# Windows

<table data-header-hidden><thead><tr><th width="212"></th><th></th></tr></thead><tbody><tr><td>HELP</td><td><code>help</code><br><code>help &#x3C;COMMAND></code><br><code>&#x3C;COMMAND> ?</code><br><code>&#x3C;COMMAND> /?</code></td></tr><tr><td>Hostname</td><td><code>hostname</code></td></tr><tr><td>Sistema Operativo, Versione, Architettura</td><td><code>systeminfo</code> <br><code>[environment]::OSVersion.Version</code></td></tr><tr><td>Username</td><td><code>echo %USERNAME%</code><br><code>whoami</code> <br><code>whoami /user</code>   <em>(also SID)</em> <br><code>whoami /groups</code></td></tr><tr><td>SID</td><td><p><code>wmic useraccount get domain,name,sid</code></p><p><code>wmic useraccount where name="&#x3C;NAME>" get sid</code><br><code>wmic group get name,sid</code></p></td></tr><tr><td>Privileges</td><td><code>whoami /priv</code>   <em>(also with System cmd)</em><br>To enable privileges (<a href="https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1">DOWNLOAD</a>)<br><code>.\EnableAllTokenPrivs.ps1</code></td></tr><tr><td>Users</td><td><code>net user</code><br><code>net user &#x3C;USER></code>   <em>(user info, also groups he/she is in)</em><br><code>Get-LocalUser</code> <br><em>Create new user</em><br><code>net user &#x3C;USER> &#x3C;PASSWORD> /add</code> <br><code>New-LocalUser -Name "&#x3C;USER>" -Password (ConvertTo-SecureString "&#x3C;PASSWORD>" -AsPlainText -Force)</code></td></tr><tr><td>Groups</td><td><code>net localgroup</code> <br><code>net localgroup &#x3C;GROUP></code>   <em>(info on who is part of it)</em><br><code>Get-LocalGroup</code><br><code>Get-LocalGroupMember &#x3C;GROUP></code> <br><code>whoami /groups</code> <br><em>Create new group</em><br><code>net localgroup &#x3C;GROUP> /add</code> <br><code>New-LocalGroup -Name "&#x3C;GROUP>"</code> <br><em>Assigning a user to a group</em><br><code>net localgroup &#x3C;GROUP> &#x3C;USER> /add</code><br><code>Add-LocalGroupMember -Group "Administrators" -Member "&#x3C;USER>"</code></td></tr><tr><td>Descriptions</td><td><code>Get-LocalUser</code>   <em>(users)</em><br><code>Get-WmiObject -Class Win32_UserAccount</code>  <em>(domain users)</em><br><code>Get-WmiObject -Class Win32_OperatingSystem | select Description</code>   <em>(machine)</em></td></tr><tr><td>Other connected users</td><td><code>query user</code> <br><code>qwinsta</code></td></tr><tr><td>File/Directory permissions</td><td><code>icacls</code><br><code>icacls &#x3C;PATH> /grant &#x3C;USER>:f</code> <br><code>icacls &#x3C;PATH> /remove &#x3C;USER>:f</code><br><em>(</em><a href="https://ss64.com/nt/icacls.html"><em>DOC</em></a><em>: f= FullAccess, W=Write, R=Read)</em></td></tr><tr><td>Execution Policy</td><td><code>Get-ExecutionPolicy -List</code><br>Change the execution policy for the current process (session) <br><code>Set-ExecutionPolicy Bypass -Scope Process</code> <em>(No blocks)</em></td></tr><tr><td>Defenses enabled</td><td><code>sc query windefend</code> <em>(Windows Defender da cmd)</em><br><code>netsh advfirewall show allprofiles</code><br><code>Get-MpComputerStatus | findstr "True"</code><br><code>Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections</code> <em>(AppLocker blocks, path bypassing?)</em></td></tr><tr><td><a href="https://www.catalog.update.microsoft.com/Search.aspx?q=hotfix">Hotfix</a></td><td><code>systeminfo</code><br><code>wmic qfe</code> <br><code>wmic qfe list brief</code><br><code>Get-HotFix | ft -AutoSize</code></td></tr><tr><td>LAPS</td><td><code>Find-LAPSDelegatedGroups</code><br><code>Find-AdmPwdExtendedRights</code><br><code>Get-LAPSComputers</code></td></tr><tr><td>Network information</td><td><code>ipconfig /all</code> <br><code>route print</code><br><code>arp -a</code><br><code>netstat -ano</code> <em>(Active Network Connections, for service name see PID and then</em> <code>tasklist /SVC | findstr &#x3C;PID></code><em>)</em></td></tr><tr><td>Pipe</td><td><a href="https://learn.microsoft.com/en-us/sysinternals/downloads/pipelist"><code>pipelist.exe</code></a> <code>/accepteula</code><br><code>gci \\.