Remove | Scripting and security

Bash PowerShell

How to make an offline mirror copy of a website with WSL (Windows Subsystem for Linux)?

(No Ratings Yet)

bash -c "wget --mirror --convert-links --html-extension --wait=2 -o log https://www.jesusninoc.com"

1	bash -c "wget --mirror --convert-links --html-extension --wait=2 -o log https://www.jesusninoc.com"

--mirror
    Turn on options suitable for mirroring. This option turns on 
    recursion and time-stamping, sets infinite recursion depth,
    and keeps FTP directory listings. It is currently equivalent to 
    ‘-r -N -l inf --no-remove-listing’. 

--convert-links
    After the download is complete, convert the links in the document
    to make them suitable for local viewing.

--html-extension

-o foo
    write "log" output to a file named "foo"

--wait=seconds
    Wait the specified number of seconds between the retrievals.
    Use of this option is recommended, as it lightens the server load 
    by making the requests less frequent.

--mirror

Turn on options suitable for mirroring. This option turns on

recursion and time-stamping, sets infinite recursion depth,

and keeps FTP directory listings. It is currently equivalent to

‘-r -N -l inf --no-remove-listing’.

--convert-links

After the download is complete, convert the links in the document

to make them suitable for local viewing.

--html-extension

-o foo

write "log" output to a file named "foo"

--wait=seconds

Wait the specified number of seconds between the retrievals.

Use of this option is recommended, as it lightens the server load

by making the requests less frequent.

PowerShell

Registrar y mostrar un evento en PowerShell cuando se ejecuta un programa

(2 votes, average: 3.00 out of 5)

#Ejecutar PowerShell como administrador
while(1)
{
Get-Event | Remove-Event -ErrorAction SilentlyContinue
#Registrar el evento de ejecutar notepad
Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStartTrace"
Wait-Event -OutVariable Event | Out-Null
$Event
}

#Ejecutar PowerShell como administrador

while(1)

{

Get-Event | Remove-Event -ErrorAction SilentlyContinue

#Registrar el evento de ejecutar notepad

Wait-Event -OutVariable Event | Out-Null

$Event

}

PowerShell Security

Registrar un evento y mostrar un mensaje en PowerShell cuando se ejecutan varios programas

(No Ratings Yet)

#Ejecutar PowerShell como administrador
while(1)
{
Get-Event | Remove-Event -ErrorAction SilentlyContinue
#Registrar el evento de ejecutar notepad
Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='notepad.exe' or ProcessName='chrome.exe'"
Wait-Event -OutVariable Event | Out-Null
$Event.sourceargs.newevent | select-Object ProcessName,TIME_CREATED
}

#Ejecutar PowerShell como administrador

while(1)

{

Get-Event | Remove-Event -ErrorAction SilentlyContinue

#Registrar el evento de ejecutar notepad

Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='notepad.exe' or ProcessName='chrome.exe'"

Wait-Event -OutVariable Event | Out-Null

$Event.sourceargs.newevent | select-Object ProcessName,TIME_CREATED

}

PowerShell Security

Registrar un evento y mostrar un mensaje en PowerShell cuando se ejecuta un programa

(No Ratings Yet)

#Ejecutar PowerShell como administrador
while(1)
{
Get-Event | Remove-Event -ErrorAction SilentlyContinue
#Registrar el evento de ejecutar notepad
Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='notepad.exe'"
Wait-Event -OutVariable Event | Out-Null
$Event.sourceargs.newevent | select-Object ProcessName,TIME_CREATED
}

#Ejecutar PowerShell como administrador

while(1)

{

Get-Event | Remove-Event -ErrorAction SilentlyContinue

#Registrar el evento de ejecutar notepad

Wait-Event -OutVariable Event | Out-Null

$Event.sourceargs.newevent | select-Object ProcessName,TIME_CREATED

}

PowerShell

Windows PowerShell aliases

(No Ratings Yet)

