> For the complete documentation index, see [llms.txt](https://refabr1k.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://refabr1k.gitbook.io/oscp/privesc/powershell-cmd.md).

# Basic checks / powershell

## Default powershell path

Powershell default path IMPORTANT: Using SysNative will get us to use the correct Powershell (32bit or 64bit) version, if we do not use absolute path the 32bit powershell will be used instead - this would be cause problems if you are trying to run privesc exploits in powershell later on a 64bit machine.

```
C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe
```

## Basic

| Syntax                   | Description                  |
| ------------------------ | ---------------------------- |
| `systeminfo`
        | System info, os, achitecture |
| <p><code>hostname</code> |                              |

</p><p><code>echo %username%</code></p>                   | Hostname/compute rname       |
| <p><code>net user &#x3C;username></code>
</p><p><code>Whoami /priv</code></p>      | user privileges              |
| `net localgroups`                                                                  | Groups                       |
| `net localgroup administrators`                                                    | Admin group users            |
| <p><code>set</code>
</p><p><code>Get-ChildItem Env: | ft Key,Value</code></p>      | Env variables                |
| `Get-Process <process name> -FileVersionInfo`                                      | Process                      |
| `Get-ChildItem -Path "C:\Users\Folder" -Recurse -File \| Select-String "Password"` | Recursive search string      |
| `powershell.exe -exec bypass -Command “& command1; command2"}`                     | Powershell execute from cmd  |
| `cmd /c "ftp -v -n -s:ftp.txt"`                                                    | FTP                          |

## Network

| Syntax                                    | Description                            |
| ----------------------------------------- | -------------------------------------- |
| `ipconfig /all`&#xD;                      | Ip&#xD; address                        |
| `route print`&#xD;                        | &#xD;Route&#xD;                        |
| `arp -A`&#xD;                             | Arp (other machines that ping it)&#xD; |
| `netstat -ano`&#xD;                       | Open ports                             |
| <p><code>netsh firewall show state</code> |                                        |

</p><p><code>netsh firewall show config</code>
</p> | Check Firewall                         |

## Juicy Info

### Reg query passwords in registry

```c
# Passwords in registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password

```

### Dir search password files

```c
# Find writeable files
dir /a-r-d /s /b

# Password files
dir /b /s unattend.xml
dir /b /s web.config
dir /b /s sysprep.inf
dir /b /s sysprep.xml
dir /b /s *pass*
dir /b /s vnc.ini
dir /s *pass* == *cred* == *vnc* == *.config*
```

### Using 'findstr' to find files

```c
# findstr syntax
findstr /si password *.xml *.ini *.txt
```

### Juicy files to look

#### Plaintext or base64 encoded passwords / config files

```c
C:\sysprep.inf
C:\sysprep\sysprep.xml
%WINDIR%\Panther\Unattend\Unattended.xml
%WINDIR%\Panther\Unattended.xml 
%SYSTEMROOT%repairsystem
%SYSTEMROOT%repairSAM
%SYSTEMROOT%repairSAM
%WINDIR%win.ini
%SYSTEMDRIVE%boot.ini
%WINDIR%Panthersysprep.inf
%WINDIR%system32configAppEvent.Evt

```

#### Encrypted password in plaintext. Can use PowerSploit's Get-GPPPassword module

```c
Groups.xml
```

| Syntax | Description |
| ------ | ----------- |