Windows Command Line: Navigating and Managing Endpoints with the CLI

Introduction

Welcome to my walkthrough of the "Windows Command Line" room! This room marks the exciting first step into the Command Line module within TryHackMe's Cyber Security 101 pathway.

In my previous article, Active Directory Basics, we explored how to centralize identity management and enforce security policies across an enterprise network using Domains, OUs, and Group Policy Objects. Now, we are pivoting from high-level network architecture down to individual endpoint management.

In this room, "Windows Command Line", we will step away from the graphical interface entirely to master the raw command-line utilities built directly into the Windows operating system. This walkthrough serves as a comprehensive guide to completing the room tasks, demonstrating exactly how to extract system diagnostics, manipulate files, and handle administrative operations directly from a terminal prompt.

Catch up on my previous article Active Directory Basics by clicking the banner below.

What we will cover

• Key advantages of utilizing a CLI over a traditional GUI environment.
• Navigating the local file system and manipulating files/directories.
• Querying deep system diagnostics and local network configurations.
• Filtering processes and terminating non-responsive services from the terminal.

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: Windows Command Line
• Path: Cyber Security 101
• Module: Command Line
• Topic: Windows CLI & System Administration
• Difficulty: Easy
• Room Link: TryHackMe — Windows Command Line

Task 1: Introduction

Most users prefer a graphical user interface (GUI) until they learn the true efficiency of a command-line interface (CLI). While graphical windows are highly intuitive for exploring a system, they consume considerable CPU power and memory. Operating directly from a shell prompt dramatically reduces resource usage, making it ideal for managing lightweight cloud instances or older hardware. Additionally, a text-based terminal allows you to easily automate tasks through scripts and smoothly manage remote systems over slower network connections.

To begin interacting with the Windows environment without a GUI, we utilize the Microsoft Windows Command Prompt, where cmd.exe serves as the default command-line interpreter. This interpreter acts as our main gateway for running commands, allowing us to query local configurations, manipulate files, and audit running services.

Deploying the Lab

To practice these commands, we connect to our target machine using an SSH client from the TryHackMe AttackBox. Open the AttackBox terminal, initiate the session by running ssh user@MACHINE_IP, type yes to trust the connection, and authenticate using the password Tryhackme123!.

Questions and Answers

What is the default command line interpreter in the Windows environment?

Answer:

cmd.exe

cmd.exe

Task 2: Basic System Information

Before executing advanced operational utilities, we need to understand how the terminal locates executable binaries. When you issue a command, the system checks predefined environment variables to know where to find the application.

Guided Walkthrough: Auditing System Environment and Diagnostics

Step 1: Checking the System Path

To audit our local configuration environment, we begin by running the set command. This dumps all active environment variables to the screen. By locating the line beginning with Path=, we can see the specific system directories where the OS looks to execute system binaries.

Step 2: Extracting the Operating System Version

Next, we execute the ver command. This provides a direct output stating the exact software build of our deployment machine. Looking at the returned string reveals the precise operating system version required to answer our first task objective.

Step 3: Gathering Detailed System Configuration Details

For an exhaustive overview of our host, we execute the systeminfo command. This utility queries the hardware and kernel layers to return the hostname, operating system configuration, and available system resources. Reviewing the initial lines of this output gives us the definitive hostname for our target machine.

Useful Output Control Commands

• Paging Long Output: If a command produces too much text (such as driverquery), pipe it to the more tool using driverquery | more. This allows you to review the records page-by-page via the Spacebar. You can cancel out at any time using CTRL + C.
• Wiping the Terminal: When your console becomes cluttered, issue the cls command to clear the screen entirely.

Questions and Answers

What is the OS version of the Windows VM?

Answer:

10.0.20348.2655

10.0.20348.2655

What is the hostname of the Windows VM?

Answer:

WINSRV2022-CORE

WINSRV2022-CORE

Task 3: Network Troubleshooting

The command-line interface provides a fast, native toolkit to look up active network configurations, audit active connections, and troubleshoot connectivity drops without relying on a GUI.

Guided Walkthrough: Investigating Interfaces and Ports

Step 1: Locating the Physical Hardware Address

To begin our network audit, we execute the ipconfig /all command. While a standard ipconfig command only prints core IP configurations, appending the /all flag dumps exhaustive network interface properties. By analyzing the output, we can locate our active Ethernet adapter details, including its hardware Physical Address (MAC address).

Step 2: Auditing Active Services and Listening Ports

Next, we want to examine active network connections and listening sockets. We execute netstat -abon, combining multiple flags to list all connections (-a), display the underlying service names (-b), track process IDs (-o), and keep addresses in a clean numerical format (-n).

Looking closely at our terminal output gives us the data required for the remaining questions:

• Port 3389: The output clearly associates this port with TermService (Remote Desktop Protocol).
• Port 135: Interestingly, our live Windows Server 2022 machine explicitly maps this port to the RpcEptMapper service. However, TryHackMe's question validation system looks for the legacy Windows service name handling RPC operations, which is RpcSs. Keep this minor OS discrepancy in mind when submitting your answer!

Essential Diagnostic Utilities

• Testing Reachability (ping): Sends ICMP echo requests to determine if a remote host is active and measures round-trip time latency.
• Mapping Route Paths (tracert): Visualizes every single router hop your packets cross across the internet to reach a destination.
• Querying Name Servers (nslookup): Allows you to manually look up specific DNS records or explicitly test external resolvers (e.g., nslookup example.com 1.1.1.1).

