|
| 1 | +<!-- Code for collapse and expand --> |
| 2 | +<script type="text/javascript"> |
| 3 | +$(document).ready(function() { |
| 4 | +$('div.view').hide(); |
| 5 | +$('div.slide').click(function() { |
| 6 | +$(this).next('div.view').slideToggle('fast'); |
| 7 | +return false; |
| 8 | +}); |
| 9 | +}); |
| 10 | +</script> |
| 11 | + |
| 12 | +# Windows Remote Access Commands |
| 13 | + |
| 14 | +Commands that move data and files between systems on a network and are usually executed from the context of the `cmd.exe` or `command.exe` prompt. |
| 15 | + |
| 16 | +## Miscellaneous |
| 17 | +### dir |
| 18 | + * **Command with arguments**: `dir \\[computername|ip]\share` |
| 19 | + * **Description**: **Must have token to the remote system.** See `net use` below to establish such a connection. Displays the contents of the remote computer's share. |
| 20 | + * **Output**: |
| 21 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Users\johndoe>dir \\192.168.10.34\c$ |
| 22 | + Volume in drive \\192.168.10.34\c$ has no label. |
| 23 | + Volume Serial Number is 1A09-5F16<br> |
| 24 | + Directory of \\192.168.10.34\c$<br> |
| 25 | +09/18/2006 05:43 PM 24 autoexec.bat |
| 26 | +09/18/2006 05:43 PM 10 config.sys |
| 27 | +01/19/2008 05:40 AM <DIR> PerfLogs |
| 28 | +10/08/2013 07:36 PM <DIR> Program Files |
| 29 | +10/23/2013 08:20 PM <DIR> temp |
| 30 | +10/10/2013 08:59 PM <DIR> Users |
| 31 | +10/23/2013 08:38 PM <DIR> Windows |
| 32 | + 2 File(s) 34 bytes |
| 33 | + 5 Dir(s) 33,316,192,256 bytes free</code></div> |
| 34 | + |
| 35 | +### qprocess |
| 36 | + * **Command with arguments**: `qprocess * [/SERVER:computername]` |
| 37 | + * **Description**: Shows information about processes locally or remotely if you provide the computername or IP. |
| 38 | + * **Output**: |
| 39 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Users\johndoe>qprocess * /SERVER:192.168.1.2 |
| 40 | + USERNAME SESSIONNAME ID PID IMAGE |
| 41 | + (unknown) services 0 0 |
| 42 | + (unknown) services 0 4 system |
| 43 | + (unknown) services 0 268 smss.exe |
| 44 | + (unknown) services 0 356 csrss.exe |
| 45 | + (unknown) services 0 408 wininit.exe |
| 46 | +>(unknown) console 1 420 csrss.exe |
| 47 | +>(unknown) console 1 460 winlogon.exe |
| 48 | + (unknown) services 0 516 services.exe |
| 49 | +>johndoe console 1 1584 dwm.exe |
| 50 | +>johndoe console 1 1600 explorer.exe |
| 51 | + (unknown) services 0 1708 vmtoolsd.exe |
| 52 | +>johndoe console 1 1936 vmwaretray.exe |
| 53 | +>johndoe console 1 1944 vmtoolsd.exe |
| 54 | + (unknown) services 0 316 tpautoconnsv... |
| 55 | +>johndoe console 1 1716 tpautoconnec... |
| 56 | +>johndoe console 1 1680 conhost.exe |
| 57 | + (unknown) services 0 1984 searchindexe... |
| 58 | + (unknown) services 0 2076 msdtc.exe |
| 59 | + (unknown) services 0 2844 svchost.exe |
| 60 | + (unknown) services 0 2920 sppsvc.exe |
| 61 | + (unknown) services 0 2976 svchost.exe |
| 62 | +>johndoe console 1 3576 cmd.exe |
| 63 | +>johndoe console 1 3540 conhost.exe |
| 64 | +>johndoe console 1 2340 cmd.exe |
| 65 | +>johndoe console 1 1560 conhost.exe |
| 66 | +>johndoe console 1 3616 qprocess.exe</code></div> |
| 67 | + |
| 68 | +### qwinsta |
| 69 | + * **Command with arguments**: `qwinsta [/SERVER:computername]` |
| 70 | + * **Description**: Shows information about Remote Desktop Sessions locally or remotely if you provide the computername or IP. |
| 71 | + * **Output**: |
| 72 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Users\johndoe>qwinsta<br> SESSIONNAME USERNAME ID STATE TYPE DEVICE<br> services 0 Disc<br>>console johndoe 1 Active<br> rdp-tcp 65536 Listen</code></div> |
| 73 | + |
| 74 | +### Remote Assistance Enable |
| 75 | + * **Command with arguments**: `reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fAllowToGetHelp /t REG_DWORD /d 1 /f` |
| 76 | + * **Description**: **Must be admin to run this.** Enable remote assistance through adding a registry entry on the local system. |
| 77 | + * **Output**: |
| 78 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Windows\system32>reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f |
