Module 38 (Driving Around on Windows) At the end of this Module, you should know where you can find a Windows XP iso to install in your VM application. (Install one!) You'll also know a little bit about dealing with Windows through the command line interface and why it's necessary for you to know how to do so. Module 38
But I don't Have A Windows VM! Go to http://www.eng.ufl.edu/msdnaa/ Module 38
Where to Go? Look for Operating Systems Module 38
What to Get? Get the XP iso and install it in your VM app. Module 38
Why Do I need to Use the Dreaded Command Line? When you have a shell through nc or metasploit, you don't see the display. What happens if you execute any of these commands cls edit runas Module 38
Driving Around in Windows Look at environment variables: set Find the current user (usually) set username If the username is not set, how can we find it? cd c:\windows\temp &REM get to temp dir dir &REM see what's in it echo >foo &REM create a file dir /q foo &REM /q shows owner Module 38
The all-important SystemRoot The System installation directory is stored in the environment variable SystemRoot. Inspect it as follows: set SystemRoot The OS may not be installed in the default location on drive C:. Don't get fooled! Use sysem variables in a command by enclosing them in percent signs: echo %systemroot% cd %systemroot% Module 38
Know How to Drive dir Know about the option to the dir command: See all files in a directory tree dir /b /s c:\ /b calls for bare output, i.e., no headers. /s says to recurse into subdirectories (appears on other commands such as attrib) Module 38
Registry Keys are Key! You can interact with the registry from the command line with the reg command. Query reg query [KeyName] Add values reg add [Keyname] /v [ValueName] /t [type] /d [Data] Export settings reg export [KeyName] [filename] Import settings reg import [filename] Module 38
Find out About the Local Network Arp Scan: arp -a Check out the network configuration ipconfig /all Display current network usage: netstat -na Module 38