Questions and Answers

Which command can we use to look up the server's physical address (MAC address)?

Answer:

ipconfig /all

ipconfig /all

What is the name of the service listening on port 135?

Answer:

RpcSs

RpcSs

What is the name of the service listening on port 3389?

Answer:

TermService

TermService

Task 4: File and Disk Management

Navigating files and managing local storage directories inside the terminal is incredibly streamlined once you become familiar with core file system commands.

Guided Walkthrough: Hunting for the Hidden Flag

Step 1: Navigating to the Target Directory

The room challenges us to locate a hidden treasure file buried deep within the file system. To shift our active console context, we use the Change Directory (cd) command followed by our target path: cd C:\Treasure\Hunt.

Step 2: Listing the Directory Contents

Once inside the folder, we run the Directory (dir) command to audit what files are contained inside. The resulting terminal output reveals a single text file named flag.txt waiting for us.

Step 3: Printing the Flag to the Console

To inspect the contents of the file without leaving the terminal, we use the native type utility. Running type flag.txt immediately dumps the cleartext contents on the screen, exposing our target flag.

Essential File Operations Reference

• Viewing File Layouts (tree): Generates a clean, visual branch diagram of all subfolders inside your current path.
• Duplicating Data (copy): Copies files from a source location to a specified destination.
• Relocating Files (move): Shifts files permanently out of the current folder into a new directory path.
• Removing Records (del or erase): Instantly wipes a file from local disk storage.
• Batch Handling (Wildcards): You can combine commands with an asterisk (e.g., copy *.txt C:\Backup) to handle multiple files sharing an extension simultaneously.

Questions and Answers

What are the file's contents in C:\Treasure\Hunt?

Answer:

THM{CLI_POWER}

THM{CLI_POWER}

Task 5: Task and Process Management

When an application hangs or freezes, there is no need to struggle with opening a sluggish graphical interface. The command line allows administrators to audit running processes, apply filters, and terminate problematic services instantly.

Querying Active Processes

To view a complete snapshot of all running applications alongside their allocated memory footprint and Process IDs (PIDs), we utilize the tasklist utility. Because this command typically generates an overwhelming wall of data, we can apply specific matching criteria using the filter flag (/FI).

To isolate applications matching a specific program name, we construct our query using the image name equals (imagename eq) syntax inside a filter block. For instance, to locate any running instances of a text editor like Notepad, you run: tasklist /FI "imagename eq notepad.exe"

Terminating Applications via CLI

Once you have identified a unique numerical Process ID (PID) from your audited list, you can bypass the application's frozen user interface and kill it directly at the kernel layer. This is achieved using the taskkill utility paired with the targeted Process ID flag (/PID). For instance, to instantly terminate a non-responsive process assigned to PID 1516, you execute: taskkill /PID 1516

Questions and Answers

What command would you use to find the running processes related to notepad.exe?

Answer:

tasklist /FI “imagename eq notepad.exe”

tasklist /FI “imagename eq notepad.exe”

What command can you use to kill the process with PID 1516?

Answer:

taskkill /PID 1516

taskkill /PID 1516

Task 6: Conclusion

This room serves as an essential primer on using the traditional Windows Command Prompt (cmd.exe) to interact with endpoints, check system parameters, and diagnose basic networking issues.

Advanced Diagnostic Utilities

While we focused on the core tools required for standard navigation and quick troubleshooting, there are several other native utilities built into the command-line interface that every IT professional should keep in their back pocket:

• chkdsk: Audits the overall health of local hard drives, scanning the file system for corruption and bad sectors.
• driverquery: Generates an exhaustive list of all installed device drivers and their respective properties.
• sfc /scannow: Launches the System File Checker, which scans protected Windows system binaries and replaces corrupted files with clean copies.

Mastering Terminal Controls

When navigating any CLI, remembering specific commands is only half the battle; knowing how to manipulate the terminal's output structure is equally vital. Appending the /? flag to almost any command displays its built-in help guide. When a utility outputs overwhelming walls of text, you can leverage the more command to pause the data and review it systematically, either directly by passing a file name (more file.txt) or by piping a command's result to it (some_command | more).

Additionally, if you need to control the power state of an endpoint directly from the prompt, you can use the shutdown utility:

• To gracefully restart a system immediately, execute: shutdown /r
• To abort or cancel a scheduled system shutdown, execute: shutdown /a

With these fundamentals down, your next logical step is diving into Windows PowerShell to unlock more complex administrative scripting capabilities.

Questions and Answers

The command shutdown /s can shut down a system. What is the command you can use to restart a system?

Answer:

shutdown /r

shutdown /r

What command can you use to abort a scheduled system shutdown?

Answer:

shutdown /a

shutdown /a

Summary & Key Takeaways

Mastering the Windows Command Line is a critical, empowering transition for any aspiring security analyst or IT administrator. Moving beyond the constraints of the GUI allows you to interact directly with the operating system kernel, query network routes in real-time, and automate tedious daily tasks.

Key lessons:

• Leverage Diagnostic Filtering: Using commands like netstat -abon or tasklist /FI allows you to rapidly pinpoint anomalies, identify suspicious open ports, and isolate rogue processes.
• Prioritize Paged Navigation: Never struggle with overwhelming terminal outputs; pipeline large command results to | more to analyze configuration tables carefully.
• Speed and Automation are King: Learning how to navigate directories, manipulate files, and verify connectivity purely from the keyboard sets the stage for building automated administrative and defensive scripts.