Skip to content

Latest commit

 

History

History
111 lines (101 loc) · 10.8 KB

remote.md

File metadata and controls

111 lines (101 loc) · 10.8 KB
Raw
<script type="text/javascript"> $(document).ready(function() { $('div.view').hide(); $('div.slide').click(function() { $(this).next('div.view').slideToggle('fast'); return false; }); }); </script>

Windows Remote Access Commands

Commands that move data and files between systems on a network and are usually executed from the context of the cmd.exe or command.exe prompt.

Miscellaneous

dir

  • Command with arguments: dir \\[computername|ip]\share
  • Description: Must have token to the remote system. See net use below to establish such a connection. Displays the contents of the remote computer's share.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Users\johndoe>dir \\192.168.10.34\c$

Volume in drive \192.168.10.34\c$ has no label. Volume Serial Number is 1A09-5F16
Directory of \192.168.10.34\c$
09/18/2006 05:43 PM 24 autoexec.bat 09/18/2006 05:43 PM 10 config.sys 01/19/2008 05:40 AM

PerfLogs 10/08/2013 07:36 PM Program Files 10/23/2013 08:20 PM temp 10/10/2013 08:59 PM Users 10/23/2013 08:38 PM Windows 2 File(s) 34 bytes 5 Dir(s) 33,316,192,256 bytes free

qprocess

  • Command with arguments: qprocess * [/SERVER:computername]
  • Description: Shows information about processes locally or remotely if you provide the computername or IP.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Users\johndoe>qprocess * /SERVER:192.168.1.2

USERNAME SESSIONNAME ID PID IMAGE (unknown) services 0 0 (unknown) services 0 4 system (unknown) services 0 268 smss.exe (unknown) services 0 356 csrss.exe (unknown) services 0 408 wininit.exe

(unknown) console 1 420 csrss.exe (unknown) console 1 460 winlogon.exe (unknown) services 0 516 services.exe johndoe console 1 1584 dwm.exe johndoe console 1 1600 explorer.exe (unknown) services 0 1708 vmtoolsd.exe johndoe console 1 1936 vmwaretray.exe johndoe console 1 1944 vmtoolsd.exe (unknown) services 0 316 tpautoconnsv... johndoe console 1 1716 tpautoconnec... johndoe console 1 1680 conhost.exe (unknown) services 0 1984 searchindexe... (unknown) services 0 2076 msdtc.exe (unknown) services 0 2844 svchost.exe (unknown) services 0 2920 sppsvc.exe (unknown) services 0 2976 svchost.exe johndoe console 1 3576 cmd.exe johndoe console 1 3540 conhost.exe johndoe console 1 2340 cmd.exe johndoe console 1 1560 conhost.exe johndoe console 1 3616 qprocess.exe

qwinsta

  • Command with arguments: qwinsta [/SERVER:computername]
  • Description: Shows information about Remote Desktop Sessions locally or remotely if you provide the computername or IP.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Users\johndoe>qwinsta
      SESSIONNAME USERNAME ID STATE TYPE DEVICE
      services 0 Disc
      >console johndoe 1 Active
      rdp-tcp 65536 Listen

Remote Assistance Enable

  • Command with arguments: reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fAllowToGetHelp /t REG_DWORD /d 1 /f
  • Description: Must be admin to run this. Enable remote assistance through adding a registry entry on the local system.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Windows\system32>reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

The operation completed successfully.

Remote Desktop Enable

  • Command with arguments: reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f
  • Description: Must be admin to run this. Enable remote desktop through adding a registry entry on the local system.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Windows\system32>reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

The operation completed successfully.

tasklist

  • Command with arguments: tasklist /v /s [computername|IP]
  • Description: Retrieve the current running processes from the remote system. Microsoft manual.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Windows\system32>tasklist /V /S 192.168.10.34
      Type the password for WIN-V32NJ7H3AQE\johndoe:************************


      Image Name PID Session Name Session# Mem Usage User Name CPU Time
      ========================= ======== ================ =========== ============ ================================================== ============
      System Idle Process 0 0 24 K N/A 4:01:47
      System 4 0 2,244 K N/A 0:00:13
      smss.exe 388 0 696 K NT AUTHORITY\SYSTEM 0:00:00
      csrss.exe 452 0 4,992 K NT AUTHORITY\SYSTEM 0:00:01
      csrss.exe 492 1 10,800 K NT AUTHORITY\SYSTEM 0:00:17
      wininit.exe 500 0 3,740 K NT AUTHORITY\SYSTEM 0:00:00
      winlogon.exe 532 1 4,244 K NT AUTHORITY\SYSTEM 0:00:00
      services.exe 580 0 7,308 K NT AUTHORITY\SYSTEM 0:00:03
      lsass.exe 592 0 36,968 K NT AUTHORITY\SYSTEM 0:00:06
      lsm.exe 600 0 5,128 K NT AUTHORITY\SYSTEM 0:00:00
      svchost.exe 840 0 6,576 K NT AUTHORITY\SYSTEM 0:00:02
      svchost.exe 908 0 6,652 K NT AUTHORITY\NETWORK SERVICE 0:00:00
      svchost.exe 984 0 7,976 K NT AUTHORITY\LOCAL SERVICE 0:00:02
      svchost.exe 1036 0 7,992 K NT AUTHORITY\SYSTEM 0:00:00
      svchost.exe 1056 0 26,740 K NT AUTHORITY\SYSTEM 0:00:08
      SLsvc.exe 1072 0 11,280 K NT AUTHORITY\NETWORK SERVICE 0:00:12
      svchost.exe 1124 0 9,720 K NT AUTHORITY\LOCAL SERVICE 0:00:01
      svchost.exe 1184 0 8,888 K NT AUTHORITY\SYSTEM 0:00:01
      svchost.exe 1208 0 15,332 K NT AUTHORITY\NETWORK SERVICE 0:00:01
      svchost.exe 1368 0 10,140 K NT AUTHORITY\LOCAL SERVICE 0:00:00
      taskeng.exe 1572 0 7,024 K NT AUTHORITY\SYSTEM 0:00:00
      spoolsv.exe 1680 0 9,892 K NT AUTHORITY\SYSTEM 0:00:00
      dfsrs.exe 1732 0 8,608 K NT AUTHORITY\SYSTEM 0:00:00
      dns.exe 1756 0 39,456 K NT AUTHORITY\SYSTEM 0:00:00

net

net time

  • Command with arguments: net time \\[computername|ip]
  • Description: Display the time from the remote system.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Users\johndoe>net time \\192.168.10.34

Current time at \192.168.10.34 is 10/23/2013 9:03:04 PM
The command completed successfully.

net use

  • Command with arguments: net use \\[computername|ip] [/user:DOMAIN\USERNAME] [password]
  • Description: Create a connection to the remote computer. This maps IPC$ which does not show up as a drive but allows you to access the remote system as the current user. If the user you launch the command as is not valid on the remote system you will need to specify a valid DOMAIN\USER and PASSWORD. This is useful when you have credentials from somewhere and wish to use them but do not have an active token on a machine you have a session on.
  • Output:
    • **Windows 2008:** Show/Hide
      C:\Users\johndoe>net use \\192.168.10.34 /user:lab\johndoe

The password or user name is invalid for \192.168.10.34.
Enter the password for 'lab\johndoe' to connect to '192.168.10.34': The command completed successfully.