Windows Command for Pentesting

gistfile1.txt

# Parsing %PATH% variable in Windows 
for %a in ("%path:;=";"%") do @echo %~a 

# Apply accesschk.exe to each PATH in %PATH% and check our access permission to that folder
for %a in ("%path:;=";"%") do accesschk.exe -dqv "%~a"

# Check all scheduled tasks 
schtasks /query
schtasks /query /fo LIST /v 

schtasks /query /fo LIST /v | findstr "Task To Run:" > ttr.txt

# Using the AD module to query the DC
Get-ADUser <account_name_to_check_for>  -credential <valid_username> -server <server_ip> -Properties MemberOf| Select-Object MemberOf

# List the Computer that using the policy "{31B2F340-016D-11D2-945F-00C04FB984F9}" 
Get-NetOU -GUID "{31B2F340-016D-11D2-945F-00C04FB984F9}" | %{ Get-NetComputer -ADSPath $_ }

# Make sure you import their customized PowerView 
Import-Module PowerView 
Import-Module bloodhound.ps1  
Get-BloodHoundData | Export-BloodHoundCSV # after this you can just import all the csv to neo4j 


# Windows Pentesting idea 
Information Gathering 
- Bloodhound to map out the whole network (Might take really long) 
- Use PowerSploit/PowerView to gather information (DC, User groups, domain) 
- Network map? .. no idea yet
- nmap scan 
- Get-NetGroup 
- Get-NetGroupMember