Editing Basic Windows Commands

= Basic Windows Commands =

'''Windows command-line tools''' are critical for navigating, enumerating, and gaining persistence on Windows-based systems.

Most global infrastructure still runs on Windows. During real-world engagements or red teaming, a hacker will inevitably encounter a compromised Windows host — and must know how to operate within it. Understanding native Windows commands provides direct access to system behavior, user activity, networking, and privilege structures. Whether working through CMD, PowerShell, or remote shells (e.g., C2 frameworks), this knowledge is essential.

Command Prompt (<code>cmd.exe</code>) is available on virtually every Windows machine, while PowerShell provides a more advanced scripting interface and object-oriented output. Mastering both enhances control, stealth, and capability during post-exploitation.

== <span id="commands"></span>Common Commands ==

=== Navigation & File Management ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-dir|<code>dir</code>]] || List directory contents || <code>dir C:\Users</code>
|-
| [[#ex-cd|<code>cd</code>]] || Change directory || <code>cd C:\Windows\System32</code>
|-
| [[#ex-mkdir|<code>mkdir</code>]] || Create a folder || <code>mkdir backdoor</code>
|-
| [[#ex-del|<code>del</code>]] || Delete file(s) || <code>del secret.txt</code>
|-
| [[#ex-copy|<code>copy</code>]] || Copy files || <code>copy payload.exe D:\payload.exe</code>
|-
| [[#ex-move|<code>move</code>]] || Move or rename files || <code>move key.txt ..\keys.txt</code>
|-
| [[#ex-robocopy|<code>robocopy</code>]] || Robust file copy with options || <code>robocopy C:\data D:\backup /MIR</code>
|-
| [[#ex-type|<code>type</code>]] || View file content || <code>type C:\Windows\win.ini</code>
|}

=== System Information & Monitoring ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-whoami|<code>whoami</code>]] || Show current user || <code>whoami</code>
|-
| [[#ex-hostname|<code>hostname</code>]] || Show computer name || <code>hostname</code>
|-
| [[#ex-systeminfo|<code>systeminfo</code>]] || Detailed OS & hardware info || <code>systeminfo</code>
|-
| [[#ex-tasklist|<code>tasklist</code>]] || List running processes || <code>tasklist</code>
|-
| [[#ex-taskkill|<code>taskkill</code>]] || Kill a process by PID || <code>taskkill /PID 1234 /F</code>
|-
| [[#ex-ver|<code>ver</code>]] || Display OS version || <code>ver</code>
|-
| [[#ex-driverquery|<code>driverquery</code>]] || List installed drivers || <code>driverquery /V</code>
|}

=== User & Privilege Enumeration ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-net-user|<code>net user</code>]] || List or modify user accounts || <code>net user</code>
|-
| [[#ex-net-localgroup|<code>net localgroup</code>]] || List or modify groups || <code>net localgroup administrators</code>
|-
| [[#ex-wmic-useraccount|<code>wmic useraccount</code>]] || Detailed user data || <code>wmic useraccount get name,sid,status</code>
|}

=== Networking & Connections ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-ipconfig|<code>ipconfig</code>]] || Show IP/network config || <code>ipconfig /all</code>
|-
| [[#ex-ping|<code>ping</code>]] || Test network reachability || <code>ping 8.8.8.8</code>
|-
| [[#ex-tracert|<code>tracert</code>]] || Show packet path || <code>tracert example.com</code>
|-
| [[#ex-netstat|<code>netstat</code>]] || Show active network connections || <code>netstat -ano</code>
|-
| [[#ex-arp|<code>arp</code>]] || View ARP cache || <code>arp -a</code>
|-
| [[#ex-nslookup|<code>nslookup</code>]] || Resolve domain to IP || <code>nslookup google.com</code>
|}

=== Persistence & Control ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-schtasks|<code>schtasks</code>]] || Schedule tasks (persistence) || <code>schtasks /Create /SC minute /TN backdoor /TR C:\payload.exe</code>
|-
| [[#ex-sc|<code>sc</code>]] || Service control manager || <code>sc qc wuauserv</code>
|-
| [[#ex-runas|<code>runas</code>]] || Run as another user || <code>runas /user:Administrator cmd</code>
|}

=== Registry & System Internals ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-reg|<code>reg</code>]] || Query/edit Windows registry || <code>reg query HKCU\Software</code>
|}

=== Helpful CMD Operations ===
{| class="wikitable sortable"
! Command !! Description !! Usage
|-
| [[#ex-help|<code>help</code>]] || Show available commands || <code>help</code>
|-
| [[#ex-command-help|<code>command /?</code>]] || Help for any command || <code>netstat /?</code>
|}

== Examples ==

=== <span id="ex-net-user"></span>List All Users ===
<syntaxhighlight lang="dos">
net user
</syntaxhighlight>

=== <span id="ex-net-localgroup"></span>List Local Admins ===
<syntaxhighlight lang="dos">
net localgroup administrators
</syntaxhighlight>

=== <span id="ex-tasklist"></span>List Running Processes ===
<syntaxhighlight lang="dos">
tasklist
</syntaxhighlight>

=== <span id="ex-netstat"></span>Show Open Network Ports ===
<syntaxhighlight lang="dos">
netstat -ano
</syntaxhighlight>

=== <span id="ex-schtasks"></span>Create Persistent Backdoor Task ===
<syntaxhighlight lang="dos">
schtasks /create /tn "backdoor" /tr "C:\payload.exe" /sc onlogon /ru "SYSTEM"
</syntaxhighlight>

=== <span id="ex-sc"></span>Query Service Config ===
<syntaxhighlight lang="dos">
sc qc WinDefend
</syntaxhighlight>

=== <span id="ex-wmic-useraccount"></span>List Users with SID ===
<syntaxhighlight lang="dos">
wmic useraccount get name,sid
</syntaxhighlight>

=== <span id="ex-ipconfig"></span>Get Full Network Config ===
<syntaxhighlight lang="dos">
ipconfig /all
</syntaxhighlight>

=== <span id="ex-reg"></span>Query Registry ===
<syntaxhighlight lang="dos">
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
</syntaxhighlight>

== See Also ==
* [[Windows Privilege Escalation]]
* [[PowerShell Basics]]
* [[Persistence Techniques]]
* [[Netcat]]