Windows CLI
Day 1
Importance of Command Line Tool Output Why is it so important to be comfortable using the command line tools and understanding and comprehending the output? Understanding the output of command line tools could make or break your operation. The GUI may not be available in all situations you encounter Often times a command line tool must be used 9.1 Identify the importance of the output of command line tools
CMD.exe Basic Native Commands set #view all env variables in command shell where #find executables within the PATH variable echo #repeat things dir #look at folder contents type #output contents of a file findstr /I /R word #windows grep hostname #system hostname date /t #output system date (/t keeps it from trying to set) time /t #output system time (/t keeps it from trying to set) This is a small subset of the available commands. These commands can be put together and saved into a Batch (.bat) file and run automatically. This allows for automation of tasks SKILL 1: Employ commands using command line interface 1.1 Use command line commands to gain situational awareness of the current workstation SKILL 4: Develop scripts 4.1 Discuss the purpose of creating a script
CMD.exe Native Command Redirection > and >> - redirect STDOUT. Create/overwrite and Create/append. Piping ( | ) - Sends output of one command to input of another. Conditional processing symbols & and ; - The second command executes regardless of the success/failure of the first command && - only execute the second command if the first command is successful || - only execute the second command if the first command fails Nesting #example: ((dir desktop && echo "success") || (echo "failure")) and ((dir desktopP && echo "success") || (echo "failure")) SKILL 1: Employ commands using command line interface 1.1 Use command line commands to gain situational awareness of the current workstation SKILL 4: Develop scripts 4.1 Discuss the purpose of creating a script
ACTIVITY Windows Batch Script (Using only CMD commands)
WMIC Command Basics wmic /? wmic process /? wmic process get /all /format:list wmic process list brief wmic service list brief wmic useraccount list brief wmic nicconfig list brief wmic nteventlog list brief SKILL 2: Employ commands using Windows Management Instrumentation Command line 2.1 Use WMIC commands to gain situational awareness of the current workstation
ACTIVITY: Windows Batch Script using only WMIC commands
Day 2
Intro to Powershell Powershell. Powershell ISE is available for use. Different versions of Powershell across windows versions. Powershell 1.0 - Nov 2006 (XP) Powershell 2.0 - Oct 2009 (7) Powershell 3.0 - Sep 2012 (8) Powershell 4.0 - Oct 2013 (8.1) Powershell 5.0 - April 2014 (10) Powershell uses commandlets (cmdlets). Unique to powershell. Follow a ‘verb-noun’ pattern Ex. get-process SKILL 3: Employ commands using PowerShell
Why use powershell? Much more functionality than cmd cmd.exe may be disabled, powershell may not Powershell is object oriented. Get-help You can search for help and commands using the above syntax. Get-help You can get help on specific commands using the above syntax. 3.1 Identify the purpose of using PowerShell in operations DEMO: open a powershell window, type ‘get-verb’ to help emphasize the verb-noun syntax 3.2 Demonstrate basic functionality of PowerShell
Running external commands (cmd.exe or sysinternals) will return a string. Running a Powershell command will return an object. DEMO: tasklist | get-member Returns ‘system.string’ DEMO: get-process | get-member Returns ‘powershell object’ An object is a data structure that contains properties and methods Properties = data Methods = functions or actions to take on properties. Tasklist | get-member VS get-process | get-member Compare the different control you have over the 2 commands Address properties or methods: object. --OR-- object.(args) 3.2 Demonstrate basic functionality of PowerShell
Main Components of Powershell Internal and external commands. (?) External = spawn new process attrib Internal = runs inside powershell process ping, dir Cmd.exe is ppid of all internal commands. (?) Objects: The output from a powershell command is an object. Classes: General term for grouped objects WMIC and CIM Common Information Model (CIM): meant to be cross platform Windows Management Instrumentation (WMI) is windows specific
3.3 Describe the main components of PowerShell Variables: $a=”Hello World” Command substitution: $(get-process).name Looping: $(get-process).name | foreach-object {echo “$_ is a running process”} $a=1..5; foreach ($i in $a) {echo “$i is a number”} $x=0; while ($x -lt 100) {echo “this is loop number $x”; $x++} Indexing: $(get-process)[4] --OR-- $(get-process)[0..4] **Indices always start at 0** 3.3 Describe the main components of PowerShell
