Hack Forums
Tutorial | Netsh - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Tutorial | Netsh (/showthread.php?tid=3150257)

Pages: Pages 1 2

Tutorial | Netsh - LevelUp - Jan 4, 2013

What is the Netsh command?

Netsh has the ability to configure Windows Server networking and firewall functions, something which Powershell doesn't really touch on.

Let's get started. I'll be covering a list of useful commands, they are done via Command Prompt.

Network Configuration

To show the system's current IP configuration, you are able to use the following command to see if the system is using DHCP or static addressing but also to show the system's current IP address, submask, gateway address, and DNS server:

Code
netsh interface ip show config

Netsh commands work with both Windows IPv4 and IPv6. To display your system's IPv4/IPv6 address, use the following Netsh command(s):

Code
netsh interface ipv4 show address
or
netsh interface ipv6 show address

Netsh can work with the built-in Windows Firewall. Just so you know, if your using Windows XP/2003, the command is netsh firewall. The following commands show how to disable then re-enable the Windows Firewall in Windows 7:

Code
netsh advfirewall set currentprofile state off
netsh advfirewall set currentprofile state on

You're also able to use Netsh to open ports in the firewall for different applications. This example in particular shows how to open TCP port 1434 for Microsoft SQL Server access:

Code
netsh advfirewall firewall
  add rule name="SQL Server"
  dir=in action=allow
  protocol=TCP localport=1434

The next example shows how you use Netsh to configure a network adapter to use a static IP address. This example specifically will set the IP address of the network adapter named Local Area Connection to 192.168.1.16, the subnet mask to 255.255.255.0, and finally the gateway address to 192.168.0.254:

Code
netsh interface ip
  set address "Local Area Connection"
  static 192.168.1.16
  255.255.255.0 192.168.0.254 1

When you change the system's IP address type to static, you usually need to change the DNS configuration also. This example shows how to use Netsh to configure the Local Area Connection to use a DNS server with the address 192.168.0.6:

Code
netsh interface ip
  set dns "Local Area Connection"
  static 192.168.0.6

And the next command is used to add another DNS Server
Code
netsh interface ip
add dnsserver "Local Area Connection"
192.168.0.4

Netsh and Firewall Configuration

First things first, you'll want to use netsh to find out your Windows Firewall's current configuration properties using the following command

Code
netsh advfirewall firewall show rule name=all

The next commands show how to turn Windows Firewall off and then back on:

Code
netsh advfirewall set allprofiles state on
netsh advfirewall set allprofiles state off

If you make an absolute balls of something, it can be easily fixed by reverting to default settings:

Code
netsh advfirewall reset

Ermagherd someone's using ping -t -l 65500 and booting you off (lel) and you need to block their ping, this command will do just that.

Code
netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=block protocol=icmpv4

Just change action=allow to make ping possible again

If you want to enable/disable a port in your firewall, you can use the following

Code
netsh advfirewall firewall add rule name="Open SQL Server Port 1337" dir=in action=allow protocol=TCP localport=1337

replace with
netsh advfirewall firewall delete rule name="Open SQL Server Port 1337" protocol=tcp localport=1337.. in order to close the port

The final task I'll be showing is how to open Windows Firewall for a given program. The following example illustrates how to add a rule that enables LOIC (lel) to work through Windows Firewall:

Code
netsh advfirewall firewall add rule name="Allow LOIC" dir=in action=allow program="C:\LOIC.exe"

Thanks for reading this tutorial. I didn't want to go too in-depth and I hope that I achieved at least making you understand some of the basic commands.

* - Van1la - Jan 4, 2013

Thank You bro.
Very nice Tutorial
..

* - LevelUp - Jan 4, 2013

(Jan 4, 2013 09:11 AM)Van1la Wrote:  Thank You bro.
Very nice Tutorial
..

Thanks, I appreciate you taking the time to comment :3

* - Metamorphic - Jan 4, 2013

This is well written and sticks to the topic, well done :)

* - LevelUp - Jan 4, 2013

(Jan 4, 2013 11:14 AM)Deso Wrote:  This is a well written and sticks to the topic, well done :)

Thanks alot Deso, it means alot 🤝

* - Antigen - Jan 4, 2013

Well written, I just skimmed because I'm busy right now.

# Bookmarked and will learn soon.

Edit: So cool, I didn't knew we could configure Win firewall like this.

* - LevelUp - Jan 4, 2013

(Jan 4, 2013 11:44 AM)Antigen Wrote:  Well written, I just skimmed because I'm busy right now.

# Bookmarked and will learn soon.

Edit: So cool, I didn't knew we could configure Win firewall like this.

Yeah it's something not many people touch on.

* - d0ngle - Jan 4, 2013

Very nice, and a good(ish) analog to Linux's iptables.

* - LevelUp - Jan 4, 2013

(Jan 4, 2013 07:08 PM)d0ngle Wrote:  Very nice, and a good(ish) analog to Linux's iptables.

Thanks, I was giving people an alternative considering many fear a Linux based OS.

* - Arbitrage - Jan 6, 2013

Great tutorial on Netsh.exe, thanks for sharing.

* - Illicit - Jan 6, 2013

(Jan 6, 2013 12:46 PM)LevelUp Wrote:  It's not a .exe, it's a command line but thanks anyway.

Incorrect it is an 'exe'. Ill take a look at this later nice tutorial BTW :3

* - LevelUp - Jan 6, 2013

(Jan 6, 2013 12:54 PM)Ebx. Wrote:  Incorrect it is an 'exe'. Ill take a look at this later nice tutorial BTW :3

The command line can be accessed as a .exe, but it's still a network shell.

* - Illicit - Jan 6, 2013

(Jan 6, 2013 12:57 PM)LevelUp Wrote:  The command line can be accessed as a .exe, but it's still a network shell.

That isnt my point, when you type in netsh you are executing C:\WINDOWS\Sytem32\Netsh.exe.

* - LevelUp - Jan 6, 2013

(Jan 6, 2013 12:59 PM)Ebx. Wrote:  That isnt my point, when you type in netsh you are executing C:\WINDOWS\Sytem32\Netsh.exe.

Indeed you are, my apologies for wording badly/misunderstanding what you're trying to say.

* - Illicit - Jan 6, 2013

(Jan 6, 2013 01:01 PM)LevelUp Wrote:  Indeed you are, my apologies for wording badly/misunderstanding.

No problem, I spend most of my beginner programming years coding in batch.You where no match :3 lawl