Alias           % -> ForEach-Object                                                   
Alias           ? -> Where-Object                                                     
Alias           ac -> Add-Content                                                     
Alias           asnp -> Add-PSSnapin                                                  
Alias           cat -> Get-Content                                                    
Alias           cd -> Set-Location                                                    
Alias           CFS -> ConvertFrom-String
Alias           chdir -> Set-Location                                                 
Alias           clc -> Clear-Content                                                  
Alias           clear -> Clear-Host                                                   
Alias           clhy -> Clear-History                                                 
Alias           cli -> Clear-Item                                                     
Alias           clp -> Clear-ItemProperty                                             
Alias           cls -> Clear-Host                                                     
Alias           clv -> Clear-Variable                                                 
Alias           cnsn -> Connect-PSSession                                             
Alias           compare -> Compare-Object                                             
Alias           copy -> Copy-Item                                                     
Alias           cp -> Copy-Item                                                       
Alias           cpi -> Copy-Item                                                      
Alias           cpp -> Copy-ItemProperty                                              
Alias           curl -> Invoke-WebRequest                                             
Alias           cvpa -> Convert-Path                                                  
Alias           dbp -> Disable-PSBreakpoint                                           
Alias           del -> Remove-Item                                                    
Alias           diff -> Compare-Object                                                
Alias           dir -> Get-ChildItem                                                  
Alias           dnsn -> Disconnect-PSSession                                          
Alias           ebp -> Enable-PSBreakpoint                                            
Alias           echo -> Write-Output                                                  
Alias           epal -> Export-Alias                                                  
Alias           epcsv -> Export-Csv                                                   
Alias           epsn -> Export-PSSession                                              
Alias           erase -> Remove-Item                                                  
Alias           etsn -> Enter-PSSession                                               
Alias           exsn -> Exit-PSSession                                                
Alias           fc -> Format-Custom                                                   
Alias           fhx -> Format-Hex
Alias           fl -> Format-List                                                     
Alias           foreach -> ForEach-Object                                             
Alias           ft -> Format-Table                                                    
Alias           fw -> Format-Wide                                                     
Alias           gal -> Get-Alias                                                      
Alias           gbp -> Get-PSBreakpoint                                               
Alias           gc -> Get-Content                                                     
Alias           gci -> Get-ChildItem                                                  
Alias           gcm -> Get-Command                                                    
Alias           gcs -> Get-PSCallStack                                                
Alias           gdr -> Get-PSDrive                                                    
Alias           ghy -> Get-History                                                    
Alias           gi -> Get-Item                                                        
Alias           gjb -> Get-Job                                                        
Alias           gl -> Get-Location                                                    
Alias           gm -> Get-Member                                                      
Alias           gmo -> Get-Module                                                     
Alias           gp -> Get-ItemProperty                                                
Alias           gps -> Get-Process                                                    
Alias           gpv -> Get-ItemPropertyValue                                          
Alias           group -> Group-Object                                                 
Alias           gsn -> Get-PSSession                                                  
Alias           gsnp -> Get-PSSnapin                                                  
Alias           gsv -> Get-Service                                                    
Alias           gu -> Get-Unique                                                      
Alias           gv -> Get-Variable                                                    
Alias           gwmi -> Get-WmiObject                                                 
Alias           h -> Get-History                                                      
Alias           history -> Get-History                                                
Alias           icm -> Invoke-Command                                                 
Alias           iex -> Invoke-Expression                                              
Alias           ihy -> Invoke-History                                                 
Alias           ii -> Invoke-Item                                                     
Alias           ipal -> Import-Alias                                                  
Alias           ipcsv -> Import-Csv                                                   
Alias           ipmo -> Import-Module                                                 
Alias           ipsn -> Import-PSSession                                              
Alias           irm -> Invoke-RestMethod                                              
Alias           ise -> powershell_ise.exe                                             
