Hack Like a Pro: Windows CMD Remote Commands for the Aspiring Hacker, Part 1 « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Many new hackers come from a Windows background, but seldom, if ever, use its built-in command-line tools. As a hacker, you will often be forced to control the target system using just Windows commands and no GUI.Although we would love to getMetasploit's Meterpreter on the target and use all its capabilities on the owned system, that is not always possible. Some exploits will only allow us to get a CMD shell on the target Windows system.In these cases, you will need to understand how to control the system strictly through the command prompt, without ever having the convenience and familiarity of the Windows GUI.What I want to do in this tutorial is demonstrate some Windows commands on a Windows 7 system (Windows 7 is still over 50% of the installed base of Windows systems), but these commands change very little from Windows version to Windows version. I will be running the Windows commands from a remoteKalisystem on the target.Step 1: Connect to a Remote Windows System from KaliWindows makes a distinction between commands that can be run while physically on the system and those that can be run remotely. We can't assume that a command we can run while on the system will run remotely.Here, we are only interested in those that can be run remotely. In my case, I will be connecting to the target system with aNetcatconnection, but aMetasploit-spawned command shell or other will work just as well.Step 2: Basic CommandsIn many ways, Windows CMD commands are similar to Linux/Unix commands (Unix preceded these commands by over a decade, and Microsoft borrowed heavily from it). At its most basic, we need to change directories within the file system. Like Linux, Windows uses thecd(change directory) command. To travel to the root of the directory system, we can just type:cd \In addition, we can move up one level in the directory structure by typing:cd ..If we want to see the contents of a directory, we typediras seen above. Some other key and basic commands include:del <filename>This will delete the file, similar to the Linuxrm.type <filename>This will display the contents of the file, similar to the Linuxcat.As you can see below, I usedtypeto display the contents of the confidentialfile.txt. I thendel(delete) the confidentialfile.txt, and when I return to display the contents of it again, I get the message that "The system cannot find the specified file."To create a new directory, we use themd(make directory) command (in Linux, it'smkdir). To create a directory named "newdirectory," we type:md newdirectoryAfter making newdirectory, we can now rundirand see the new directory that we created.Step 3: Network CommandsWhen we are on the remote system, we may need networking information. To do so, we have two basic commands,ipconfigandnetstat. Ipconfig is very similar to the Linuxifconfig, as seen below.To view the network connections of the system, we can typenetstat,just like in Linux.netstatStep 4: View ProcessesOften, when we are on a remote system, we will need to see a listing of the running processes. From the GUI, of course, we can use the Task Manager (Ctrl + Alt + Del), but from the command prompt, we usetasklist.tasklistIf we want to find a single process, we could use the filterfindstr(find string). This works similarly togrepin Linux. So, to find the process named "explorer," we could type:tasklist | findstr explorerNote, that we used the pipe (|), just like in Linux, to send the results from thetasklistcommand to the filtering command,findstr.If I want to kill a process, I can use thetaskkillcommand. It requires the PID of the process we want to kill. In this case, the explorer process has a PID of 1532, so to kill it, I can type:taskkill /PID 1532 /FWhere the/Fmeans to force the kill.Step 5: Find the User AccountsIf we want to see the users on the target system, we can type:net usersAs you can see, this system has three users: guest, administrator, and the aptly named victim.Step 6: Run a Browser on the TargetWhile operating the system from the command prompt, we can execute some applications, such as the web browser. Internet Explorer is namediexploreon the command prompt, and we can find it either in the "Program Files" with the 64-bit version or "Program Files (x86)" with the 32-bit version. So, if I want to open Internet Explorer on the remote system from the command prompt and have it openwonderhowto.com, I would type:iexplorewww.wonderhowto.comWhen we do, this opens Internet Explorer on the target system and goes towonderhowto.com, as you can see below.This might be really useful if you had a malicious XSS link set up and needed the target to go to a web server. Furthermore, we might just want the target system to go to our web server on Kali. We could start the Apache web server and then direct the target system to our web server where we may have some malicious software.We can type:iexplore <IP address>As you can see below, we have directed the target system to our web server on Kali.Keep coming back, my greenhorn hackers, as we develop the most valuable skill set in the 21st century—hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow to Hack Databases:Running CMD Commands from an Online MS SQL ServerHack Like a Pro:Scripting for the Aspiring Hacker, Part 3 (Windows PowerShell)How To:Hack a Windows 7/8/10 Admin Account Password with Windows MagnifierNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Use Common Features of Windows Command PromptHow To:Reset Windows Password with a Windows CD or a Linux CDHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)Hacker Hurdles:DEP & ASLRHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)How To:Hack Any Windows 7/8/10 User Password Without Logging InHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)Advice from Typo:Mastering CMD Like a Real Hacker, Part 1 (Colors)How To:Hack Windows 7 (Become Admin)How To:Exploit DDE in Microsoft Office & Defend Against DDE-Based AttacksHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 9 (Managing Environmental Variables)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)How To:Run Your Favorite Graphical X Applications Over SSHHow To:Disable WPAD on Your PC So Your HTTPS Traffic Won't Be Vulnerable to the Latest SSL AttackHow To:Hack Wireless Router Passwords & Networks Using HydraGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Recover WinRAR and Zip PasswordsHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:Remotely Control Computers Over VNC Securely with SSHGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker Training