Windows command line tutorial for penteration tester and system administrator [part3]

The Firewall

“netsh” is for configuring windows firewall.

We can configure the firewall from command line(cmd.exe) easily. I am including some firewall command below.

Start firewall:

Netsh> help

or

netsh firewall ?

Show all current configuration of the firewall:

netsh firewall show config

Firewall “set” command:

(This will set up the firewall to allow a program.)

netsh firewall set (see helps)

Enable the firewall

netsh firewall set opmode enable

ICMP setting:

netsh firewall set icmpsetting 8

Or

netsh firewall set icmpsetting type=all mode=enable

firewall service:

netsh firewall set service type=REMOTEADMIN mode=enable scope=CUSTOM address= ip.ip.ip.ip

netsh firewall set service REMOTEDESKTOP ENABLE

Adding new rules “The 'add' command”:

netsh firewall add ? (For helps)

netsh firewall add allowedprogram c:\somewhere\your\nc\nc.exe virus ENABLE

netsh firewall add allowedprogram program= c:\somewhere\somethings\rat.exe name=legit mode=enable

Open a port:

netsh firewall portopening TCP 1337 backdoor

netsh firewall portopening protocol=TCP port=31337 name=another mode=ENABLE scope=CUSTOM address=ip.ip.ip.ip profile=ALL interface=eth0

Delete a allowed program:

netsh firewall delete allowedprogram c:\somewhere\something\virus\nc.exe

netsh firewall delete allowedprogram program=c:\here\1337\delete\the\hacker\bye.exe profile=ALL

Turn into default windows firewall:

netsh firewall reset

to be continued...