Alias           iwmi -> Invoke-WMIMethod                                              
Alias           iwr -> Invoke-WebRequest                                              
Alias           kill -> Stop-Process                                                  
Alias           lp -> Out-Printer                                                     
Alias           ls -> Get-ChildItem                                                   
Alias           man -> help                                                           
Alias           md -> mkdir                                                           
Alias           measure -> Measure-Object                                             
Alias           mi -> Move-Item                                                       
Alias           mount -> New-PSDrive                                                  
Alias           move -> Move-Item                                                     
Alias           mp -> Move-ItemProperty                                               
Alias           mv -> Move-Item                                                       
Alias           nal -> New-Alias                                                      
Alias           ndr -> New-PSDrive                                                    
Alias           ni -> New-Item                                                        
Alias           nmo -> New-Module                                                     
Alias           npssc -> New-PSSessionConfigurationFile                               
Alias           nsn -> New-PSSession                                                  
Alias           nv -> New-Variable                                                    
Alias           ogv -> Out-GridView                                                   
Alias           oh -> Out-Host                                                        
Alias           popd -> Pop-Location                                                  
Alias           ps -> Get-Process                                                     
Alias           pushd -> Push-Location                                                
Alias           pwd -> Get-Location                                                   
Alias           r -> Invoke-History                                                   
Alias           rbp -> Remove-PSBreakpoint                                            
Alias           rcjb -> Receive-Job                                                   
Alias           rcsn -> Receive-PSSession                                             
Alias           rd -> Remove-Item                                                     
Alias           rdr -> Remove-PSDrive                                                 
Alias           ren -> Rename-Item                                                    
Alias           ri -> Remove-Item                                                     
Alias           rjb -> Remove-Job                                                     
Alias           rm -> Remove-Item                                                     
Alias           rmdir -> Remove-Item                                                  
Alias           rmo -> Remove-Module                                                  
Alias           rni -> Rename-Item                                                    
Alias           rnp -> Rename-ItemProperty                                            
Alias           rp -> Remove-ItemProperty                                             
Alias           rsn -> Remove-PSSession                                               
Alias           rsnp -> Remove-PSSnapin                                               
Alias           rujb -> Resume-Job                                                    
Alias           rv -> Remove-Variable                                                 
Alias           rvpa -> Resolve-Path                                                  
Alias           rwmi -> Remove-WMIObject                                              
Alias           sajb -> Start-Job                                                     
Alias           sal -> Set-Alias                                                      
Alias           saps -> Start-Process                                                 
Alias           sasv -> Start-Service                                                 
Alias           sbp -> Set-PSBreakpoint                                               
Alias           sc -> Set-Content                                                     
Alias           select -> Select-Object                                               
Alias           set -> Set-Variable                                                   
Alias           shcm -> Show-Command                                                  
Alias           si -> Set-Item                                                        
Alias           sl -> Set-Location                                                    
Alias           sleep -> Start-Sleep                                                  
Alias           sls -> Select-String                                                  
Alias           sort -> Sort-Object                                                   
Alias           sp -> Set-ItemProperty                                                
Alias           spjb -> Stop-Job                                                      
Alias           spps -> Stop-Process                                                  
Alias           spsv -> Stop-Service                                                  
Alias           start -> Start-Process                                                
Alias           sujb -> Suspend-Job                                                   
Alias           sv -> Set-Variable                                                    
Alias           swmi -> Set-WMIInstance                                               
Alias           tee -> Tee-Object                                                     
Alias           trcm -> Trace-Command                                                 
Alias           type -> Get-Content                                                   
Alias           wget -> Invoke-WebRequest                                             
Alias           where -> Where-Object                                                 
Alias           wjb -> Wait-Job                                                       
Alias           write -> Write-Output

