolicy -List` Change the execution policy for the current process (session) `Set-ExecutionPolicy Bypass -Scope Process` (No blocks) `powershell -ep bypass`
Defenses enabled	`sc query windefend` (Windows Defender da cmd) `netsh advfirewall show allprofiles` `Get-MpComputerStatus \| findstr "True"` `Get-AppLockerPolicy -Effective \| select -ExpandProperty RuleCollections` (AppLocker blocks, path bypassing?)
Hotfix	`systeminfo` `wmic qfe` `wmic qfe list brief` `Get-HotFix \| ft -AutoSize`
LAPS	`Find-LAPSDelegatedGroups` `Find-AdmPwdExtendedRights` `Get-LAPSComputers`
Network information	`ipconfig /all` `route print` `arp -a` `netstat -ano` (Active Network Connections, for service name see PID and then `tasklist /SVC \| findstr <PID>`)
Pipe	`pipelist.exe` `/accepteula` `gci \\.\pipe\` `accesschk.exe` `/accepteula <PIPE> [/v]` (enumerate permissions assigned to a pipe) `<PIPE>` = `\pipe\` to see all, otherwise `<PATH>`, ex. `\\.\Pipe\lsass`)
Installed applications	`wmic product get name` `Get-WmiObject -Class Win32_Product \| select Name, Version` 32bit `reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s \| findstr /i "DisplayName"` `Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\" \| select DisplayName, DisplayVersion, InstallLocation` 64bit* `reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s \| findstr /i "DisplayName"` `Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" \| select DisplayName, DisplayVersion, InstallLocation` `$COMMAND_ABOVE \| ?{ $_.DisplayName -ne $null } \| sort-object -Property DisplayName -Unique \| Format-Table -AutoSize` Look in `C:\Program Files`
Service list	`Get-CimInstance -ClassName win32_service \| Select Name,State,PathName,StartMode \| ? {$_.State -like 'Running'}` `wmic service get name,pathname,state,startmode,<OTHER_FIELDS> \| findstr /i /v "<STRING>"` (/i caseInsensitive, /v NOT) `Get-Service \| ? {$_.Status -eq "Running"} \| select -First 2 \|fl` GUI: `Services`
Running processes	`tasklist` `tasklist /SVC` `Get-Process` `Get-Process \| select ProcessName, Path`
Task Manager	`taskmgr` GUI: `Task Manager` GUI: `Process Explorer` (to download, also shows DLLs used for each process)
Scheduled tasks	`schtasks /query /fo LIST /v` `Get-ScheduledTask`
Environment variables	`set` `Get-ChildItem Env: \| ft key,value`
Variable PATH	`$env:path`
Alias	`get-alias` `New-Alias -Name "<NAME>" <COMMAND>`
View Share/Drive	`net share` `net view \\<COMPUTER> /all` `net use` `net use X: \\<COMPUTER>\<SHARE>`
Logs	GUI: `Event Viewer`
Various info	GUI: `Computer Management` GUI: `Local Security Policy` GUI: `Local Group Policy Editor`

## Warnings * To access a user with **RDP**, they must be part of the `Remote Desktop Users group`. * To access a user with **WinRM**, they must be part of the `Remote Management Users group`. * Startup scripts in: * For all users (requires administrator privileges): * `%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\` * `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\` * For single user: * `%APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\` * `C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`