# Basics Located at `C:\Windows\System32\cmd.exe`. ## Basic Commands ```sh # clear the screen cls # command history doskey /history ```

Key/Command	Description
`doskey /history`	Prints the session's command history.
`page up`	Places the first command in our session history to the prompt.
`page down`	Places the last command in history to the prompt.
`⇧`	View previously run commands.
`⇩`	View most recent commands run.
`⇨`	Types the previous command to prompt one character at a time.
`⇦`	N/A
`F3`	Will retype the entire previous entry to our prompt.
`F5`	Pressing F5 multiple times will allow you to cycle through previous commands.
`F7`	Opens an interactive list of previous commands.
`F9`	Enters a command to our prompt based on the number specified. The number corresponds to the commands place in our history.

## Interesting Directories

Location	Description
`C:\Windows\Temp`	Contains temp system files accessible to all users on the system. All users have full access (rwx). Useful for dropping files as a low-privilege user on the system.
`C:\Users\<user>\AppData\Local\Temp`	Similar to above, but accessible only to the user account that it is attached to. Useful when the attacker gains control of a local/domain joined user account.
`C:\Users\Public`	Allows any interactive logon account full access. Alternative to the global `\Temp` as it's less likely to be monitored for suspicious activity.
`C:\Program Files`	Contains all 64-bit applications installed on the system.
`C:\Program Files (x86)`	Contains all 32-bit applications installed on the system.

## Navigation ```sh # list directory dir # list hidden files dir /a:h # current working directory cd chdir # move to another directory cd chdir # print the structure of current directory & subdirs tree # directories & files tree /F ``` ## Files & Dirs ### Directories #### Basics ```sh # create new dir mkdir md # delete empty dir rmdir rd # delete non-empty dir rmdir /S rd /S # move dir move ``` #### Copy `xcopy` has been deprecated for `robocopy`. `xcopy` resets any file attributes by default which can be useful from an attacker's perspective. ```sh # copy dir xcopy # recursive (+empty dirs) xcopy /E # retain attributes xcopy /K ``` `robocopy` (*robust file copy*) is a combination of `copy`, `xcopy`, and `move`. It is made for large directories and drive syncing. ```sh # basic usage robocopy ``` ### Files #### View Content ```bash # view contents type # view contents of all files at once type *.txt # read all files from all subdirectories for /r %i in (*) do type "%i" >> all_files_content.txt # view contents once-screen at a time, remove extra blank space more /S # we can also large-output commands to it systeminfo | more ``` #### Create & Modify ```sh # create a file echo > fsutil file createNew 222 # rename a file ren rename ``` #### Delete ```sh # delete a file del erase # delete files based on a specific attribute del /A:R * ``` #### Copy & Move ```sh # copy a file (with validation) copy /V # move a file move ``` ## I/O ```shell # redirect output to a file systeminfo > # append to a file systeminfo >> # pass input to a command find /i "see" < # pass output to a command type | find /i "see" ``` #### Command Chaining ```sh # just run one after another regardelss of status & # run cmd2 only if cmd1 succeeds && # run cmd2 only if cmd1 fails || ``` ## Resources {% tabs %} {% tab title="Documentation" %} {% embed url="" %} {% endtab %} {% tab title="SS64" %} {% embed url="" %} {% endtab %} {% tab title="Robocopy" %} {% embed url="" %} {% endtab %} {% endtabs %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://x7331.gitbook.io/notes/windows-shells/command-prompt/basics.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.