Arithmetic: 1+1 == 2 1 + “dog” == “1dog” “cat” + “dog” == “catdog” (strings concatenate) $a=”1”; $a+1 == “11” Because $a is a string. Use a typecast to avoid this: [int]$a+1 == 2 While ($true) {$date = get-date -format hh:mm; if ($date -eq “05:00”){break}} Functions A list of commands that, when together, serve a purpose. Ex. Function dostuff {get-date; get-process; get-service} Once the function has been declared, you simply issue the name of the function as a command and it will execute the commands inside the function. 3.3 Describe the main components of PowerShell
Multithreading A technique that allows a single set of code to be used by several processors at different stages of execution. To multithread in Powershell, use jobs https://www.youtube.com/watch?v=4QnJPCqaOWQ https://www.youtube.com/watch?v=kj98OhCW-xs
DEMO: get-ciminstance -namespace root\securitycenter2 -classname antispywareproduct WMI is organized in namespaces, like folder that correlate to products/technology Get-wmiobject -class win32_BIOS When a cmdlet is run in PowerShell, the object is output in a default way. You can format the data that you recieve by piping the object through a format cmdlet (format-table, format-list, etc) 3.3 Describe the main components of PowerShell
DEMO: command and explain the parts of the command and the output to the students
Get-process | get-member Look at associated properties Get-process | select threads, processname, id Choose a few different properties to view Get-process | select threads, processname, id | where {$_.id -lt 1000} Get more granular and view specific process properties 3.3 Describe the main components of PowerShell
Powershell Enumeration Scripting Set-ExecutionPolicy Unrestricted -Scope CurrentUser This command is required before running any Powershell scripts **NOTE: Powershell supports tab completion for files, commands, and options.** Aliases are available to help all types of users (cmd.exe and bash users) Ex. Get-childitem: ls, dir, gci The ForEach (alias %) command has two distinct forms: ForEach ($f in Get-ChildItem) { Write-output “$($f.Length) $($f.FullName)” } Get-ChildItem | ForEach { Write-output “$($_.Length) $($_.FullName)” } 4.3 Create a Powershell script that will perform basic enumeration of a workstation
DEMO: Basic Poswershell (.ps1) script
The Where (alias ?) command can be used to filter (e.g. files over 1,000 bytes): Get-ChildItem | Where { $_.Length -gt 1000 } | Select Length, Name Output can be controlled with Format-Table or Format-List Get-ChildItem | Format-Table -AutoSize Get-ChildItem | Format-List | more Standard options are available Remove-Item does_not_exist.txt Remove-Item does_not_exist.txt -ErrorAction SilentlyContinue New-Item -Type File it_exists.txt Remove-Item it_exists.txt -Verbose 4.3 Create a Powershell script that will perform basic enumeration of a workstation
Functions in Powershell have unexpected quirks: function summer($a,$b) { $total = $a + $b echo "a=$a b=$b sum=$total" return $total } $sum = summer 9 10 Write-Output "Sum is $sum" summer 1 2 summer 5, 6 summer(7, 8) summer(7, 8) (9,10) 4.3 Create a Powershell script that will perform basic enumeration of a workstation EXERCISE: Through the Wire
EXERCISE THROUGH THE WIRE
Day 3 Review: Creation of batch script and powershell script. Use your own of the ones located at the following address: http://we_should_pre-write_the_scripts_and_host_on_git http://we_should_pre-Write_the_output_as_well_just_in_case
Demo a batch script that will perform a basic enumeration of a windows workstation. http://link_here_for_script Be aware that variables (i.e. %i) must be doubled in a batch file (%%i) 4.2 Create a batch script that will perform a basic enumeration of a workstation
ACTIVITY DLL Enumeration
SysInternals Tools /?: provides help menu for each tool PROCESSES psinfo: shows basic system info, remote capabilities. psinfo -h -s -d -nobanner pslist: shows processes in tree format. pslist -t procmon: used to view, monitor, filter on processes. (GUI) autoruns: checks autorun registry locations. handle: shows handles of all processes. handle -p (matches partial names) 1.2 Use System Internal tools to gain situational awareness of the current workstation
USERS logonsessions logonsessions -p psloggedon NETWORKING tcpview 1.2 Use System Internal tools to gain situational awareness of the current workstation
DISCUSSION: What is situational awareness? What is running on the system? Processes Services Scheduled tasks Registry keys Users on the system? Accounts Groups Domain Situational Awareness Discussion
Networking System networking settings Local subnet Active Network Connections Routing Firewall settings Logging and Auditing Windows event logs Windows auditing policies Situational Awareness Discussion
ACTIVITY Groups By User
ACTIVITY Rootkit Hunter