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

Alias % -> ForEach-Object

Alias ? -> Where-Object

Alias ac -> Add-Content

Alias asnp -> Add-PSSnapin

Alias cat -> Get-Content

Alias cd -> Set-Location

Alias CFS -> ConvertFrom-String

Alias chdir -> Set-Location

Alias clc -> Clear-Content

Alias clear -> Clear-Host

Alias clhy -> Clear-History

Alias cli -> Clear-Item

Alias clp -> Clear-ItemProperty

Alias cls -> Clear-Host

Alias clv -> Clear-Variable

Alias cnsn -> Connect-PSSession

Alias compare -> Compare-Object

Alias copy -> Copy-Item

Alias cp -> Copy-Item

Alias cpi -> Copy-Item

Alias cpp -> Copy-ItemProperty

Alias curl -> Invoke-WebRequest

Alias cvpa -> Convert-Path

Alias dbp -> Disable-PSBreakpoint

Alias del -> Remove-Item

Alias diff -> Compare-Object

Alias dir -> Get-ChildItem

Alias dnsn -> Disconnect-PSSession

Alias ebp -> Enable-PSBreakpoint

Alias echo -> Write-Output

Alias epal -> Export-Alias

Alias epcsv -> Export-Csv

Alias epsn -> Export-PSSession

Alias erase -> Remove-Item

Alias etsn -> Enter-PSSession

Alias exsn -> Exit-PSSession

Alias fc -> Format-Custom

Alias fhx -> Format-Hex

Alias fl -> Format-List

Alias foreach -> ForEach-Object

Alias ft -> Format-Table

Alias fw -> Format-Wide

Alias gal -> Get-Alias

Alias gbp -> Get-PSBreakpoint

Alias gc -> Get-Content

Alias gci -> Get-ChildItem

Alias gcm -> Get-Command

Alias gcs -> Get-PSCallStack

Alias gdr -> Get-PSDrive

Alias ghy -> Get-History

Alias gi -> Get-Item

Alias gjb -> Get-Job

Alias gl -> Get-Location

Alias gm -> Get-Member

Alias gmo -> Get-Module

Alias gp -> Get-ItemProperty

Alias gps -> Get-Process

Alias gpv -> Get-ItemPropertyValue

Alias group -> Group-Object

Alias gsn -> Get-PSSession

Alias gsnp -> Get-PSSnapin

Alias gsv -> Get-Service

Alias gu -> Get-Unique

Alias gv -> Get-Variable

Alias gwmi -> Get-WmiObject

Alias h -> Get-History

Alias history -> Get-History

Alias icm -> Invoke-Command

Alias iex -> Invoke-Expression

Alias ihy -> Invoke-History

Alias ii -> Invoke-Item

Alias ipal -> Import-Alias

Alias ipcsv -> Import-Csv

Alias ipmo -> Import-Module

Alias ipsn -> Import-PSSession

Alias irm -> Invoke-RestMethod

Alias ise -> powershell_ise.exe

Alias iwmi -> Invoke-WMIMethod

Alias iwr -> Invoke-WebRequest

Alias kill -> Stop-Process

Alias lp -> Out-Printer

Alias ls -> Get-ChildItem

Alias man -> help

Alias md -> mkdir

Alias measure -> Measure-Object

Alias mi -> Move-Item

Alias mount -> New-PSDrive

Alias move -> Move-Item

Alias mp -> Move-ItemProperty

Alias mv -> Move-Item

Alias nal -> New-Alias

Alias ndr -> New-PSDrive

Alias ni -> New-Item

Alias nmo -> New-Module

Alias npssc -> New-PSSessionConfigurationFile

Alias nsn -> New-PSSession

Alias nv -> New-Variable

Alias ogv -> Out-GridView

Alias oh -> Out-Host

Alias popd -> Pop-Location

Alias ps -> Get-Process

Alias pushd -> Push-Location

Alias pwd -> Get-Location

Alias r -> Invoke-History

Alias rbp -> Remove-PSBreakpoint

Alias rcjb -> Receive-Job

Alias rcsn -> Receive-PSSession

Alias rd -> Remove-Item

Alias rdr -> Remove-PSDrive

Alias ren -> Rename-Item

Alias ri -> Remove-Item

Alias rjb -> Remove-Job

Alias rm -> Remove-Item

Alias rmdir -> Remove-Item

Alias rmo -> Remove-Module

Alias rni -> Rename-Item

Alias rnp -> Rename-ItemProperty

Alias rp -> Remove-ItemProperty

Alias rsn -> Remove-PSSession

Alias rsnp -> Remove-PSSnapin

Alias rujb -> Resume-Job

Alias rv -> Remove-Variable

Alias rvpa -> Resolve-Path

Alias rwmi -> Remove-WMIObject

Alias sajb -> Start-Job

Alias sal -> Set-Alias

Alias saps -> Start-Process

Alias sasv -> Start-Service

Alias sbp -> Set-PSBreakpoint

Alias sc -> Set-Content

Alias select -> Select-Object

Alias set -> Set-Variable

Alias shcm -> Show-Command

Alias si -> Set-Item

Alias sl -> Set-Location

Alias sleep -> Start-Sleep

Alias sls -> Select-String

Alias sort -> Sort-Object

Alias sp -> Set-ItemProperty

Alias spjb -> Stop-Job

Alias spps -> Stop-Process

Alias spsv -> Stop-Service

Alias start -> Start-Process

Alias sujb -> Suspend-Job

Alias sv -> Set-Variable

Alias swmi -> Set-WMIInstance

Alias tee -> Tee-Object

Alias trcm -> Trace-Command

Alias type -> Get-Content

Alias wget -> Invoke-WebRequest

Alias where -> Where-Object

Alias wjb -> Wait-Job

Alias write -> Write-Output

PowerShell

9. Gestión de la red en PowerShell (nivel intermedio)

(4 votes, average: 4.00 out of 5)

Capa física Adaptadores de red Información sobre los adaptadores de red Información avanzada sobre los adaptadores de red Habilitar un […]

PowerShell

8. Gestión de usuarios en PowerShell (nivel intermedio)

(18 votes, average: 2.78 out of 5)

Características Cuenta de usuario Listas de control de acceso Control de cuentas de usuario Ejecutar como Perfil de usuario Directivas […]

PowerShell

6. Virtualización en PowerShell (nivel intermedio)

(No Ratings Yet)

Máquinas virtuales Listar hosts virtuales Ver propiedades del host virtual Crear host virtual Actualizar propiedades de la máquina virtual Arrancar […]

PowerShell

4. Gestión del sistema de archivos en PowerShell (nivel intermedio)

(6 votes, average: 4.33 out of 5)

Discos Discos físicos Información sobre discos físicos Crear una partición Dar formato Discos virtuales Crear discos virtual Montar un disco […]

PowerShell

2. Programación en PowerShell (nivel intermedio)

(2 votes, average: 5.00 out of 5)

Variables Constantes Ámbito Tipos Tipos simples Numéricas Caracteres Fechas Arrays Arrays de números Arrays de caracteres (cadenas) Concatenar Determinar longitud […]

Filesystem Hardware Network Users

Rundll32 commands for Windows

(2 votes, average: 5.00 out of 5)

