Comment on page
PowerView
https://powersploit.readthedocs.io/en/latest/Recon/
Get-Domain
Get-DomainSID
Get-DomainController
Get-DomainUser
(Get-DomainUserr).count
Get-DomainUser -Identity harry.jones -Domain inlanefreight.local | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,mail,useraccountcontrol
Get-DomainUser -KerberosPreauthNotRequired -Properties samaccountname,useraccountcontrol,memberof
Get-DomainUser -TrustedToAuth -Properties samaccountname,useraccountcontrol,memberof
Get-DomainUser -TrustedToAuth -Properties samaccountname,useraccountcontrol,memberof
Get-DomainUser -Properties samaccountname,description | Where {$_.description -ne $null}
Get-DomainUser -SPN -Properties samaccountname,memberof,serviceprincipalname
Get-DomainUser -Properties samaccountname,pwdlastset,lastlogon -Domain InlaneFreight.local | select samaccountname, pwdlastset, lastlogon | Sort-Object -Property pwdlastset
Get-DomainGroup -Properties Name
Get-DomainGroupMember -Identity '<Group name>'
Find-ManagedSecurityGroups | select GroupName
Get-DomainManagedSecurityGroup
$sid = Convert-NameToSid <username>
$computers = Get-DomainComputer -Properties dnshostname | select -ExpandProperty dnshostname
foreach ($line in $computers) {Get-NetLocalGroupMember -ComputerName $line | ? {$_.SID -eq $sid}}
Get-DomainComputer -Properties dnshostname,operatingsystem,lastlogontimestamp,useraccountcontrol
ForceChangePassword abused with
Set-DomainUserPassword
Add Members abused with Add-DomainGroupMember
GenericAll abused with Set-DomainUserPassword
or Add-DomainGroupMember
GenericWrite abused with Set-DomainObject
WriteOwner abused with Set-DomainObjectOwner
WriteDACL abused with Add-DomainObjectACL
AllExtendedRights abused with Set-DomainUserPassword
or Add-DomainGroupMember
(Get-ACL "AD:$((Get-ADUser joe.evans).distinguishedname)").access | ? {$_.ActiveDirectoryRights -match "WriteProperty" -or $_.Act
Rights -match "GenericAll"} | Select IdentityReference,ActiveDirectoryRights -Unique | ft -W
Get-DomainObjectAcl -Identity harry.jones -Domain inlanefreight.local -ResolveGUIDs
# list File Shares
Get-NetShare -ComputerName SQL01
# List Inside File Share
Get-PathAcl "\\SQL01\DB_backups"
$dcsync = Get-ObjectACL "DC=inlanefreight,DC=local" -ResolveGUIDs | ? { ($_.ActiveDirectoryRights -match 'GenericAll') -or ($_.ObjectAceType -match 'Replication-Get')} | Select-Object -ExpandProperty SecurityIdentifier | Select -ExpandProperty value
# List Users who can DCSync
Convert-SidToName $dcsync
Get-DomainGPO | select displayname
Get-DomainGPO -ComputerName WS01 | select displayname
Get-DomainGPO | Get-ObjectAcl | ? {$_.SecurityIdentifier -eq 'S-1-5-21-2974783224-3764228556-2640795941-513'}
Get-DomainTrust
Get-DomainTrustMapping
Last modified 6mo ago