ShellSpells
  • 🧙‍♂️Welcome!
    • ShellSpells
    • FAQs
    • License & Disclaimer
  • 🐧Linux
    • System Ops
      • Transcripts
      • Help
      • System Info
        • Date/Time
        • System Details
        • Patches & Updates
        • Init System Identification
        • Hostname / Host ID
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Shares
        • Packages
        • Connected Devices
        • Kernel Modules (Drivers)
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Jobs
        • Enumerate
        • Modify
      • Processes
        • Enumerate
        • Modify
        • Custom Script and Shared Object
        • Process I/O Redirection
      • Services
        • Enumerate
        • Modify
        • Create a Service
      • Startup/Boot Scripts
        • Enumerate
        • Modify
      • Security
        • Antivirus
        • Firewall
        • SSH Keys
      • History & Logs
        • History
        • Logs
    • File Ops
      • Search
        • Filename
        • Content
        • Users (Owners)
        • Time
        • Size
        • Permission
        • Hidden Files
        • Inode
        • Find + Exec
        • Notes
      • Enumerate Metadata
      • Modify Metadata
      • Read Content
      • Modify Content
      • Extract Content
      • Sort / Compare / Count
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
    • Terminal Ops
      • Keyboard Shortcuts
      • Tmux Shortcuts
  • 🪟Windows
    • System Ops
      • Transcripts
      • Help
      • System Info
        • One-liners
        • Date/Time
        • System Details
        • Hotfixes
        • Domain or Workgroup
        • Data Execution Prevention
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Installed Software
        • Drivers
        • Shares
      • Registry
        • Enumerate
        • Modify
        • Forensically Relevant Keys
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Tasks
      • Processes
        • Enumerate
        • Modify
      • Services
        • Enumerate
        • Modify
      • Autorun / Startup
        • Enumerate
        • Modify
      • Security
        • Permissions
          • Enumerate
          • Page
        • Antivirus
        • Firewall
          • Enumerate
          • Modify
        • Audit Policies
        • Remoting
          • Enumerate
          • Modify
          • Registry Locations
        • Stored Credentials
      • Remote Command Execution
      • Active Directory
        • Enumerate
        • Modify
      • History & Logs
        • History
        • Logs
      • PowerShell Config
      • Scripting
      • WMIC Notes
    • File Ops
      • Search
        • Filename
        • Time
        • Size
        • Permissions
        • Attributes
        • Wildcarding
      • Enumerate Metadata
        • One Liners
        • Users (Owners)
        • Timestamps
        • Size
        • Permissions
        • Attributes
      • Modify Metadata
        • Change Owner
        • Timestamps
        • Size
        • Attributes
      • Read Content
      • Modify Content
        • Overwrite
        • Insert
        • Append
        • Replace / Remove
        • Convert Case
        • Alternate Data Streams
      • Extract Content
      • Sort / Compare / Count
        • Sort
        • Count
        • Compare
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
      • Output Formatting / Filtering
      • File Formatting
      • Operators
  • ⛓️Network
    • Traffic Manipulation
      • iptables
        • Option List
        • General Commands
        • Filter Tables
        • NAT
        • Mangle
        • Filter for SSH Traffic (Example)
      • nftables
    • Packet Capture
      • Syntax
      • TCPDump Examples
    • Packet Analysis
      • Wireshark
  • 🚗Maneuver
    • SSH
    • Control Sockets
    • RDP
    • Windows Port Proxy
  • 🛩️Data Transfer
    • SCP
    • FTP
    • Netcat
      • Netcat Relays
    • Server Interactions
    • Alternate Methods
  • 🪄REGEX
    • Examples
Powered by GitBook
On this page
  • Commands
  • Remote
  • Remote For PS3 -> PS2
  • Registry Locations

Was this helpful?

  1. Windows
  2. System Ops
  3. Services

Enumerate

Commands

tasklist /svc

Display running services.

tasklist /svc /fi "imagename eq svchost.exe"

Finds only processes that are svchost.exe and associated services.

tasklist /svc /fi "services eq dnscache"

List Process responsible for a service (DNS Client Service in this case).

tasklist /V /FI "MODULES eq mswsock.dll"

List all process associated with the Windows Socket DLL.

net start

View a list of running services.

net start ^ | find /v /c

Count services.

sc query [ServiceName]

Configuration & status info.

sc queryex state=all

Shows extended information for all services.

sc enumdepend [ServiceName]

Displays service dependencies.

sc enumdepend tapisrv

List the local services that will not run unless the TAPISRV service is running.

sc enumdepend rpcss 6971

List services that depend on RPCSS service, and specify buffer size of 6,971 bytes.

sc qc lanmanworkstation

View the services the "Workstation" service depends upon.

sc qc w32time

Gets properties of ServiceName. Shows exes.

sc getdisplayname "Scheduler"

Gets DisplayName from the KeyName.

sc getkeyname "Task Scheduler"

Gets KeyName from the DisplayName.