# Control Panel
RunDll32.exe shell32.dll,Control_RunDLL

# Delete Temporary Internet Files
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

# Delete Cookies
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

# Delete History
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1

# Delete Form Data
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16

# Delete Passwords
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32

# Delete All
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255

# Delete all files and settings stored by Add-ons
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

# Date and Time Properties
RunDll32.exe shell32.dll,Control_RunDLL timedate.cpl

# Device Manager
RunDll32.exe devmgr.dll DeviceManager_Execute

# Folder Options – General
RunDll32.exe shell32.dll,Options_RunDLL 0

# Folder Options – Search
RunDll32.exe shell32.dll,Options_RunDLL 2

# Folder Options – View
RunDll32.exe shell32.dll,Options_RunDLL 7

# Hibernate
RunDll32.exe powrprof.dll,SetSuspendState

# Keyboard Properties
RunDll32.exe shell32.dll,Control_RunDLL main.cpl @1

# Lock Screen
RunDll32.exe user32.dll,LockWorkStation

# Mouse Button – Swap left button to function as right
Rundll32 User32.dll,SwapMouseButton

# Map Network Drive Wizard
Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL Connect

# Network Connections
RunDll32.exe shell32.dll,Control_RunDLL ncpa.cpl

# Organize IE Favourites
Rundll32.exe shdocvw.dll,DoOrganizeFavDlg

# Open With Dialog Box
Rundll32 Shell32.dll,OpenAs_RunDLL File.ext

# Plays a waveform sound
rundll32.exe user32.dll,MessageBeep

# Printer User Interface
Rundll32 Printui.dll,PrintUIEntry

# Printer Management Folder.
Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

# Power Options
RunDll32.exe Shell32.dll,Control_RunDLL powercfg.cpl

# Stored Usernames and Passwords
RunDll32.exe keymgr.dll,KRShowKeyMgr

# Safely Remove Hardware Dialog Box
Rundll32 Shell32.dll,Control_RunDLL HotPlug.dll

# Taskbar Properties
RunDll32.exe shell32.dll,Options_RunDLL 1

# User Accounts
RunDll32.exe shell32.dll,Control_RunDLL nusrmgr.cpl

# Windows Security Center
RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

# Windows Fonts Installation Folder
Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL FontsFolder

# Windows Firewall
RunDll32.exe shell32.dll,Control_RunDLL firewall.cpl

# Abrir la calculadora
rundll32 zipfldr.dll, RouteTheCall calc.exe
rundll32 advpack.dll, RegisterOCX calc.exe
rundll32 c:\Windows\System32\pcwutl.dll,LaunchApplication calc.exe

# You looking out for that "RegisterOCX" function in IEAdvpack.dll?  
rundll32.exe C:\windows\system32\IEAdvpack.dll,RegisterOCX C:\path\to\payload.dll
rundll32.exe C:\windows\system32\IEAdvpack.dll,RegisterOCX C:\path\to\payload.exe
rundll32.exe IEAdvpack.dll,RegisterOCX calc.exe

# Llame al Asistente de conexión de la unidad de red
rundll32.exe shell32.dll, SHHelpShortcuts_RunDLL Connect

# Abra un cuadro de diálogo que muestra la versión del sistema operativo Windows. También puede mostrar este cuadro de diálogo ejecutando el comando winver.exe
rundll32.exe shell32.dll, ShellAboutA

# Muestra el árbol del sistema de archivos del disco duro de la computadora
rundll32.exe IEAKENG.dll, BrowseForFileA

# Llame al cuadro de diálogo AYUDA Y SOPORTE en la página especificada. Por ejemplo, puede usar la llamada mshelp como la página html: // Windows /? Id = 33307acf-0698-41ba-b014-ea0a2eb8d0a8
rundll32.exe ndfapi.dll, NdfRunDllHelpTopic "html-page"

# Llame al diálogo ABRIR COMO ... para abrir este archivo
rundll32.exe shell32.dll, OpenAs_RunDLL "ruta y nombre de archivo"

# Muestra el cuadro de diálogo de la utilidad de red del cliente de SQL Server
rundll32.exe shell32.dll, Control_RunDLL Cliconfg.dll

# Muestra el cuadro de diálogo Eliminar dispositivo
rundll32.exe shell32.dll, Control_RunDLL Hotplug.dll

# Reescribe el contenido de este archivo
rundll32.exe admparse.dll, CheckDuplicateKeysA "ruta y nombre de archivo"

# Crea una carpeta. Si esta carpeta ya existe, se borrarán todos sus contenidos
rundll32.exe IEAKENG.dll, BToolbar_SaveA "ruta a la carpeta"

# Inicia el navegador de Internet Explorer y descarga la página http://g.msn.com/WMHFUSEN/101724
rundll32.exe appwiz.cpl, GetProgramsOnline

# Ejecuta el comando
rundll32.exe shell32.dll, ShellExec_RunDLL "comando"

# Abra la carpeta. Si no especifica una carpeta, se abrirá la carpeta de su perfil
rundll32.exe url.dll, FileProtocolHandler "directorio"

# Elimina todos los archivos de la carpeta especificada que tienen el atributo FILEATTRIBUTETAGINFORMATION
rundll32.exe WININET.dll, RunOnceUrlCache "ruta a la carpeta"