| 79 | +The operation completed successfully.</code></div> |
| 80 | + |
| 81 | +### Remote Desktop Enable |
| 82 | + * **Command with arguments**: `reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f` |
| 83 | + * **Description**: **Must be admin to run this.** Enable remote desktop through adding a registry entry on the local system. |
| 84 | + * **Output**: |
| 85 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Windows\system32>reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f |
| 86 | +The operation completed successfully.</code></div> |
| 87 | + |
| 88 | +### tasklist |
| 89 | + * **Command with arguments**: `tasklist /v /s [computername|IP]` |
| 90 | + * **Description**: Retrieve the current running processes from the remote system. [Microsoft manual](http://technet.microsoft.com/en-us/library/bb491010.aspx). |
| 91 | + * **Output**: |
| 92 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Windows\system32>tasklist /V /S 192.168.10.34<br>Type the password for WIN-V32NJ7H3AQE\johndoe:************************<br><br><br>Image Name PID Session Name Session# Mem Usage User Name CPU Time<br>========================= ======== ================ =========== ============ ================================================== ============<br>System Idle Process 0 0 24 K N/A 4:01:47<br>System 4 0 2,244 K N/A 0:00:13<br>smss.exe 388 0 696 K NT AUTHORITY\SYSTEM 0:00:00<br>csrss.exe 452 0 4,992 K NT AUTHORITY\SYSTEM 0:00:01<br>csrss.exe 492 1 10,800 K NT AUTHORITY\SYSTEM 0:00:17<br>wininit.exe 500 0 3,740 K NT AUTHORITY\SYSTEM 0:00:00<br>winlogon.exe 532 1 4,244 K NT AUTHORITY\SYSTEM 0:00:00<br>services.exe 580 0 7,308 K NT AUTHORITY\SYSTEM 0:00:03<br>lsass.exe 592 0 36,968 K NT AUTHORITY\SYSTEM 0:00:06<br>lsm.exe 600 0 5,128 K NT AUTHORITY\SYSTEM 0:00:00<br>svchost.exe 840 0 6,576 K NT AUTHORITY\SYSTEM 0:00:02<br>svchost.exe 908 0 6,652 K NT AUTHORITY\NETWORK SERVICE 0:00:00<br>svchost.exe 984 0 7,976 K NT AUTHORITY\LOCAL SERVICE 0:00:02<br>svchost.exe 1036 0 7,992 K NT AUTHORITY\SYSTEM 0:00:00<br>svchost.exe 1056 0 26,740 K NT AUTHORITY\SYSTEM 0:00:08<br>SLsvc.exe 1072 0 11,280 K NT AUTHORITY\NETWORK SERVICE 0:00:12<br>svchost.exe 1124 0 9,720 K NT AUTHORITY\LOCAL SERVICE 0:00:01<br>svchost.exe 1184 0 8,888 K NT AUTHORITY\SYSTEM 0:00:01<br>svchost.exe 1208 0 15,332 K NT AUTHORITY\NETWORK SERVICE 0:00:01<br>svchost.exe 1368 0 10,140 K NT AUTHORITY\LOCAL SERVICE 0:00:00<br>taskeng.exe 1572 0 7,024 K NT AUTHORITY\SYSTEM 0:00:00<br>spoolsv.exe 1680 0 9,892 K NT AUTHORITY\SYSTEM 0:00:00<br>dfsrs.exe 1732 0 8,608 K NT AUTHORITY\SYSTEM 0:00:00<br>dns.exe 1756 0 39,456 K NT AUTHORITY\SYSTEM 0:00:00</code></div> |
| 93 | +---- |
| 94 | + |
| 95 | +## net |
| 96 | +### net time |
| 97 | + * **Command with arguments**: `net time \\[computername|ip]` |
| 98 | + * **Description**: Display the time from the remote system. |
| 99 | + * **Output**: |
| 100 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Users\johndoe>net time \\192.168.10.34 |
| 101 | +Current time at \\192.168.10.34 is 10/23/2013 9:03:04 PM<br> |
| 102 | +The command completed successfully.</code></div> |
| 103 | + |
| 104 | +### net use |
| 105 | + * **Command with arguments**: `net use \\[computername|ip] [/user:DOMAIN\USERNAME] [password] ` |
| 106 | + * **Description**: Create a connection to the remote computer. This maps IPC$ which does not show up as a drive but allows you to access the remote system as the current user. If the user you launch the command as is not valid on the remote system you will need to specify a valid DOMAIN\USER and PASSWORD. This is useful when you have credentials from somewhere and wish to use them but do not have an active token on a machine you have a session on. |
| 107 | + * **Output**: |
| 108 | + * <div class="slide" style="cursor: pointer;"> **Windows 2008:** Show/Hide</div><div class="view"><code>C:\Users\johndoe>net use \\192.168.10.34 /user:lab\johndoe |
| 109 | +The password or user name is invalid for \\192.168.10.34.<br> |
| 110 | +Enter the password for 'lab\johndoe' to connect to '192.168.10.34': |
| 111 | +The command completed successfully.</code></div> |
0 commit comments