Gathering Information of the System
Last updated
Network Configuration:
ipconfig /all → View detailed network interface configurations (IP, DNS, etc.).
arp -a → Display ARP cache (shows local network devices).
route print → View the system's routing table.
Service Information:
tasklist /svc → List all running processes along with their services.
netstat -ano → Display active TCP/UDP connections and listening ports with process IDs.
System Info:
systeminfo → Get a comprehensive overview of the system (OS version, architecture, hotfixes, etc.).
wmic product get name → List installed software via the command line.
Get-WmiObject -Class Win32_Product | select Name, Version → List installed software via PowerShell.
Current User & Privileges:
whoami /priv → List current user privileges.
whoami /groups → List group memberships for the current user.
net user → Get a list of all user accounts.
query user → Display logged-in users on the system.
Groups & Password Policies:
net localgroup → List all local groups.
net localgroup "Backup Operators" → List users in the Backup Operators group.
net accounts → View password policies and other account-related configurations.
Windows Defender:
Get-MpComputerStatus → Check the status of Windows Defender (active, signatures, etc.).
AppLocker:
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections → List effective AppLocker rules.
Test-AppLockerPolicy -Path C:\Windows\System32\cmd.exe -User Everyone → Test if a specific executable (cmd.exe) can be run for a specific user.
Listing Named Pipes:
pipelist.exe /accepteula → List all named pipes on the system.
Access Rights to Named Pipes:
accesschk.exe /accepteula \\.\Pipe\lsass -v → Check permissions for a specific named pipe (e.g., LSASS pipe).
accesschk.exe /accepteula -w \\.\Pipe\SQLLocal\SQLEXPRESS01 -v → Check write access for a SQL pipe.
View Environment Variables:
set → Display environment variables for the current session.
Last updated