# Ejecute el archivo xml
rundll32.exe xwizards.dll, ProcessXMLFile "ruta y nombre del archivo xml"

# Presiona el botón derecho del mouse
rundll32.exe user32.dll, mouse_event

# Coloque el cursor en la esquina inferior derecha de la pantalla
rundll32.exe user32.dll, SetCursorPos

# Detener el servicio de actualización en segundo plano dfsvc.exe
rundll32.exe dfshim.dll, KillService

# Ejecuta los comandos descritos en la rama de registro HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunOnceEx (o en la rama de la partición raíz HKCU)
rundll32.exe IERNONCE.dll, RunOnceExProcess

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

# Control Panel

RunDll32.exe shell32.dll,Control_RunDLL

# Delete Temporary Internet Files

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

# Delete Cookies

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

# Delete History

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1

# Delete Form Data

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16

# Delete Passwords

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32

# Delete All

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255

# Delete all files and settings stored by Add-ons

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

# Date and Time Properties

RunDll32.exe shell32.dll,Control_RunDLL timedate.cpl

# Device Manager

RunDll32.exe devmgr.dll DeviceManager_Execute

# Folder Options – General

RunDll32.exe shell32.dll,Options_RunDLL 0

# Folder Options – Search

RunDll32.exe shell32.dll,Options_RunDLL 2

# Folder Options – View

RunDll32.exe shell32.dll,Options_RunDLL 7

# Hibernate

RunDll32.exe powrprof.dll,SetSuspendState

# Keyboard Properties

RunDll32.exe shell32.dll,Control_RunDLL main.cpl @1

# Lock Screen

RunDll32.exe user32.dll,LockWorkStation

# Mouse Button – Swap left button to function as right

Rundll32 User32.dll,SwapMouseButton

# Map Network Drive Wizard

Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL Connect

# Network Connections

RunDll32.exe shell32.dll,Control_RunDLL ncpa.cpl

# Organize IE Favourites

Rundll32.exe shdocvw.dll,DoOrganizeFavDlg

# Open With Dialog Box

Rundll32 Shell32.dll,OpenAs_RunDLL File.ext

# Plays a waveform sound

rundll32.exe user32.dll,MessageBeep

# Printer User Interface

Rundll32 Printui.dll,PrintUIEntry

# Printer Management Folder.

Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

# Power Options

RunDll32.exe Shell32.dll,Control_RunDLL powercfg.cpl

# Stored Usernames and Passwords

RunDll32.exe keymgr.dll,KRShowKeyMgr

# Safely Remove Hardware Dialog Box

Rundll32 Shell32.dll,Control_RunDLL HotPlug.dll

# Taskbar Properties

RunDll32.exe shell32.dll,Options_RunDLL 1

# User Accounts

RunDll32.exe shell32.dll,Control_RunDLL nusrmgr.cpl

# Windows Security Center

RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

# Windows Fonts Installation Folder

Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL FontsFolder

# Windows Firewall

RunDll32.exe shell32.dll,Control_RunDLL firewall.cpl

# Abrir la calculadora

rundll32 zipfldr.dll, RouteTheCall calc.exe

rundll32 advpack.dll, RegisterOCX calc.exe

rundll32 c:\Windows\System32\pcwutl.dll,LaunchApplication calc.exe

# You looking out for that "RegisterOCX" function in IEAdvpack.dll?

rundll32.exe C:\windows\system32\IEAdvpack.dll,RegisterOCX C:\path\to\payload.dll

rundll32.exe C:\windows\system32\IEAdvpack.dll,RegisterOCX C:\path\to\payload.exe

rundll32.exe IEAdvpack.dll,RegisterOCX calc.exe

# Llame al Asistente de conexión de la unidad de red

rundll32.exe shell32.dll, SHHelpShortcuts_RunDLL Connect

# Abra un cuadro de diálogo que muestra la versión del sistema operativo Windows. También puede mostrar este cuadro de diálogo ejecutando el comando winver.exe

rundll32.exe shell32.dll, ShellAboutA

# Muestra el árbol del sistema de archivos del disco duro de la computadora

rundll32.exe IEAKENG.dll, BrowseForFileA

# Llame al cuadro de diálogo AYUDA Y SOPORTE en la página especificada. Por ejemplo, puede usar la llamada mshelp como la página html: // Windows /? Id = 33307acf-0698-41ba-b014-ea0a2eb8d0a8

rundll32.exe ndfapi.dll, NdfRunDllHelpTopic "html-page"

# Llame al diálogo ABRIR COMO ... para abrir este archivo

rundll32.exe shell32.dll, OpenAs_RunDLL "ruta y nombre de archivo"

# Muestra el cuadro de diálogo de la utilidad de red del cliente de SQL Server

rundll32.exe shell32.dll, Control_RunDLL Cliconfg.dll

# Muestra el cuadro de diálogo Eliminar dispositivo

rundll32.exe shell32.dll, Control_RunDLL Hotplug.dll

# Reescribe el contenido de este archivo

rundll32.exe admparse.dll, CheckDuplicateKeysA "ruta y nombre de archivo"

