{"id":421,"date":"2014-07-05T07:04:22","date_gmt":"2014-07-05T07:04:22","guid":{"rendered":"http:\/\/ixyzero.com\/blog\/?p=421"},"modified":"2014-07-05T07:04:22","modified_gmt":"2014-07-05T07:04:22","slug":"collect%e4%b8%80%e4%ba%9bwindows%e5%91%bd%e4%bb%a4bak","status":"publish","type":"post","link":"https:\/\/ixyzero.com\/blog\/archives\/421.html","title":{"rendered":"[collect]\u4e00\u4e9bWindows\u547d\u4ee4[bak]"},"content":{"rendered":"<p style=\"color: #666666;\"><span style=\"color: #000000;\"><strong>\u5185\u7f51(\u57df)\u6e17\u900f\u20131.\u57fa\u672c\u547d\u4ee4<\/strong><\/span><\/p>\n<p style=\"color: #666666;\">====================================================<\/p>\n<pre class=\"lang:default decode:true\">ipconfig \/all\t\t\t\t#\u67e5\u8be2\u672c\u673aIP\u6bb5\uff0c\u6240\u5728\u57df\u7b49\nnet user\t\t\t\t\t#\u672c\u673a\u7528\u6237\u5217\u8868\nnet localhroup administrators\t#\u672c\u673a\u7ba1\u7406\u5458[\u901a\u5e38\u542b\u6709\u57df\u7528\u6237]\nnet user \/domain\t\t\t\t#\u67e5\u8be2\u57df\u7528\u6237\nnet group \/domain\t\t\t\t#\u67e5\u8be2\u57df\u91cc\u9762\u7684\u5de5\u4f5c\u7ec4\nnet group \"domain admins\" \/domain\t#\u67e5\u8be2\u57df\u7ba1\u7406\u5458\u7528\u6237\u7ec4\nnet localgroup administrators \/domain\t#\u767b\u5f55\u672c\u673a\u7684\u57df\u7ba1\u7406\u5458\nnet localgroup administrators workgroupuser001 \/add\t#\u57df\u7528\u6237\u6dfb\u52a0\u5230\u672c\u673a\nnet group \"domain controllers\" \/domain\t#\u67e5\u770b\u57df\u63a7\u5236\u5668(\u5982\u679c\u6709\u591a\u53f0)\nnet time \/domain\t\t#\u5224\u65ad\u4e3b\u57df\uff0c\u4e3b\u57df\u670d\u52a1\u5668\u90fd\u505a\u65f6\u95f4\u670d\u52a1\u5668\nnet config workstation\t#\u5f53\u524d\u767b\u5f55\u57df\nnet session\t\t\t\t#\u67e5\u770b\u5f53\u524d\u4f1a\u8bdd\nnet use \\ipipc$ pawword \/user:username\t#\u5efa\u7acbIPC\u4f1a\u8bdd[\u7a7a\u8fde\u63a5-***]\nnet share\t\t\t#\u67e5\u770bSMB\u6307\u5411\u7684\u8def\u5f84[\u5373\u5171\u4eab]\nnet view\t\t\t#\u67e5\u8be2\u540c\u4e00\u57df\u5185\u673a\u5668\u5217\u8868\nnet view \\ip\t\t#\u67e5\u8be2\u67d0IP\u5171\u4eab\nnet view \/domain\t#\u67e5\u8be2\u57df\u5217\u8868\nnet view \/domain:domainname\t\t#\u67e5\u770bworkgroup\u57df\u4e2d\u8ba1\u7b97\u673a\u5217\u8868\nnet start\t\t\t\t#\u67e5\u770b\u5f53\u524d\u8fd0\u884c\u7684\u670d\u52a1\nnet accounts\t\t\t#\u67e5\u770b\u672c\u5730\u5bc6\u7801\u7b56\u7565\nnet accounts \/domain\t#\u67e5\u770b\u57df\u5bc6\u7801\u7b56\u7565\nnbtstat \u2013A ip\t\t\t#netbios\u67e5\u8be2\nnetstat \u2013an\/ano\/anb\t\t#\u7f51\u7edc\u8fde\u63a5\u67e5\u8be2\nroute print\t\t\t\t#\u8def\u7531\u8868<\/pre>\n<p>====================================================<\/p>\n<pre class=\"lang:default decode:true\">dsquery computer       # finds computers in the directory.\ndsquery contact           # finds contacts in thedirectory.\ndsquery subnet # finds subnets in thedirectory.\ndsquery group  # finds groups in thedirectory.\ndsquery ou        # finds organizationalunits in the directory.\ndsquery site      # finds sites in thedirectory.\ndsquery server  # finds domain controllers inthe directory.\ndsquery user     # finds users in thedirectory.\ndsquery quota   # finds quota specificationsin the directory.\ndsquery partition         # finds partitions in thedirectory.\ndsquery *          # finds any object inthe directory by using a generic LDAP query.\ndsquery server \u2013domain Yahoo.com | dsget server\u2013dnsname \u2013site # \u641c\u7d22\u57df\u5185\u57df\u63a7\u5236\u5668\u7684DNS\u4e3b\u673a\u540d\u548c\u7ad9\u70b9\u540d\ndsquery computer domainroot \u2013name *-xp \u2013limit 10 # \u641c\u7d22\u57df\u5185\u4ee5-xp\u7ed3\u5c3e\u7684\u673a\u566810\u53f0\ndsquery user domainroot \u2013name admin* -limit # \u641c\u7d22\u57df\u5185\u4ee5admin\u5f00\u5934\u7684\u7528\u623710\u4e2a\n\u2026\u2026\n\u2026\u2026\n[\u6ce8:dsquery\u6765\u6e90\u4e8eWindows Server 2003 Administration Tools Pack]<\/pre>\n<p>====================================================<\/p>\n<pre class=\"lang:default decode:true\">tasklist \/V           # \u67e5\u770b\u8fdb\u7a0b[\u663e\u793a\u5bf9\u5e94\u7528\u6237]\ntasklist \/S ip \/U domainusername \/P \/V  # \u67e5\u770b\u8fdc\u7a0b\u8ba1\u7b97\u673a\u8fdb\u7a0b\u5217\u8868\nqprocess *         # \u7c7b\u4f3ctasklist\nqprocess \/SERVER:IP      # \u8fdc\u7a0b\u67e5\u770b\u8ba1\u7b97\u673a\u8fdb\u7a0b\u5217\u8868\nnslookup \u2013qt-MX Yahoo.com      # \u67e5\u770b\u90ae\u4ef6\u670d\u52a1\u5668\nwhoami \/all        # \u67e5\u8be2\u5f53\u524d\u7528\u6237\u6743\u9650\u7b49\nset        # \u67e5\u770b\u7cfb\u7edf\u73af\u5883\u53d8\u91cf\nsysteminfo         # \u67e5\u770b\u7cfb\u7edf\u4fe1\u606f\nqwinsta # \u67e5\u770b\u767b\u5f55\u60c5\u51b5\nqwinsta \/SERVER:IP       # \u67e5\u770b\u8fdc\u7a0b\u767b\u5f55\u60c5\u51b5\nfsutil fsinfo drives           # \u67e5\u770b\u6240\u6709\u76d8\u7b26\ngpupdate \/force   # \u66f4\u65b0\u57df\u7b56\u7565<\/pre>\n<p>===================================================<\/p>\n<pre class=\"lang:default decode:true \">wmic bios          # \u67e5\u770bbios\u4fe1\u606f\nwmic qfe           # \u67e5\u770b\u8865\u4e01\u4fe1\u606f\nwmic qfe get hotfixid    # \u67e5\u770b\u8865\u4e01-Patch\u53f7\nwmic startup      # \u67e5\u770b\u542f\u52a8\u9879\nwmic service      # \u67e5\u770b\u670d\u52a1\nwmic os           # \u67e5\u770bOS\u4fe1\u606f\nwmic process get caption,executablepath,commandline\nwmic process call create \u201cprocess_name\u201d (executes a program)\nwmic process where name=\u201dprocess_name\u201d call terminate (terminates program)\nwmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size,\nvolumeserialnumber (hard drive information)\nwmic useraccount (usernames, sid, and various security related goodies)\nwmic useraccount get \/ALL\nwmic share get \/ALL (you can use ? for gets help ! )\nwmic startup list full (this can be a huge list!!!)\nwmic \/node:\"hostname\" bios get serialnumber (this can be great for finding warranty info about target)<\/pre>\n<p>====================================================<\/p>\n<p style=\"color: #666666;\"><span style=\"color: #e53333;\">Password hashes dump tools\u00a0<\/span>\u00a0 \u00a0\u2014\u2014\u6293hash\u5de5\u5177\u5217\u8868[\u5927\u96c6\u5408]<\/p>\n<p style=\"color: #666666;\">\n<h6 style=\"color: #666666;\">\u53c2\u8003\u94fe\u63a5\uff1a<\/h6>\n<ul>\n<li style=\"color: #666666;\"><a href=\"http:\/\/www.freebuf.com\/articles\/system\/8499.html\" target=\"_blank\">\u6d45\u8c08\u5185\u7f51\u6e17\u900f<\/a><\/li>\n<li style=\"color: #666666;\"><a href=\"http:\/\/www.freebuf.com\/articles\/system\/8726.html\" target=\"_blank\">\u518d\u8c08\u5185\u7f51\u6e17\u900f<\/a><\/li>\n<li style=\"color: #666666;\"><a href=\"http:\/\/www.freebuf.com\/articles\/web\/5783.html\" target=\"_blank\">\u518d\u63a2\u5185\u7f51\uff08\u57df\uff09\u6e17\u900f<\/a><\/li>\n<li style=\"color: #666666;\"><a href=\"http:\/\/www.freebuf.com\/articles\/web\/5901.html\" target=\"_blank\">\u5185\u7f51(\u57df)\u6e17\u900f\u4e4b\u5e38\u89c1\u547d\u4ee4(\u7eed)<\/a><\/li>\n<li style=\"color: #666666;\"><a href=\"http:\/\/www.freebuf.com\/articles\/web\/53056.html\" target=\"_blank\">\u4e00\u4e2a\u4eba\u7684\u6b66\u6797\uff1a\u6e17\u900f\u6d4b\u8bd5\u5e38\u89c4\u601d\u8def\u5206\u6790\uff08\u4e00\uff09<\/a><\/li>\n<li style=\"color: #666666;\"><a href=\"http:\/\/www.freebuf.com\/articles\/system\/53987.html\" target=\"_blank\">\u4e00\u4e2a\u4eba\u7684\u6b66\u6797\uff1a\u5185\u7f51\u6e17\u900f\u6d4b\u8bd5\u601d\u8def\uff08\u4e8c\uff09<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u5185\u7f51(\u57df)\u6e17\u900f\u20131.\u57fa\u672c\u547d\u4ee4 ======================================== [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,12,20],"tags":[202,203,159,104,123],"class_list":["post-421","post","type-post","status-publish","format-standard","hentry","category-security","category-tools","category-windows","tag-dsquery","tag-net","tag-netstat","tag-windows","tag-wmi"],"views":35924,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=421"}],"version-history":[{"count":0,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/421\/revisions"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}