Intranet information collection (1) Working group information collection

Because I am currently studying "Intranet Security Attack and Defense Penetration Testing Practical Guide", I will record some notes here, and thank you for your wonderful explanation.
Workgroup information collection
Note: Users with low permissions under XP cannot use the wmic command. Wmic is very suitable for intranet lateral penetration
. 1. Query network configuration
ipconfig /all
2. Query user list
net user View local user list
net localgroup administrators Machine administrator (usually including domain users)
query user || qwinsta View current online users
3. Query process list
tasklist /v
wmic process list brief
4. Collect local machine information
Obtain operating system and version information
systeminfo | findstr /B /C: "OS Name" /C: "OS Version"
systeminfo | findstr /B /C: "OS name" /C: "OS version"
View the installed software and version, path, etc.
wmic product get name, version powershell "Get-WmiObject- class Win32_Product | Select-Object -Property name,version"
5. Query port list
netstat -ano Update port is 8530 DNS server 53 port
6. Query patch list
systeminfo can also determine whether there is a domain
wmic qfe get description, installedon through this command
7. Query the local share
net share
net share \hostname
wmic share get name, path, status The sharing of domain classes is often the same
8. Query firewall configuration
netsh firewall show config to
turn off the firewall
A. Windows Server 2003 and previous versions
netsh firewall set opmode disable
B. Windows Server 2003 and later versions
netsh advfirewall set allprofiles state off
Customize the firewall log storage location
netsh advfirewall set currentprofile logging filename "C:\windows \temp\fw.log"
A. Windows Server 2003 and previous versions, allowing all specified programs to connect to
netsh firewall add allowedprogram c:\nc.exe "allow nc" enable
B. Windows Server 2003 and later versions
allow specified programs to be connected
netsh advfirewall firewall add rule name="pass nc" dir=in action=allow program="C:\nc.exe"
allows the specified program to connect out
netsh advfirewall firewall add rule name="Allow nc" dir=out action=allow program = "C: \nc.exe"
C. Allow port 3389 to allow
netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow
9. Query and enable remote connection service
Query remote connection port
Reg query "hkey_local_machine\system\currentcontrolset\control\terminal server\winstations\RDP-Tcp" /v portnumber
10. Query the host in the domain
net view /domain:hacker
11. Query the current authority
whoami /all Get the domain SID
net user XXX /domain Query the detailed information of a specified account