命令行下的信息搜集
使用wmic识别安装到系统中的补丁情况
1 |
C:> wmic qfe get description,installedOn |
识别正在运行的服务
1 2 |
C:>sc query type= service C:>net start |
识别开机启动的程序,包括路径
1 |
C:>wmic startup list full |
ping探测存活主机
1 |
D:>for /L %I in (100,1,254) DO @ping -w 1 -n 1 10.18.180.%I | findstr "TTL=" >> pinglive.txt |
查看系统中网卡的IP地址和MAC地址
1 |
D:>wmic nicconfig get ipaddress,macaddress |
查看当前系统是否有屏保保护,延迟是多少
1 |
D:>wmic desktop get screensaversecure,screensavertimeout |
查看系统中开放的共享
1 2 |
D:>wmic share get name,path D:>net share |
查看系统中开启的日志
1 |
C:>wmic nteventlog get path,filename,writeable |
清除相关的日志(这里是全部清除)
1 2 3 |
wevtutil cl "windows powershell" wevtutil cl "security" wevtutil cl "system" |
查看系统中安装的软件以及版本
1 |
C:>wmic product get name,version |
查看某个进程的详细信息 (路径,命令行参数等)
1 |
C:>wmic process where name="chrome.exe" list full |
终止一个进程
1 2 |
D:>wmic process where name="xshell.exe" call terminate D:>ntsd -c q -p 进程的PID |
显示系统中的曾经连接过的无线密码
1 2 |
D:>netsh wlan show profiles D:>netsh wlan show profiles name="profiles的名字" key=clear |
查看当前系统是否是VMWARE
1 |
C:>wmic bios list full | find /i "vmware" |
文章出处:Evi1cg's blog
原文链接:https://evi1cg.me/archives/Get_Informations.html