> For the complete documentation index, see [llms.txt](https://cybersecurity-cloud-and-it-notes.gitbook.io/kyles-cybersecurity-cloud-and-it-gitbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybersecurity-cloud-and-it-notes.gitbook.io/kyles-cybersecurity-cloud-and-it-gitbook/hack-the-box/academy/windows-fundamentals/skills-assessment-windows-fundamentals.md).
# Skills Assessment - Windows Fundamentals
10.129.201.211
The cheat sheet is a useful command reference for this module.
| **Command** | **Description** |
| -------------------------------------------------------------- | ----------------------------------------------------------------------- |
| `xfreerdp /v: /u:htb-student /p:` | RDP to lab target |
| `Get-WmiObject -Class win32_OperatingSystem` | Get information about the operating system |
| `dir c:\ /a` | View all files and directories in the c:\ root directory |
| `tree ` | Graphically displaying the directory structure of a path |
| `tree c:\ /f \| more` | Walk through results of the `tree` command page by page |
| `icacls ` | View the permissions set on a directory |
| `icacls c:\users /grant joe:f` | Grant a user full permissions to a directory |
| `icacls c:\users /remove joe` | Remove a users' permissions on a directory |
| `Get-Service` | `PowerShell` cmdlet to view running services |
| `help ` | Display the help menu for a specific command |
| `get-alias` | List `PowerShell` aliases |
| `New-Alias -Name "Show-Files" Get-ChildItem` | Create a new `PowerShell` alias |
| `Get-Module \| select Name,ExportedCommands \| fl` | View imported `PowerShell` modules and their associated commands |
| `Get-ExecutionPolicy -List` | View the `PowerShell` execution policy |
| `Set-ExecutionPolicy Bypass -Scope Process` | Set the `PowerShell` execution policy to bypass for the current session |
| `wmic os list brief` | Get information about the operating system with `wmic` |
| `Invoke-WmiMethod` | Call methods of `WMI` objects |
| `whoami /user` | View the current users' SID |
| `reg query ` | View information about a registry key |
| `Get-MpComputerStatus` | Check which `Defender` protection settings are enabled |
| `sconfig` | Load Server Configuration menu in Windows Server Core |
Above, I used the xfreerdp command to remote into the windows machine.
I created the Company data folder. Right click and select properties.
Selected the sharing tab. Then selected advanced Sharing button
Select "Share this folder"
Select apply then ok
Close out of that popup menu and then open up the company data folder
Created a subfolder named "HR"
Search up and open "computer management app"
Select local users and groups.
Right click on users and select "new user".
Type in User name and Full name as "Jim" and uncheck "User must change password at next login" per htb's instructions.
Create a password and click create
Select the Groups folder in the side panel and create a new group called HR
Double click on HR and select 'add' and input Jim to the HR group
You can type the name in the field and select check names to select the actual user
Hit Ok, apply ok, all that.
Go back to the company data folder and right click, select properties, sharing tab and then advanced sharing.
Select Permissions button
Remove the 'Everyone' group from the permissions
Select 'add'
Type 'HR' then hit 'check names' then select ok
Add change and read permission
Hit apply, and then OK. Go to the security tab in the properties
Select advanced
Select disable inheritance
Select convert inherited permissions into explicit permissions on this object.
Someone would select **"Convert inherited permissions into explicit permissions on this object"** when disabling inheritance to maintain the same set of permissions that the object currently has but make them independent of the parent object's permissions. Here's why this might be desirable:
1. **Maintain Existing Permissions:** This option ensures that the current permissions applied to the object remain intact. Disabling inheritance without converting the permissions would otherwise result in losing all inherited permissions, which could inadvertently lock users out or disrupt access control.
2. **Customization:** By converting inherited permissions to explicit permissions, you can modify or fine-tune permissions specific to the object without affecting or being affected by the parent object’s permissions.
3. **Preservation of Access Control:** If permissions were inherited from a parent object and those permissions are needed for the object to function properly or for certain users to retain access, converting them to explicit permissions ensures continuity.
4. **Granular Management:** Once permissions are explicit, they can be adjusted for the specific object without altering permissions of other objects that share the parent’s inheritance.
This is particularly useful in environments where permissions need to be adjusted for individual files, folders, or objects without propagating changes across the entire hierarchy.
hit 'apply' then hit add
Click on 'select a principal'
Enter HR in the object name field and then select check names
Make sure the basic permissions that are selected are: Modify, Read & execute, List folder contents, Read and Write.
Hit OK
Select OK in this menu as well:
Verify permissions for HR:
Select 'close'
Go to the HR subfolder, right click on it and select properties:
In the sharing tab select advanced sharing.
Whoops, actually back out of that and don't right click on the HR folder, instead right click inside of the company data folder:
Select the sharing tab, then the advanced sharing button and then in the new popup for advanced sharing select permissions
The SID changes to HR automatically
Go back to the security tab and select advanced
Enable and disable inheritance again ( I may be wrong about this step)
Hit 'add'
Select a principle for permission entry pop up menu
Enter 'HR' and select okay... I feel like I already did this...
But 'modify' and 'write' permissions are missing for the company data folder. I must have only put the permissions for the 'hr' folder and since I disabled the inheritance I have to also modify these permissions back for the parent folder for anyone in the hr group.
Hit okay
Then hit apply and okay
Basically hit okay for every menu to get out of all menus.
For the following question, What is the name of the group that is present in the Company Data Share Permissions ACL by default, I believe the answer to this is "Everyone"
Yolp. I was correct.
The question here is What is the name of the tab that allows you to configure NTFS permissions? I believe the answer is "Security" or "Sharing"
It was Security
The third question is What is the name of the service associated with "Windows Update?"
I ran Get-Service in the powershell and got a list of running services:
Looks Like I may have gotten lucky, since there is a windows update service running called wuauserv. I will enter that into the question field and see.
Yep, it was correct.
Next question is List the SID associated with the user account Jim you created.
Whelp... I already forgot about that lol.
Luckily, I did that yesterday, having to look up a user account's sid, so I just looked at my notes from yesterday.
So I copied what I did but with Jim's account name:
Get-WmiObject -Class Win32\_Account -Filter "Name='Jim'"
Which returned the output:
The SID is S-1-5-21-2614195641-1726409526-3792725429-1006
The last question is: List the SID associated with the HR security group you created.
That is going to be a little tough because I am not 100% sure what the class name is for groups
I made a stab in the dark and entered this command into the powershell:
Get-WmiObject -Class Win32\_Group -Filter "Name='HR'"
which actually gave me an output instead of an error so I may have gotten lucky here
Here is the HR group SId apparently:
S-1-5-21-2614195641-1726409526-3792725429-1007
Looks like they accepted my answer
Well, there is another command that can show this as well:
wmic useraccount get name,sid
This is technically easier and simpler I suppose.
The same for groups
The command:
wmic group get name,sid