Windows

CLI

Day 1

Command Line Tool Output


  • Importance
    • could make or break your operation
    • GUI may not be available
    • Often times a command line tool must be used

Basic Native Commands

  • set
  • where
  • echo
  • dir
  • type
  • findstr /I /R word
  • hostname
  • date /t
  • time /t
  • Batch (.bat)
    • allows for automation of tasks

Native Command Redirection

  • > and >>
  • Piping ( | )
  • Conditional processing symbols
    • & and ;
    • &&
    • ||
  • Nesting

ACTIVITY

Windows Batch Script

(Using only CMD commands)

WMIC Command Basics

  • wmic /?
  • wmic process /?
  • wmic service
  • wmic useraccount
  • wmic nicconfig
  • wmic nteventlog
    • list brief

ACTIVITY

Windows Batch Script using only WMIC commands

Day 2

Powershell

  • Powershell ISE
  • Different versions
  • Commandlets (cmdlets)

Powershell Continued

  • Why use powershell?
  • <INSERT VERBS FROM PS HERE AND EXPLAIN>
  • Object oriented
  • Get-help <content>
    • Get-help <command>
Running external commands (cmd.exe or sysinternals) will return a string. Running a Powershell command will return an object. DEMO: tasklist | get-member Returns ‘system.string’ DEMO: get-process | get-member Returns ‘powershell object’ An object is a data structure that contains properties and methods Properties = data Methods = functions or actions to take on properties. Tasklist | get-member VS get-process | get-member Compare the different control you have over the 2 commands Address properties or methods: object. --OR-- object.(args) 3.2 Demonstrate basic functionality of PowerShell
Main Components of Powershell Internal and external commands. (?) External = spawn new process attrib Internal = runs inside powershell process ping, dir Cmd.exe is ppid of all internal commands. (?) Objects: The output from a powershell command is an object. Classes: General term for grouped objects WMIC and CIM Common Information Model (CIM): meant to be cross platform Windows Management Instrumentation (WMI) is windows specific
3.3 Describe the main components of PowerShell Variables: $a=”Hello World” Command substitution: $(get-process).name Looping: $(get-process).name | foreach-object {echo “$_ is a running process”} $a=1..5; foreach ($i in $a) {echo “$i is a number”} $x=0; while ($x -lt 100) {echo “this is loop number $x”; $x++} Indexing: $(get-process)[4] --OR-- $(get-process)[0..4] **Indices always start at 0** 3.3 Describe the main components of PowerShell
Arithmetic: 1+1 == 2 1 + “dog” == “1dog” “cat” + “dog” == “catdog” (strings concatenate) $a=”1”; $a+1 == “11” Because $a is a string. Use a typecast to avoid this: [int]$a+1 == 2 While ($true) {$date = get-date -format hh:mm; if ($date -eq “05:00”){break}} Functions A list of commands that, when together, serve a purpose. Ex. Function dostuff {get-date; get-process; get-service} Once the function has been declared, you simply issue the name of the function as a command and it will execute the commands inside the function. 3.3 Describe the main components of PowerShell
Multithreading A technique that allows a single set of code to be used by several processors at different stages of execution. To multithread in Powershell, use jobs https://www.youtube.com/watch?v=4QnJPCqaOWQ https://www.youtube.com/watch?v=kj98OhCW-xs
DEMO: get-ciminstance -namespace root\securitycenter2 -classname antispywareproduct WMI is organized in namespaces, like folder that correlate to products/technology Get-wmiobject -class win32_BIOS When a cmdlet is run in PowerShell, the object is output in a default way. You can format the data that you recieve by piping the object through a format cmdlet (format-table, format-list, etc) 3.3 Describe the main components of PowerShell
DEMO: command and explain the parts of the command and the output to the students
Get-process | get-member Look at associated properties Get-process | select threads, processname, id Choose a few different properties to view Get-process | select threads, processname, id | where {$_.id -lt 1000} Get more granular and view specific process properties 3.3 Describe the main components of PowerShell
Powershell Enumeration Scripting Set-ExecutionPolicy Unrestricted -Scope CurrentUser This command is required before running any Powershell scripts **NOTE: Powershell supports tab completion for files, commands, and options.** Aliases are available to help all types of users (cmd.exe and bash users) Ex. Get-childitem: ls, dir, gci The ForEach (alias %) command has two distinct forms: ForEach ($f in Get-ChildItem) { Write-output “$($f.Length) $($f.FullName)” } Get-ChildItem | ForEach { Write-output “$($_.Length) $($_.FullName)” } 4.3 Create a Powershell script that will perform basic enumeration of a workstation
DEMO: Basic Poswershell (.ps1) script
The Where (alias ?) command can be used to filter (e.g. files over 1,000 bytes): Get-ChildItem | Where { $_.Length -gt 1000 } | Select Length, Name Output can be controlled with Format-Table or Format-List Get-ChildItem | Format-Table -AutoSize Get-ChildItem | Format-List | more Standard options are available Remove-Item does_not_exist.txt Remove-Item does_not_exist.txt -ErrorAction SilentlyContinue New-Item -Type File it_exists.txt Remove-Item it_exists.txt -Verbose 4.3 Create a Powershell script that will perform basic enumeration of a workstation
Functions in Powershell have unexpected quirks: function summer($a,$b) { $total = $a + $b echo "a=$a b=$b sum=$total" return $total } $sum = summer 9 10 Write-Output "Sum is $sum" summer 1 2 summer 5, 6 summer(7, 8) summer(7, 8) (9,10) 4.3 Create a Powershell script that will perform basic enumeration of a workstation EXERCISE: Through the Wire
EXERCISE THROUGH THE WIRE
Day 3 Review: Creation of batch script and powershell script. Use your own of the ones located at the following address: http://we_should_pre-write_the_scripts_and_host_on_git http://we_should_pre-Write_the_output_as_well_just_in_case
Demo a batch script that will perform a basic enumeration of a windows workstation. http://link_here_for_script Be aware that variables (i.e. %i) must be doubled in a batch file (%%i) 4.2 Create a batch script that will perform a basic enumeration of a workstation
ACTIVITY DLL Enumeration
SysInternals Tools /?: provides help menu for each tool PROCESSES psinfo: shows basic system info, remote capabilities. psinfo -h -s -d -nobanner pslist: shows processes in tree format. pslist -t procmon: used to view, monitor, filter on processes. (GUI) autoruns: checks autorun registry locations. handle: shows handles of all processes. handle -p (matches partial names) 1.2 Use System Internal tools to gain situational awareness of the current workstation
USERS logonsessions logonsessions -p psloggedon NETWORKING tcpview 1.2 Use System Internal tools to gain situational awareness of the current workstation
DISCUSSION: What is situational awareness? What is running on the system? Processes Services Scheduled tasks Registry keys Users on the system? Accounts Groups Domain Situational Awareness Discussion
Networking System networking settings Local subnet Active Network Connections Routing Firewall settings Logging and Auditing Windows event logs Windows auditing policies Situational Awareness Discussion
ACTIVITY Groups By User
ACTIVITY Rootkit Hunter