\pipe\</code> <br><a href="https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk"><code>accesschk.exe</code></a> <code>/accepteula &#x3C;PIPE> [/v]</code> <em>(enumerate permissions assigned to a pipe)</em><br><code>&#x3C;PIPE></code> = <code>\pipe\</code> to see all, otherwise <code>&#x3C;PATH></code>, ex. <code>\\.\Pipe\lsass</code>)</td></tr><tr><td>Installed applications</td><td><p><code>wmic product get name</code><br><code>Get-WmiObject -Class Win32_Product | select Name, Version</code><br><br><code>str32BIT = HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall</code><br><code>str64BIT = HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</code> <br><code>reg query "&#x3C;str32BIT>" /s /f "DisplayName" | findstr /i "DisplayName”</code><br><code>reg query "&#x3C;str64BIT>" /s /f "DisplayName" | findstr /i "DisplayName”</code><br><code>Get-ItemProperty "&#x3C;str32BIT>\*" | select displayname</code><br><code>Get-ItemProperty "&#x3C;str64BIT>\*" | select displayname</code> <br> <br><code>$INSTALLED = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |  Select-Object DisplayName, DisplayVersion, InstallLocation</code> <br><code>$INSTALLED += Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, InstallLocation</code></p><p><code>$INSTALLED | ?{ $_.DisplayName -ne $null } | sort-object -Property DisplayName -Unique | Format-Table -AutoSize</code></p><p></p><p>Or look in <code>C:\Program Files</code></p></td></tr><tr><td>Service list</td><td><code>wmic service get name,pathname,state,startmode,&#x3C;OTHER_FIELDS> | findstr /i /v "&#x3C;STRING>"</code> <em>(/i caseInsensitive, /v NOT)</em><br><code>Get-CimInstance -ClassName win32_service | Select &#x3C;FIELDS> | ? {$_.&#x3C;FIELDS> -like '&#x3C;STRINGS>'}</code><br><code>Get-Service | ? {$_.Status -eq "Running"} | select -First 2 |fl</code> <br><strong>GUI</strong>: <code>Services</code></td></tr><tr><td>Running processes</td><td><code>tasklist</code><br><code>tasklist /SVC</code><br><code>Get-Process</code></td></tr><tr><td>Task Manager</td><td><code>taskmgr</code> <br><strong>GUI</strong>: <code>Task Manager</code><br><strong>GUI</strong>: <a href="https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer"><code>Process Explorer</code></a> <em>(to download, also shows DLLs used for each process)</em></td></tr><tr><td>Scheduled tasks</td><td><code>schtasks /query /fo LIST /v</code><br><code>Get-ScheduledTask</code></td></tr><tr><td>Environment variables</td><td><code>set</code> <br><code>Get-ChildItem Env: | ft key,value</code></td></tr><tr><td>Variable PATH</td><td><code>$env:path</code></td></tr><tr><td>Alias</td><td><code>get-alias</code> <br><code>New-Alias -Name "&#x3C;NAME>" &#x3C;COMMAND></code></td></tr><tr><td>View Share/Drive</td><td><code>net share</code> <br><code>net use</code><br><code>net use x: \&#x3C;COMPUTER>\&#x3C;SHARE></code></td></tr><tr><td>Logs</td><td><strong>GUI</strong>: <code>Event Viewer</code></td></tr><tr><td>Various info</td><td><strong>GUI</strong>: <code>Computer Management</code><br><strong>GUI</strong>: <code>Local Security Policy</code><br><strong>GUI</strong>: <code>Local Group Policy Editor</code></td></tr></tbody></table>

## Warnings

* To access a user with **RDP**, they must be part of the `Remote Desktop Users group`.
* To access a user with **WinRM**, they must be part of the `Remote Management Users group`.
* Use the **runas** command to execute commands on behalf of another user on the same host. \
  `runas /user:<USER> <COMMAND, ex. cmd>` \
  `Start-Process cmd.exe -Verb runAs`
  * You can also use [RunasCs.ps1](https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1)\
    `Import-Module .\Invoke-RunasCs.ps1`\
    `Invoke-RunasCs <USER> <PASS> "cmd /c whoami /all"`&#x20;
* Startup scripts in:&#x20;
  * &#x20;For all users (requires administrator privileges):
    * `%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\`
    * `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\`&#x20;
  * For single user:
    * `%APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\`
    * `C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`
