# Quality Of Life changes

## Firewall

```
netsh advfirewall show allprofiles
netsh advfirewall set allprofiles state off

#Add a route to the IP you want
route add <IP_YOU_WANT_TO_ACCESS> MASK 255.255.255.255 <YOUR_GATEWAY>
route add 172.16.3.11 MASK 255.255.255.255 172.16.100.254
```

### Firewall Rules

For Firewall rules usually it needs to be run under administrator

{% tabs %}
{% tab title="Batch" %}

```
netsh advfirewall firewall add rule name="Allow Traffic from 172.16.3.11" `
dir=in action=allow `
remoteip=172.16.3.11 `
protocol=TCP `
profile=any `
description="Allow incoming traffic from 172.16.3.11"
```

{% endtab %}

{% tab title="Powershell" %}

```
New-NetFirewallRule -DisplayName "Allow Traffic from 172.16.3.11" `
-Direction Inbound `
-Action Allow `
-RemoteAddress 172.16.3.11 `
-Protocol TCP `
-Profile Any `
-Enabled True `
-Description "Allow incoming traffic from 172.16.3.11"
```

{% endtab %}
{% endtabs %}

## Disabling AV

{% tabs %}
{% tab title="Batch" %}
Disable real time monitoring

```
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
```

Disable IOAV Protection

```
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
```

{% endtab %}

{% tab title="Powershell" %}
To disable it using powershell

Disable real time monitoring & IOAVProtection

```
Set-MpPreference -DisableRealTimeMonitoring $true
Set-MpPreference -DisableIOAVProtection $true	
```

{% endtab %}
{% endtabs %}

## AMSI

To break AMSI this website can also work

{% embed url="<https://amsi.fail/>" %}

## Enabling WinRM, WMIEXEC, SMB

I had also used the tricks down in persistence to make it easier for me to get into my student machine and to confirm if it works?. well NXC says it does of course I censored my student no.

```
kali@kali ~> nxc wmi 172.16.100.XX     -u 'sawyer' -p 'Password123' --local-auth
RPC         172.16.100.90   135    DCORP-STDXX      [*] Windows Server 2022 Build 20348 (name:DCORP-STDXX) (domain:dollarcorp.moneycorp.local)
RPC         172.16.100.90   135    DCORP-STDXX      [+] DCORP-STD90\sawyer:Password123
```