# Crea una carpeta. Si esta carpeta ya existe, se borrarán todos sus contenidos

rundll32.exe IEAKENG.dll, BToolbar_SaveA "ruta a la carpeta"

# Inicia el navegador de Internet Explorer y descarga la página http://g.msn.com/WMHFUSEN/101724

rundll32.exe appwiz.cpl, GetProgramsOnline

# Ejecuta el comando

rundll32.exe shell32.dll, ShellExec_RunDLL "comando"

# Abra la carpeta. Si no especifica una carpeta, se abrirá la carpeta de su perfil

rundll32.exe url.dll, FileProtocolHandler "directorio"

# Elimina todos los archivos de la carpeta especificada que tienen el atributo FILEATTRIBUTETAGINFORMATION

rundll32.exe WININET.dll, RunOnceUrlCache "ruta a la carpeta"

# Ejecute el archivo xml

rundll32.exe xwizards.dll, ProcessXMLFile "ruta y nombre del archivo xml"

# Presiona el botón derecho del mouse

rundll32.exe user32.dll, mouse_event

# Coloque el cursor en la esquina inferior derecha de la pantalla

rundll32.exe user32.dll, SetCursorPos

# Detener el servicio de actualización en segundo plano dfsvc.exe

rundll32.exe dfshim.dll, KillService

# Ejecuta los comandos descritos en la rama de registro HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunOnceEx (o en la rama de la partición raíz HKCU)

rundll32.exe IERNONCE.dll, RunOnceExProcess

PowerShell Users

Cmdlets relacionados con la gestión de cuentas locales en Windows 10

(No Ratings Yet)

Get-Command -Module Microsoft.PowerShell.LocalAccounts

1	Get-Command -Module Microsoft.PowerShell.LocalAccounts

CommandType     Name                                               Version    Source                                                                                                 
-----------     ----                                               -------    ------                                                                                                 
Cmdlet          Add-LocalGroupMember                               1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Disable-LocalUser                                  1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Enable-LocalUser                                   1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Get-LocalGroup                                     1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Get-LocalGroupMember                               1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Get-LocalUser                                      1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          New-LocalGroup                                     1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          New-LocalUser                                      1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Remove-LocalGroup                                  1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Remove-LocalGroupMember                            1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Remove-LocalUser                                   1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Rename-LocalGroup                                  1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Rename-LocalUser                                   1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Set-LocalGroup                                     1.0.0.0    Microsoft.PowerShell.LocalAccounts                                                                     
Cmdlet          Set-LocalUser                                      1.0.0.0    Microsoft.PowerShell.LocalAccounts

CommandType Name Version Source

----------- ---- ------- ------

Cmdlet Add-LocalGroupMember 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Disable-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Enable-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Get-LocalGroup 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Get-LocalGroupMember 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Get-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet New-LocalGroup 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet New-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Remove-LocalGroup 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Remove-LocalGroupMember 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Remove-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Rename-LocalGroup 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Rename-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Set-LocalGroup 1.0.0.0 Microsoft.PowerShell.LocalAccounts

Cmdlet Set-LocalUser 1.0.0.0 Microsoft.PowerShell.LocalAccounts

PowerShell Users

Eliminar un grupo local en Windows 10 con PowerShell 5.1

(No Ratings Yet)

#Es necesario abrir PowerShell como administrador
Remove-LocalGroup grupo

1 2	#Es necesario abrir PowerShell como administrador Remove-LocalGroup grupo

PowerShell Users

Eliminar un usuario local en Windows 10 con PowerShell 5.1

(No Ratings Yet)

#Es necesario abrir PowerShell como administrador
Remove-LocalUser usuario

1 2	#Es necesario abrir PowerShell como administrador Remove-LocalUser usuario

PowerShell

8. Gestión de usuarios en PowerShell para administradores de sistemas (nivel básico)

(No Ratings Yet)

Los sistemas operativos actuales se pueden utilizar por uno o varios usuarios, en algunos sistemas pueden hacerlo simultáneamente y en […]

PowerShell

6. Virtualización en PowerShell para administradores de sistemas (nivel básico)

(No Ratings Yet)

La virtualización es un conjunto de técnicas hardware y/o software que permiten abstraer hardware y/o software creando la ilusión de […]

Filesystem Permissions PowerShell

4. Gestión de archivos en PowerShell para administradores de sistemas (nivel básico)

(2 votes, average: 3.50 out of 5)

Los sistemas de archivos permiten organizar los datos en los dispositivos de almacenamiento siguiendo una serie de normas y restricciones. […]

PowerShell Security

Windows Post Exploitation Cmdlets Execution (PowerShell)

(5 votes, average: 5.00 out of 5)

Presence This section focuses on information gathering about the victim host and the network that it’s attached to. System

