Benutzer-Werkzeuge
Dies ist eine alte Version des Dokuments!
Inhaltsverzeichnis
Windows ist ein von Microsoft entwickeltes Betriebssystem speziell für Desktop PC, Notebook und Laptop.
# Per MSI installierte Pakete Get-WMIObject -Class Win32_Product # Per Winget installierte Pakete? Get-WingetPackage # 32 bit uninstallers Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | select DisplayName,UninstallString # 64 bit uninstallers Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | select DisplayName,UninstallString
// boot to bios
shutdown /r /fw /t 1
winget
net group // show domain groups on DC
net localgroup // show local groups
net localgroup <group> // list group members
net user <user> // see user info
whoami
whoami /groups
whoami /priv
net user <username> <password> // set new password
net user <username> * // set password interactive
dsquery user -limit 1000
dsquery user -upn max.mustermann@domain.local
dsget user "CN=Max Mustermann,DC=dómain,DC=local"
dsquery user -upn manuel.zarat@akm.at | dsget user -memberof
// sessions anzeigen
query session [/SERVER]
qwinsta [/SERVER]
// session beenden
reset session [/SERVER] <session-id>
rwinsta [/SERVER] <session-id>
shutdown -s -t 3600 // sleep timer
shutdown -a // cancel timer
dir /s /b c:\* | findstr /i "test" // find files and folders containing "test"
ps> iwr -Uri http://google.com -UseBasicParsing
// installed patches
wmic qfe get Caption,Description,HotFixID,InstalledOn
// get running services
cmd> net start
ps> Get-CimInstance -ClassName win32_service | Select Name,State,PathName,StartName,StartMode | Where-Object {$_.State -like 'Running'}
ps> Get-CimInstance -ClassName Win32_Service -Filter "Name='mysql'" | Select-Object StartMode
ps> Restart-Computer -WhatIf // dry run
Tastenkombinationen
- Windows-E Explorer öffnen
- Strg-Windows-1 Programm aus Taskleiste öffnen (Nummer der Reihenfolge)
- Strg-Windows-D Neuer virt. Desktop
- Windows-Pfeiltaste Bildschirm teilen
- Strg-Windows-Pfeiltaste Zwischen virt. Desktops wechseln
- Windows-M Alle Fenster minimieren
- Windows-Shift-S Screenshot Ausschnitt
- Windows-G Bildschirmaufnahme
- Windows-. Emojis, GIFs etv.
Zwischenablage
Wenn man etwas mit Ctrl-C in die Zwischenablage kopiert kann man es mit Ctrl-V einfügen. Oder mit Windows+V den Verlauf anzeigen.
Power Managment
powercfg
Invoker
Wenn ein Programm Admin Rechte zur Installation erfordert.
set __COMPAT_LAYER=RunAsInvoker start steamsetup.exe
ContextMenu
add a contextmenu to open current folder in cmd
regedit Computer\HKEY_CLASSES_ROOT\Directory\Background\shell addKey <menutitle> addKey <menutitle> "command" addKey <menutitle> <command> value "cmd.exe ."
add a contextmenu to open files with a specific program
regedit Computer\HKEY_CLASSES_ROOT\SOFTWARE\Classes\*\shell addKey <menutitle> addKey <menutitle> "command" addKey <menutitle> <command> value "program.exe %1"
Commands
winget [install|uninstall] --id <package-name> set [var=var] findstr [/s] [/r] "Manuel" *.txt findStr /irc:"Hello" /irc:"World" // find both words more attrib cacls <path\\to\\file> /e /p <user>:<[R]ead|[W]rite|[F]ull> [deprecated] -> Use Icacls subst <mountpoint>: <file> //mount subst /d <mountpint> //delete fc <file1> <file2>: file compare tasklist taskkill [/IM <name>|/PID <pid>] [/f] query [process|user|session] // (Server only) logoff <session> net user net share [<sharename>=<path>] [/delete] net use x: \\<server>\<path> net localgroup <group> /<add|remove> <user> openfiles [/local on] robocopy c:\documents d:\backup\documents /copyall /e /r:0 /dcopy:t /mir: sync dirs dir file.xxx > output.msg [2>output.err|2>&1] mode con:cols=140 lines=70 nslookup -type=mx zarat.ml certutil -hashfile file.txt <algo> where // wie which (Get-Command <command>).Path // wie which in powershell doskey ls=dir // alias wmic qfe [get|list] // show updates and patches wusa /uninstall /kb:<kbID> // uninstall update wmic product get name // list installed programs wmic product where name="<ProgramName> call uninstall // uninstall program
for /f "tokens=1-2 delims= " %a in (test.txt) DO @echo %a %b : wie cut
cat "file.txt" | %{$_ -replace "original", "replacement"} > newfile.txt : wie sed
// cmd piping
dir 2> err.txt
dir > out.txt 2> err.txt
dir 1> out.txt 2>&1 // redirect stderr to stdout
Windows Context Menu Explorer https://stackoverflow.com/questions/20449316/how-add-context-menu-item-to-windows-explorer-for-folders CMD A-Z
Piping
Std Handles
- STDIN = 0 Keyboard input
- STDOUT = 1 Text output
- STDERR = 2 Error text output
command 2> filename Redirect any error message into a file command 2>> filename Append any error message into a file (command)2> filename Redirect any CMD.exe error into a file command > file 2>&1 Redirect errors and output to one file command > fileA 2> fileB Redirect output and errors to separate files command 2>&1 >filename This will fail!
Firewall
Siehe netsh.
Password reset with installer disk
restart pc with installer inserted (usb,image,..). once the setup begins, hit Shift+F10 to bring up a shell.
move c:\windows\system32\utilman.exe c:\windows\system32\utilman.exe.bak copy c:\windows\system32\cmd.exe c:\windows\system32\utilman.exe
reboot. back at the login screen click the utilitymanager which spawns a shell now add a new user and add to local admin group.
net user <username> /add net localgroup administrators <username> /add
After a reboot you can log in using th new user.
Domain join
In den Adapteroptionen des Interfaces den DNS Server auf die IP des DC ändern.
In den Systeminformationen → Einstellungen ändern → Domain beitreten
Driver
Downloads
NTFS
Siehe Dateisystem bzw. NTFS
SAM Database
Die SAM Datenbank findet man unter
C:\Windows\System32\config\SAM
Wenn sie von einem anderen Prozess verwendet wird, Daten extrahieren.
reg save hklm/sam C:\tmp\sam.save reg save hklm/security C:\tmp\security.save reg save hklm/system C:\tmp\system.save
Mit samdump2 kann man die Hashes extrahieren.
samdump2 system.save sam.save
Oder auch mit creddump7
cd /usr/share/creddump7 python pwdump.py system.save sam.save
Siehe auch Mimikatz
Links
Seiten-Werkzeuge
