ShellSpells
  • πŸ§™β€β™‚οΈWelcome!
    • ShellSpells
    • FAQs
    • License & Disclaimer
  • 🐧Linux
    • System Ops
      • Transcripts
      • Help
      • System Info
        • Date/Time
        • System Details
        • Patches & Updates
        • Init System Identification
        • Hostname / Host ID
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Shares
        • Packages
        • Connected Devices
        • Kernel Modules (Drivers)
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Jobs
        • Enumerate
        • Modify
      • Processes
        • Enumerate
        • Modify
        • Custom Script and Shared Object
        • Process I/O Redirection
      • Services
        • Enumerate
        • Modify
        • Create a Service
      • Startup/Boot Scripts
        • Enumerate
        • Modify
      • Security
        • Antivirus
        • Firewall
        • SSH Keys
      • History & Logs
        • History
        • Logs
    • File Ops
      • Search
        • Filename
        • Content
        • Users (Owners)
        • Time
        • Size
        • Permission
        • Hidden Files
        • Inode
        • Find + Exec
        • Notes
      • Enumerate Metadata
      • Modify Metadata
      • Read Content
      • Modify Content
      • Extract Content
      • Sort / Compare / Count
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
    • Terminal Ops
      • Keyboard Shortcuts
      • Tmux Shortcuts
  • πŸͺŸWindows
    • System Ops
      • Transcripts
      • Help
      • System Info
        • One-liners
        • Date/Time
        • System Details
        • Hotfixes
        • Domain or Workgroup
        • Data Execution Prevention
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Installed Software
        • Drivers
        • Shares
      • Registry
        • Enumerate
        • Modify
        • Forensically Relevant Keys
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Tasks
      • Processes
        • Enumerate
        • Modify
      • Services
        • Enumerate
        • Modify
      • Autorun / Startup
        • Enumerate
        • Modify
      • Security
        • Permissions
          • Enumerate
          • Page
        • Antivirus
        • Firewall
          • Enumerate
          • Modify
        • Audit Policies
        • Remoting
          • Enumerate
          • Modify
          • Registry Locations
        • Stored Credentials
      • Remote Command Execution
      • Active Directory
        • Enumerate
        • Modify
      • History & Logs
        • History
        • Logs
      • PowerShell Config
      • Scripting
      • WMIC Notes
    • File Ops
      • Search
        • Filename
        • Time
        • Size
        • Permissions
        • Attributes
        • Wildcarding
      • Enumerate Metadata
        • One Liners
        • Users (Owners)
        • Timestamps
        • Size
        • Permissions
        • Attributes
      • Modify Metadata
        • Change Owner
        • Timestamps
        • Size
        • Attributes
      • Read Content
      • Modify Content
        • Overwrite
        • Insert
        • Append
        • Replace / Remove
        • Convert Case
        • Alternate Data Streams
      • Extract Content
      • Sort / Compare / Count
        • Sort
        • Count
        • Compare
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
      • Output Formatting / Filtering
      • File Formatting
      • Operators
  • ⛓️Network
    • Traffic Manipulation
      • iptables
        • Option List
        • General Commands
        • Filter Tables
        • NAT
        • Mangle
        • Filter for SSH Traffic (Example)
      • nftables
    • Packet Capture
      • Syntax
      • TCPDump Examples
    • Packet Analysis
      • Wireshark
  • πŸš—Maneuver
    • SSH
    • Control Sockets
    • RDP
    • Windows Port Proxy
  • πŸ›©οΈData Transfer
    • SCP
    • FTP
    • Netcat
      • Netcat Relays
    • Server Interactions
    • Alternate Methods
  • πŸͺ„REGEX
    • Examples
Powered by GitBook
On this page
  • Enumerate
  • Modify
  • Automatic Variables
  • Registry Locations

Was this helpful?

  1. Windows
  2. System Ops
  3. System Info

Variables

Enumerate

Get-Variable

Displays current variables

gci variable:

Same as above

Get-ChildItem env:

List all Environment Variables

set

Lists all environment variables in the Command Prompt.

echo %VARIABLE_NAME%

Shows the value of a specific environment variable in the Command Prompt.

$env:VARIABLE_NAME

Retrieves the value of a specific environment variable in PowerShell.

printenv

Windows Subsystem for Linux (WSL) environment.

Modify

Get-Variable

Names are displayed without the preceding <$>

Clear-Variable -Name MyVariable

Delete the value of a Variable

Remove-Variable -Name MyVariable

Delete the Variable

$MyVariable = 1, 2, 3

Creates the MyVariable with 1,2,3

$Processes = Get-Process

Creates a Variable with the results of Get-Process

$Today = (Get-Date).DateTime

Creates a combined Date/Time variable from the results of Get-Date

Set-Item -Path Env:/A -Value 1

Sets environment variable 'A' to '1'

Automatic Variables

$$

Last token in the last line received by the session.

$?

Execution status of the last operation.

$^

First token in the last line received by the session.

$_

Contains the current object in the pipeline object.

$ARGS

Array of the undeclared parameters and/or parameter values passed to a function, script, or script block.

$ERROR

An array of error objects that represent the most recent errors.

$FALSE

Represent FALSE in commands and scripts instead of using the string "false".

$FOREACH

Enumerator (not the resulting values) of a ForEach loop.

$HOME

Full path of the user’s home directory.

$LASTEXITCODE

Exit code of the last Windows-based program that was run.

$MATCHES

Works with the -match and -notmatch operators.

$NULL

Automatic variable that contains a NULL or empty value.

$PID

Process identifier (PID) of the process hosting the current PowerShell session.

$PROFILE

Full path of the PowerShell profile for the current user and the current host application.

$PSVERSIONTABLE

Read-only hash table displaying details about the version of PowerShell running in the current session.

$TRUE

Used to represent TRUE in commands and scripts.

Registry Locations

Environment variables in Windows are stored in the registry in two primary locations:

System Variables:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

This key contains environment variables that are set system-wide and affect all users on the system.

User Variables:

HKEY_CURRENT_USER\Environment

This key stores environment variables that are specific to the currently logged-in user.

When you set or modify environment variables via system settings or using tools like setx, the changes are reflected in these registry locations.

PreviousData Execution PreventionNextHardware & Resources

Last updated 1 year ago

Was this helpful?

πŸͺŸ