reg save HKLM\Security security.hive (Save security hive to a file)
reg save HKLM\System system.hive (Save system hive to a file)
reg save HKLM\SAM sam.hive (Save sam to a file)=
reg add [\\TargetIPaddr\] [RegDomain][ \Key ]
reg export [RegDomain]\[Key] [FileName]
reg import [FileName ]
reg query [\\TargetIPaaddr\] [RegDomain]\[ Key ] /v [Valuename!] (you can to add /s for recurse all values )
NET
net view /domain
net view /domain:otherdomain
net user %USERNAME% /domain
net accounts
* NETSH
>
```cmd
netsh wlan show profile
NETSTAT
netstat -antp | findstr :445
NBTSTAT
WMIC
wmic bios
wmic qfe qfe get hotfixid
(This gets patches IDs)
wmic startupwmic service
wmic process get caption,executablepath,commandline
wmic process call create “process_name” (executes a program)
wmic process where name=”process_name” call terminate (terminates program)
wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size,
volumeserialnumber (hard drive information)
wmic useraccount (usernames, sid, and various security related goodies)
wmic useraccount get /ALL
wmic share get /ALL (you can use ? for gets help ! )
wmic startup list full (this can be a huge list!!!)
wmic /node:"hostname" bios get serialnumber (this can be great for finding warranty info about target)
最近写了一些
Powershell
脚本,然后列出一些CMD
和PowerShell
作为比较。使用PowerShell
进行渗透的话,github
上有许多不错的资源。Windows Cmd