It's time for us to get a little bit more information about what services are running
on the actual system. So we can see what may or may not be inside of startup and what other
processes are running on the actual system itself. So inside of our Kali box here, we're still in the
shell of the target system on our Win10 system. And there's two real basic commands we're going
to use for this. And the first one is scquery. And this will give us an output of all services
running on the target system itself to give us information about not only the service name,
but potentially the PID and also the file that could go with it. Now you may not see that in
this output and that's because you can get a little bit more detailed in the weeds on this
by hitting scqc and then the actual service name. So if you, for instance, right above this,
there's one that's running. We know this because we can see that it's running. And don't you worry,
I'll zoom in here momentarily. And I'm going to copy this right here and then paste it inside of
our prompt. There we go. And I'll expand this so that way we can see just a little bit better.
And up top, we're taking a look at the actual output from the scquery, all the services together.
And so we can see, we get the service name, display name, and what it's actually supposed
to be doing and its current status. And right below that, we went into scqc, the actual service
name itself. And I do want to note that I use both of these back to back because I wanted to show you
that when you type in the service name, you don't need that underscore 47db8 or whatever
follows it at the end. You just need the actual display name. And you can type in the whole thing
or you can do the actual truncated service name. By doing this, we now have a more detailed view
of the actual service itself and what file it's actually coming off of and who's actually in
charge of the service. For instance, this one is the Windows push notifications for user services,
and it's ran by the actual local system. We can also see that it's an auto start and is coming
from the svchost file with a flag of dash K and then following that. So this gives us more
information and detail on not only what services are running, but the file locations, who's in
charge of them, and potentially for us to be able to go in and start making changes to the actual
services that are running on the target system. Now, you may be also wondering, how can we see
the services that are running? And that's as simple as typing in task list. And we get not only the
actual task that's running, but the PIDs and everything else that we would see very clearly
here in the Windows 10 task manager output. So we're just looking at this in actual CLI format
instead of what's actually on the GUI form. And we can see all sorts of information as far as like
the file name and everything else about that service as well. And using the task list sub
cmdlets that you can learn inside of other CVT skills, even earlier in this course as well,
you can begin to start to start, stop different processes and
services that are running on this target system.