Navigating Windows in the most efficient manner possible can be seen as wizardry-- it almost seems as if Microsoft tries to make it increasingly more difficult to accomplish simple things. However, there are plenty of very useful tricks and shortcuts built into Windows, the problem is they are not publicized very well. Students in our Ultimate Hacking Courses usually find these Windows tips useful, so we figured we would share them.
Command shell historyIf you thought “
doskey /history” was cool—this is even better and more useful. Function keys help control and recall the command history in Windows. We have noted the most useful keys and their function below. Try them out for yourself.
F7 – Graphical command shell history After hitting F7, you can use the arrow keys to scroll up and down through the command history and then use the right key in order to edit the command or hit enter to run the command. The screenshot below shows a graphical command history is presented after the user presses F7. This can be navigated via arrow keys.
F1 – Letter by letter repeat of the last command
F2 – Retype letters up to a certain letter
F3 – Retype last command
F4 – Delete characters from the cursor up to a certain character
F5 – Scroll up through command history (same as up arrow)
F9 – Enter the command number you would repeat
Command shell shortcutsAdjusting the command shell to fit your preference can sometimes be a headache (too much clicking for a shell) here are some ways to customize the view without touching the mouse
This is often very useful when running commands whose output extends beyond the 80
character default width of the unaltered command shell.
mode – adjusting the size of the command shell
This screenshot shows you what it looks like to expand the window quickly with
This is very useful when setting different color shells to indicate different
color - Sets the default console foreground and background colors
COLOR [attr] attr Specifies color attribute of console output Color attributes are specified by TWO hex digits -- the first corresponds to the background; the second the foreground. Each digit can be any of the following values: 0 = Black 8 = Gray 1 = Blue 9 = Light Blue 2 = Green A = Light Green 3 = Aqua B = Light Aqua 4 = Red C = Light Red 5 = Purple D = Light Purple 6 = Yellow E = Light Yellow 7 = White F = Bright White If no argument is given, this command restores the color to what it was when CMD.EXE started.
The screenshot below shows two different windows with two different colors with netcat listeners on different ports.
This is also useful for labeling your windows with a title that is easy to remember and
descriptive of what you are working on.
Title - Sets the window title for the command prompt window
TITLE [string] string Specifies the title for the command prompt window.
Let's see what this looks like - the screenshot below shows how to change the title of the window via the command line
findstr – (grep for Windows)
findstrsearches for strings in files [or anything else]. If you wanted grep in Windows, you got it.
findstrhas been present in Windows since XP and 2003. It accepts regular expressions and can search case insensitive (
/I). One of our favorite ways to use this command is for filtering—especially long lists such as process listings and listening ports.
C:\>tasklist | findstr /i EXPLORER explorer.exe 3404 Console 1 119,884 K
C:\>netstat -an | findstr 135 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP [::]:135 [::]:0 LISTENING C:\>netstat -an | findstr 445 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING TCP [::]:445 [::]:0 LISTENING UDP 127.0.0.1:63445 *:*
Prefer WordPad over Notepad at times?
write - the greatest shortcut ever
Want to launch it from the command line, but you hate typing the full path (
c:\Program Files\Windows NT\Accessories\wordpad.exe c:\Program Files (x86)\Windows NT\Accessories\wordpad.exe) to launch it?
How about five letters?
w r i t e
Ever wanted to dump the contents of a particular directory or structure to a text file?
tree – graphical “text” directory listings
treeis the way to go—it is fast and recursive. The “
/F” attribute will list the files in addition to the folders—leave it off and you just get the folders. "
/A" is useful if you are sending output to a text file or other document.
TREE [drive:][path] [/F] [/A] /F Display the names of the files in each folder. /A Use ASCII instead of extended characters. C:\> tree /a /f c:\users Folder PATH listing for volume PSV Volume serial number is 8800-000 C:\USERS +---Tony | | test.exe | | Sti_Trace.log | | | +---Contacts | | Tony.contact | | | +---Desktop | | | cmd.txt | | | fixPrinter.bat | | | malicious.exe | | | research.txt --snip--
If you live in the command line and don’t want to spawn a graphical text editor to read a
simple file, you can always “
type - when you can’t spare the GUI
type” the file. This is similar to “
cat” in *nix. If you need to read larger documents, it can be piped to more or just use more to read the file in the first place.
TYPE [drive:][path]filename C:\>type %TEMP%\readme.txt "This is how you can read a text file from the command line"
Those are some of our favorite tricks to make Windows more convenient to use! Hopefully there was at least one trick here that is new for you.
Do you have any tricks that amaze others? Share them in the comments below!
Any way to show the PID of the actual cmd window it is running in?ReplyDelete
tasklist | find "cmd"Delete
The second column is the pid.
I would use a simple WMI query to get cmd.exe PID info:Delete
wmic process get name, executablepath, processID | find "cmd"
If you want to see a list of all processes, just remove "find" part (including pipe sign).
This is really cool!ReplyDelete
Something useful you might find interesting:ReplyDelete
Thanks for the awesome links and your work making volitility that much better. I will use this in class to explain a key concept. First, I usually remind students about nix's bash_history and then ask them this thought provoking question: "What file contains Windows command line history". Very few people know the answer. Thanks again for sharing.
The feature I use most frequently on command line is the auto-completion [tab] key.ReplyDelete
Thanks for sharing.ReplyDelete
On each computer I work on I change the properties of the windows to quck edit mode and set it to modify the link that starts cmd prompts. Since I am using my profile it does not interfere with others.ReplyDelete
I forget most of these but like to be reminded every once and a while.
Nice tip John. We create modified command prompt shortcuts for our class images. It prevents us from having to change the background color and adjust the font size each time we spawn a shell (which happens a lot in a Foundstone class). A real life saver when you have to project something that is legible to a whole class.Delete
http://rmccurdy.com/scripts/fu.txt (my personal fu) and http://rmccurdy.com/scripts/fu_ripp.txt ripped fu from websiteReplyDelete
That is a lot of fu, sir. Well done and thanks for sharing.Delete