Enumeration

Basic Enumeration

Get-NetDomain
Get-NetDomain -Domain <domain>

Get-DomainSID

Get-DomainPolicy
(Get-DomainPolicy)."systemaccess","kerberospolicy"

Get-NetDomainController

Get-NetUser
Get-NetUser -Username akash


Get-UserProperty
Get-UserProperty -Properties pwdlastset,logoncount,badpwdcount
Get-UserProperty -Properties logoncount
Get-UserProperty -Properties badpwdcount

Find-UserField -SearchField Description -SearchTerm "built"

Get-NetComputer
Get-NetComputer -OperatingSystem "*Server 2016*"
Get-NetComputer -Ping
Get-NetComputer -FullData

Get-NetGroup
Get-NetGroup -Domain <domain>
Get-NetGroup -FullData
Get-NetComputer -Domain
Get-NetGroup *admin*
Get-NetGroup -GroupName *admin*
Get-NetGroup *admin* -FullData
Get-NetGroup -GroupName *admin* -Doamin akash.local
Get-NetGroup -UserName "akash"

Get-NetGroupMember -GroupName "Domain Admins" -Recurse

Get-NetLocalGroup -ComputerName <servername> -ListGroups
Get-NetLocalGroup -ComputerName <servername> -Recurse

Get-NetLoggedon -ComputerName <servername> 

Get-LoggedonLocal -ComputerName <servername> 

Get-LastLoggedon -ComputerName <servername>

Invoke-ShareFinder -Verbose     // Finds shares
Invoke-FileFinder -Verbose     // Finds sensitive files
Get-NetFileServer             // Gets all the file-servers

GPO Enumeration

GPO's are specific settings applied to the OU's, they can differ within them

Allows configurations of

• security settings

• Registry-based policy settings

• GPP - like startup, shutdown, log-on/off

• Software installation

Get-NetGPO
Get-NetGPO -ComputerName <servername>
Get-GPO -All (GroupPolicy module)
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Users\Administrator\report.html (Provides RSoP)
gpresult /R /V (GroupPolicy Results of current machine)

Get-NetGPOGroup        # groups.xml

Find-GPOComputerAdmin -ComputerName <servername>

Get-NetOU -FullData

Get-NetGPO -GPOname "{AB306569-220D-43FF-BO3B-83E8F4EF8081}"
Get-GPO -Guid AB306569-220D-43FF-B03B-83E8F4EF8081 (GroupPolicy module) 

Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')}
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'

ACL Enumeration

ACLs help control who can access different parts of the network, like files or folders, and what they can do with them

• Access Tokens - Identity and Privs

• Security Descriptors - SID owner, DACL and SACL

DACL tells who has the permission to access, and SACL contains the audit log, loggin and logging off - when a sysadmin monitors

Get-ObjectAcl -SamAccountName akash -ResolveGUIDs
Get-ObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -Verbose
Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose

Invoke-ACLScanner -ResolveGUIDs
Get-PathAcl -Path "\\dc.hydra.local\sysvol" 

Trusts Enumeration

• allows user of a domain or forest to access resources in another domain or forest

• two-way trust exists between domains, even in forests too

• trust relationships need to be created between forests

One-Way Trust

A => B

• if A is the printer we are trying to access, then the trust relationship will be from A to B

Two-Way Trust

A <=> B

• users in both domains can access each other’s resources

Transitive Trust

A <=> B <=> C

• relationships that are extended with other domains, parent-child

Trust Types

Domain Trusts

Parent-child trust is created automatically between new domain and existing domain

Forest Trusts

Established between root domains of forests, can be one-way or two-way

Get-NetDomainTrust
Get-NetDomainTrust -Domain <domain>

Get-NetForest
Get-NetForest -Forest <forest>

Get-NetForestDomain
Get-NetForestDomain -Forest <forest>

Get-NetForestCatalog
Get-NetForestCatalog -Forest <forest>

User Hunting

Find-LocalAdminAccess -Verbose

Invoke-UserHunter
Invoke-UserHunter -GroupName "RDPUsers"
Invoke-UserHunter -CheckAccess
Invoke-UserHunter -Stealth

Get-DomainForeingUser 
Get-DomainForeignGroupMember

BloodHound Enumeration

. .\SharpHound.ps1

Invoke-BloodHound -CollectionMethod All,LoggedOn
Invoke-Bloodhound -CollectionMethod All -Domain CONTROLLER.local -ZipFileName loot.zip
Invoke-BloodHound -CollectionMethod All -ExcludeDC    # To avoid ATA detection