Get-Service

PS - Get service listing.

Get-Service | Where-Object {$_.Status -eq "Stopped"}

Show stopped services.

Get-Service | where Status -eq "Stopped"

Show stopped services.

Get-Service -ComputerName <ComputerName>

Retrieves the status of services on a specified remote computer.

Get-CimInstance -ClassName Win32_Service

Services.

Get-WmiObject Win32_Service

Retrieves service objects using WMI.

wmic service Name get pathname

Service cmdline.

wmic service list brief

All services with brief details.

wmic service where "state='running'" get name, displayname

Running services with select properties.

wmic service get name,displayname,startmode,pathname

Services and select properties.

service* sc enumdepend lanmanworkstation

View the services that depend upon the "Workstation" service.

Check services for exe:

reg query "HKLM\System\CurrentControlSet\Services" /s | find /I "nc.exe"

Get all services that the Display Name starts with Windows*. This is not the actual name of the service. The Display (Human Readable) name.

Get-Service -DisplayName 'Windows*' 

Allows you to access extended properties such as Description of the service.

Get-Service -Name wuauserv | Select-Object -ExpandProperty Description

Finds the description of a service "wuauserv" if -ExpandedProperty does not work.

Get-CimInstance win32_service | ?{$_.NAME -match "wuauserv"} | select Description 

Get cmdline of service or Verbose (/s):

reg query "HKLM\System\CurrentControlSet\Services\<Name>" /v "ImagePath"
reg query "HKLM\System\CurrentControlSet\Services\<Name> /s

Query service by name and show the cmdline:

$service = get-wmiobject -query 'select * from win32_service where name="Name"'; echo $service.pathname

Shows what processes are linked to services:

get-ciminstance -namespace root/cimv2 -classname Win32_service | select-object displayname,state,processid

Filter off of service state:

get-ciminstance -namespace root/cimv2 -classname Win32_service | where-object {$_.state -eq "running"} | select-object displayname,state,processid

Shows services set to bootstart (1).

1 = bootstart, these will be unfamiliar services most likely.

2 = autostart (delayed), which will be services you are more familiar with.

get-itemproperty HKML:\system\currentcontrolset\services* | where-object {$_.start -eq 1} | select description,imagepath,pschildname | format-list

This is a good command to run to make sure that services are running the correct processes.

This is how to list DLLs that specific programs are loading. Only works on running programs.

By Name (use the name used in the process list):

get-process | where-object {$_.name -eq "cmd"} | select-object -ExpandProperty modules | select-object filename

By Process ID:

get-process | where-object {$_.id -eq 5648} | select-object -ExpandProperty modules | select-object filename

Remote

sc \\xp.ops.local query type=service

Remote query

sc \\xp.ops.local getkeyname "Windows Firewall/Internet Connection Sharing (ICS)"

Returns keyname of "sharedaccess"

sc \\xp.ops.local query sharedaccess

Returns Description and Status of the Windows "Security Center" service

Creates 1-to-1 Temporary Session:

Invoke-Command -ComputerName File-Server {Get-Service}

Running a Temporary Session as a Job:

Invoke-Command -ComputerName File-Server,Domain-Controll,Workstation2 {Get-Service} -asjob

Running a Temporary Session as a Job:

Invoke-Command -ComputerName File-Server,Domain-Controll,Workstation2 {Get-Service} -asjob

Displays the job's Results:

Receive-Job <job #>

-> don't forget winrm quickconfig -q if using PS3+ for PSSession/CIMSession Remote

get-ciminstance -classname win32_service -filter "state like 'running'" | select name

Create CimSession or PSSession:

$c = New-CimSession -ComputerName win10 -Credential barney

Get running services on Win10, pipe the CimInstance in:

$c | Get-CimInstance -ClassName Win32_Service -filter "State like 'Running'

Get service status:

Get-CimInstance Win32_Service -Filter "Name='Spooler'" -CimSession $c | Selectlogging Name,State

Start service:

Get-CimInstance Win32_Service -Filter "Name='Spooler'" -CimSession $c | Invoke-CimMethod -Name StartService

Remote For PS3 -> PS2

$dopt = New-CimSessionOption -Protocol Dcom
$d = New-CimSession -ComputerName win7 -Credential fred -SessionOption $dopt
$d | Get-CimInstance -ClassName Win32_Service -filter "State like 'Running'"

Registry Locations

PreviousServicesNextModify

Last updated 1 year ago

Was this helpful?

🪟