CyberGuardians

1 - Windows - - Unable to delete registry key? - Use the at command to schedule an interactive registry edit with SYSTEM rights ex. c:\> at 16:00 /interactive regedt32.exe - - Netstat Foo - - C:\> netstat -na 1 | find "[Scan_Host_IP_Addr]" -- Watches for connections/scans - - C:\> netstat -nao 1 | find "[Dest_IP_Addr]" -- Finds the PID generating the traffic - - C:\> netstat -na 1 | find "4444" | find "ESTABLISHED" -- Reports when someone connects - - Get Your Netbios Name Codes http://www.cotse.com/nbcodes.htm - - PSTools Foo - - Remote Shutdown > psexec \\RemotePC -u UserName -p Password shutdown -r -t 1 - - Remote Service Disabling - sc \\ config start= disabled - - MISC - - LM Empty Hash AAD3B435B51404EEAAD3B435B51404EE - - NTLM Empty Hash 31D6CFE0D16AE931B73C59D7E0C089C0 - - Find Resultant Set of Group Policy, rsop.msc - - C:\> write notepad.exe:STR -- allows you to see ADS - - Ping Sweeper - - for /L %i in (1,1,255) do @