Importance of Command Line Tool Output
Why is it so important to be comfortable using the command line tools and understanding and comprehending the output?
Understanding the output of command line tools could make or break your operation.
The GUI may not be available in all situations you encounter
Often times a command line tool must be used
9.1 Identify the importance of the output of command line tools
CMD.exe Basic Native Commands
set #view all env variables in command shell
where #find executables within the PATH variable
echo #repeat things
dir #look at folder contents
type #output contents of a file
findstr /I /R word #windows grep
hostname #system hostname
date /t #output system date (/t keeps it from trying to set)
time /t #output system time (/t keeps it from trying to set)
This is a small subset of the available commands. These commands can be put together and saved into a Batch (.bat) file and run automatically.
This allows for automation of tasks
SKILL 1: Employ commands using command line interface
1.1 Use command line commands to gain situational awareness of the current workstation
SKILL 4: Develop scripts
4.1 Discuss the purpose of creating a script
CMD.exe Native Command Redirection
> and >> - redirect STDOUT. Create/overwrite and Create/append.
Piping ( | ) - Sends output of one command to input of another.
Conditional processing symbols
& and ; - The second command executes regardless of the success/failure of the first command
&& - only execute the second command if the first command is successful
|| - only execute the second command if the first command fails
Nesting
#example: ((dir desktop && echo "success") || (echo "failure")) and ((dir desktopP && echo "success") || (echo "failure"))
SKILL 1: Employ commands using command line interface
1.1 Use command line commands to gain situational awareness of the current workstation
SKILL 4: Develop scripts
4.1 Discuss the purpose of creating a script
ACTIVITY
Windows Batch Script
(Using only CMD commands)
WMIC Command Basics
wmic /?
wmic process /?
wmic process get /all /format:list
wmic process list brief
wmic service list brief
wmic useraccount list brief
wmic nicconfig list brief
wmic nteventlog list brief
SKILL 2: Employ commands using Windows Management Instrumentation Command line
2.1 Use WMIC commands to gain situational awareness of the current workstation
ACTIVITY: Windows Batch Script using only WMIC commands
Intro to Powershell
Powershell. Powershell ISE is available for use.
Different versions of Powershell across windows versions.
Powershell 1.0 - Nov 2006 (XP)
Powershell 2.0 - Oct 2009 (7)
Powershell 3.0 - Sep 2012 (8)
Powershell 4.0 - Oct 2013 (8.1)
Powershell 5.0 - April 2014 (10)
Powershell uses commandlets (cmdlets).
Unique to powershell.
Follow a ‘verb-noun’ pattern
Ex. get-process
SKILL 3: Employ commands using PowerShell
Why use powershell?
Much more functionality than cmd
cmd.exe may be disabled, powershell may not
Powershell is object oriented.
Get-help
You can search for help and commands using the above syntax.
Get-help
You can get help on specific commands using the above syntax.
3.1 Identify the purpose of using PowerShell in operations
DEMO: open a powershell window, type ‘get-verb’ to help emphasize the verb-noun syntax
3.2 Demonstrate basic functionality of PowerShell
Running external commands (cmd.exe or sysinternals) will return a string.
Running a Powershell command will return an object.
DEMO: tasklist | get-member
Returns ‘system.string’
DEMO: get-process | get-member
Returns ‘powershell object’
An object is a data structure that contains properties and methods
Properties = data
Methods = functions or actions to take on properties.
Tasklist | get-member VS get-process | get-member
Compare the different control you have over the 2 commands
Address properties or methods:
object. --OR-- object.(args)
3.2 Demonstrate basic functionality of PowerShell
Main Components of Powershell
Internal and external commands. (?)
External = spawn new process
attrib
Internal = runs inside powershell process
ping, dir
Cmd.exe is ppid of all internal commands. (?)
Objects:
The output from a powershell command is an object.
Classes:
General term for grouped objects
WMIC and CIM
Common Information Model (CIM): meant to be cross platform
Windows Management Instrumentation (WMI) is windows specific
3.3 Describe the main components of PowerShell
Variables:
$a=”Hello World”
Command substitution:
$(get-process).name
Looping:
$(get-process).name | foreach-object {echo “$_ is a running process”}
$a=1..5; foreach ($i in $a) {echo “$i is a number”}
$x=0; while ($x -lt 100) {echo “this is loop number $x”; $x++}
Indexing:
$(get-process)[4] --OR-- $(get-process)[0..4]
**Indices always start at 0**
3.3 Describe the main components of PowerShell
Arithmetic:
1+1 == 2
1 + “dog” == “1dog”
“cat” + “dog” == “catdog” (strings concatenate)
$a=”1”; $a+1 == “11”
Because $a is a string. Use a typecast to avoid this: [int]$a+1 == 2
While ($true) {$date = get-date -format hh:mm; if ($date -eq “05:00”){break}}
Functions
A list of commands that, when together, serve a purpose.