#Shows all current environmental variables
$env:ALLUSERSPROFILE
$env:APPDATA
$env:CommonProgramFiles
${env:CommonProgramFiles(x86)}
$env:CommonProgramW6432
$env:COMPUTERNAME
$env:ComSpec
$env:FP_NO_HOST_CHECK
$env:HOMEDRIVE
$env:HOMEPATH
$env:LOCALAPPDATA
$env:LOGONSERVER
$env:NUMBER_OF_PROCESSORS
$env:OS
$env:Path
$env:PATHEXT
$env:PROCESSOR_ARCHITECTURE
$env:PROCESSOR_IDENTIFIER
$env:PROCESSOR_LEVEL
$env:PROCESSOR_REVISION
$env:ProgramData
$env:ProgramFiles
${env:ProgramFiles(x86)}
$env:ProgramW6432
$env:PSModulePath
$env:PUBLIC
$env:SESSIONNAME
$env:SystemRoot
$env:TEMP
$env:TMP
$env:USERDOMAIN
$env:USERDOMAIN_ROAMINGPROFILE
$env:USERNAME
$env:USERPROFILE
$env:SystemDrive
$env:windir

#Shows all current environmental variables (macOS)
$env:_ 
$env:LOGNAME
$env:SHLVL
$env:TERM_SESSION_ID
$env:PATHEXT
$env:__CF_USER_TEXT_ENCODING
$env:PATH
$env:SSH_AUTH_SOCK
$env:TMPDIR
$env:Apple_PubSub_Socket_Render
$env:PSMODULEPATH
$env:TERM
$env:USER
$env:HOME
$env:PWD
$env:TERM_PROGRAM
$env:XPC_FLAGS
$env:LC_CTYPE
$env:SHELL
$env:TERM_PROGRAM_VERSION
$env:XPC_SERVICE_NAME

#Information about disk
Get-Disk

#Retrieving Process Information
Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process
(Get-Process chrome | Select-Object Threads).Threads
Get-Process | select -expand Threads

#Last Boot Uptime
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system
Get-Process -Module

#Events and event logs on the local and remote
Get-EventLog -LogName System -EntryType Error, Warning
Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

#Shows all current environmental variables

$env:ALLUSERSPROFILE

$env:APPDATA

$env:CommonProgramFiles

${env:CommonProgramFiles(x86)}

$env:CommonProgramW6432

$env:COMPUTERNAME

$env:ComSpec

$env:FP_NO_HOST_CHECK

$env:HOMEDRIVE

$env:HOMEPATH

$env:LOCALAPPDATA

$env:LOGONSERVER

$env:NUMBER_OF_PROCESSORS

$env:OS

$env:Path

$env:PATHEXT

$env:PROCESSOR_ARCHITECTURE

$env:PROCESSOR_IDENTIFIER

$env:PROCESSOR_LEVEL

$env:PROCESSOR_REVISION

$env:ProgramData

$env:ProgramFiles

${env:ProgramFiles(x86)}

$env:ProgramW6432

$env:PSModulePath

$env:PUBLIC

$env:SESSIONNAME

$env:SystemRoot

$env:TEMP

$env:TMP

$env:USERDOMAIN

$env:USERDOMAIN_ROAMINGPROFILE

$env:USERNAME

$env:USERPROFILE

$env:SystemDrive

$env:windir

#Shows all current environmental variables (macOS)

$env:_

$env:LOGNAME

$env:SHLVL

$env:TERM_SESSION_ID

$env:PATHEXT

$env:__CF_USER_TEXT_ENCODING

$env:PATH

$env:SSH_AUTH_SOCK

$env:TMPDIR

$env:Apple_PubSub_Socket_Render

$env:PSMODULEPATH

$env:TERM

$env:USER

$env:HOME

$env:PWD

$env:TERM_PROGRAM

$env:XPC_FLAGS

$env:LC_CTYPE

$env:SHELL

$env:TERM_PROGRAM_VERSION

$env:XPC_SERVICE_NAME

#Information about disk

Get-Disk

#Retrieving Process Information

Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process

(Get-Process chrome | Select-Object Threads).Threads

Get-Process | select -expand Threads

#Last Boot Uptime

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system

Get-Process -Module

#Events and event logs on the local and remote

Get-EventLog -LogName System -EntryType Error, Warning

Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

[…]

Filesystem PowerShell

Eliminar ficheros que contienen una cadena

(No Ratings Yet)

Get-ChildItem D:\prueba | %{if(Get-Content $_.FullName | Select-String "borrar"){Remove-Item $_.FullName -WhatIf}}

1	Get-ChildItem D:\prueba \| %{if(Get-Content $_.FullName \| Select-String "borrar"){Remove-Item $_.FullName -WhatIf}}

Android

ADB Shell Commands

(No Ratings Yet)

The Android Debug Bridge (adb) provides a Unix shell that you can use to run a variety of commands on […]

Older Posts