shutdown_windows_firewall

firewallwindowspostexploitlateral-Movementpivot

First method (up to date)

CMD

# Disable all profiles
netsh advfirewall set allprofiles state off
 
# Enable all profiles
netsh advfirewall set allprofiles state on

Powershell

# Get all profiles status
Get-NetFirewallProfile -Name Public,Domain,Private | Select Name,Enabled
 
# Disable all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
 
# Enable all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

Second method (deprecated)

# Get windows firewall actual mode
netsh firewall show opmode
 
# Disable the Windows Firewall
netsh firewall set opmode mode=disable

---

sources

• https://pentestlab.blog/2012/04/06/post-exploitation-disable-firewall-and-kill-antivirus/
• https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/defense-evasion/impair-defenses/disable-or-modify-system-firewall