Cyberops - Module 3 Study Notes - TH
Cyberops - Module 3 Study Notes - TH
Summary
MS-DOS Commands
MS-DOS includes several commands that facilitate file management, such as: - `dir`: Lists files in the
current directory. - `cd`: Changes the directory. - `copy`: Copies files from one location to another. - `del`:
Deletes files. - `mkdir`: Creates a new directory. - `ren`: Renames a file. - `help`: Displays available
commands.
The Disk Operating System (DOS) allows computers to manage data storage devices for reading
and writing files.
MS-DOS was developed by Microsoft and primarily used a command line interface for file
manipulation, where commands appear in bold in command outputs.
Early Windows versions, starting with Windows 1.0 in 1985, operated over MS-DOS, while
newer versions utilize Windows NT technology for direct hardware control.
Users can access a command window to experience MS-DOS by typing 'cmd' in Windows Search
and pressing Enter.
Windows has seen over 20 releases based on the NT operating system since 1993, with specialized
editions for various uses, including workstation and server applications.
The transition to 64-bit architecture introduced substantial changes, allowing for a larger address
space, although compatibility with older 32-bit programs is maintained.
Microsoft has stated that Windows 10 will be the final version, with future updates instead of new
releases.
Windows features a Graphical User Interface (GUI) characterized by a customizable Desktop that
can hold files, folders, shortcuts, and applications.
The Task Bar at the bottom contains the Start menu for easy access to programs, a quick launch
area, and a notification area for program statuses.
Right-clicking icons reveals a Context Menu offering additional functions for ease of use.
Operating systems, including Windows, contain thousands to millions of lines of code, which can
harbour vulnerabilities that malicious actors may exploit to gain unauthorized access or control.
Common security recommendations include using Windows Defender for malware protection,
monitoring unknown services, implementing encryption, and enforcing a solid security policy.
The Hardware Abstraction Layer (HAL) facilitates communication between hardware and the
kernel, the core component of the OS managing input, output requests, and memory.
Windows operates in two modes: user mode for applications and kernel mode for OS code,
maintaining a restricted address space for user applications to enhance security.
Windows supports multiple file systems, including NTFS (most commonly used), exFAT, FAT32,
and Linux's EXT, with various capabilities and attributes.
NTFS uses structures like the Master File Table (MFT) to track files, including security and
timestamp information.
The Windows Architecture and Operations - Windows Boot Process
The boot process involves the BIOS or UEFI firmware initializing hardware, discovering the
master boot record, and executing Bootmgr.exe to load the operating system.
The process ensures all drivers are digitally signed for security before proceeding to initialize the
Windows kernel with Ntoskrnl.exe.
Proper shutdown of a computer is essential, allowing applications and services to close correctly
while facilitating record-saving of configuration changes.
Different options such as Shutdown, Restart, and Hibernate cater to varied user needs for power
management.
Each application on Windows operates as a process composed of one or more threads, which do
not share memory space across processes to prevent corruption.
Background services support the OS and applications, providing essential functionality like
network connectivity; caution is needed when modifying service settings.
The Windows Registry is a hierarchical database for system and application settings, divided into
main hives such as HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.
Each key can contain subkeys and values, which define various settings and parameters across the
operating system. Tools like regedit.exe allow users to modify these settings with caution.
Running applications as Administrator is advisable only when required. This can be performed
using context menus in File Explorer or Command Prompt.
User accounts can be customized with specific permissions through local users and domain
settings, managed via the lusrmgr.msc applet, to improve administration staff management and
security.
Windows PowerShell is an environment used for scripting and automating tasks that standard
Command Line Interface (CLI) cannot perform.
PowerShell supports the execution of various command types, including:
Help commands in PowerShell provide structured assistance based on detail level:
WMI enables management and monitoring of remote computers, offering insights into hardware
and software statistics.
Access the WMI Control via Windows Control Panel by navigating through Administrative Tools
> Computer Management > WMI Control Properties.
WMI Control Properties contain:
The net command is essential for OS administration and supports various subcommands with
specific switches.
Common net commands include:
1. net accounts: This command is used to set password and logon requirements for user accounts on the
system.
2. net session: This command lists all active sessions between the local computer and other computers on
the network, and it can also disconnect sessions.
3. net share: This command allows users to create, remove, or manage shared resources on the network.
4. net start: This command starts a specified network service or lists all currently running network services.
6. net use: This command connects, disconnects, and displays information about shared network resources.
7. net view: This command shows a list of computers and network devices available on the network.
8. netsh - he `netsh` command is a powerful command-line utility in Windows that allows users to display
and modify the network configuration of the operating system. It can be used to configure various
networking parameters and settings, including network interfaces, firewall settings, and routing protocols
9. Netstat - - netstat: This command displays details of active network connections, which can help identify
unauthorized connections and monitor network activity.
Task Manager gives an overview of running processes, software performance, and system
utilization across seven tabs.
Tabs in Task Manager include:
Networking
Networking is vital for connecting computers, managed primarily through the Network and
Sharing Centre.
Network and Sharing Centre functionalities:
The `nslookup` command tests DNS functionality, while `netstat` displays active network
connections.
The Server Message Block (SMB) protocol facilitates sharing network resources.
The Universal Naming Convention (UNC) enables access with paths like `\\servername\
sharename\file`.
Remote Desktop Protocol (RDP) allows users to control remote computers, posing security risks.
Windows Server
Windows Server caters to data centre needs with various services, including network services
(DNS, DHCP), file services (SMB, NFS), and management (Active Directory).
Windows Server starts a lineage with Windows Server 2003 for server-specific operations, unlike
desktop versions.
Windows Security
The `netstat` command checks for unauthorized network connections and active TCP connections.
Windows Event Viewer logs application and security events, aiding in troubleshooting with
specific logs like Administrative Events.
Regular updates are vital for security; service packs bundle necessary patches for vulnerabilities.
Local Security Policy governs security settings for stand-alone Windows computers, including
password guidelines and account lockout policies.
Windows Defender
Windows Defender offers built-in real-time protection against malware, including various threats
like viruses and spyware.
It allows for manual scanning and is designed to work concurrently with other antimalware
software.
The Windows Defender Firewall manages and denies unwanted network traffic, with settings
accessible through the Control Panel for program access controls.