Ex. Function dostuff {get-date; get-process; get-service}
Once the function has been declared, you simply issue the name of the function as a command and it will execute the commands inside the function.
3.3 Describe the main components of PowerShell
Multithreading
A technique that allows a single set of code to be used by several processors at different stages of execution.
To multithread in Powershell, use jobs
https://www.youtube.com/watch?v=4QnJPCqaOWQ
https://www.youtube.com/watch?v=kj98OhCW-xs
DEMO:
get-ciminstance -namespace root\securitycenter2 -classname antispywareproduct
WMI is organized in namespaces, like folder that correlate to products/technology
Get-wmiobject -class win32_BIOS
When a cmdlet is run in PowerShell, the object is output in a default way.
You can format the data that you recieve by piping the object through a format cmdlet (format-table, format-list, etc)
3.3 Describe the main components of PowerShell
DEMO: command and explain the parts of the command and the output to the students
Get-process | get-member
Look at associated properties
Get-process | select threads, processname, id
Choose a few different properties to view
Get-process | select threads, processname, id | where {$_.id -lt 1000}
Get more granular and view specific process properties
3.3 Describe the main components of PowerShell
Powershell Enumeration Scripting
Set-ExecutionPolicy Unrestricted -Scope CurrentUser
This command is required before running any Powershell scripts
**NOTE: Powershell supports tab completion for files, commands, and options.**
Aliases are available to help all types of users (cmd.exe and bash users)
Ex. Get-childitem: ls, dir, gci
The ForEach (alias %) command has two distinct forms:
ForEach ($f in Get-ChildItem) {
Write-output “$($f.Length) $($f.FullName)” }
Get-ChildItem | ForEach {
Write-output “$($_.Length) $($_.FullName)” }
4.3 Create a Powershell script that will perform basic enumeration of a workstation
DEMO: Basic Poswershell (.ps1) script
The Where (alias ?) command can be used to filter (e.g. files over 1,000 bytes):
Get-ChildItem | Where { $_.Length -gt 1000 } | Select Length, Name
Output can be controlled with Format-Table or Format-List
Get-ChildItem | Format-Table -AutoSize
Get-ChildItem | Format-List | more
Standard options are available
Remove-Item does_not_exist.txt
Remove-Item does_not_exist.txt -ErrorAction SilentlyContinue
New-Item -Type File it_exists.txt
Remove-Item it_exists.txt -Verbose
4.3 Create a Powershell script that will perform basic enumeration of a workstation
Functions in Powershell have unexpected quirks:
function summer($a,$b) {
$total = $a + $b
echo "a=$a b=$b sum=$total"
return $total
}
$sum = summer 9 10
Write-Output "Sum is $sum"
summer 1 2
summer 5, 6
summer(7, 8)
summer(7, 8) (9,10)
4.3 Create a Powershell script that will perform basic enumeration of a workstation
EXERCISE: Through the Wire
EXERCISE
THROUGH THE WIRE
Day 3
Review: Creation of batch script and powershell script. Use your own of the ones located at the following address:
http://we_should_pre-write_the_scripts_and_host_on_git
http://we_should_pre-Write_the_output_as_well_just_in_case
Demo a batch script that will perform a basic enumeration of a windows workstation.
http://link_here_for_script
Be aware that variables (i.e. %i) must be doubled in a batch file (%%i)
4.2 Create a batch script that will perform a basic enumeration of a workstation
SysInternals Tools
/?: provides help menu for each tool
PROCESSES
psinfo: shows basic system info, remote capabilities.
psinfo -h -s -d -nobanner
pslist: shows processes in tree format.
pslist -t
procmon: used to view, monitor, filter on processes. (GUI)
autoruns: checks autorun registry locations.
handle: shows handles of all processes.
handle -p (matches partial names)
1.2 Use System Internal tools to gain situational awareness of the current workstation
USERS
logonsessions
logonsessions -p
psloggedon
NETWORKING
tcpview
1.2 Use System Internal tools to gain situational awareness of the current workstation
DISCUSSION: What is situational awareness?
What is running on the system?
Processes
Services
Scheduled tasks
Registry keys
Users on the system?
Accounts
Groups
Domain
Situational Awareness Discussion
Networking
System networking settings
Local subnet
Active Network Connections
Routing
Firewall settings
Logging and Auditing
Windows event logs
Windows auditing policies
Situational Awareness Discussion