Basic Enumeration
Get-NetDomain
Get-NetDomain -Domain <domain>
Get-DomainSID
Get-DomainPolicy
(Get-DomainPolicy)."systemaccess","kerberospolicy"
Get-NetDomainController
Get-NetUser
Get-NetUser -Username akash
Get-UserProperty
Get-UserProperty -Properties pwdlastset,logoncount,badpwdcount
Get-UserProperty -Properties logoncount
Get-UserProperty -Properties badpwdcount
Find-UserField -SearchField Description -SearchTerm "built"
Get-NetComputer
Get-NetComputer -OperatingSystem "*Server 2016*"
Get-NetComputer -Ping
Get-NetComputer -FullData
Get-NetGroup
Get-NetGroup -Domain <domain>
Get-NetGroup -FullData
Get-NetComputer -Domain
Get-NetGroup *admin*
Get-NetGroup -GroupName *admin*
Get-NetGroup *admin* -FullData
Get-NetGroup -GroupName *admin* -Doamin akash.local
Get-NetGroup -UserName "akash"
Get-NetGroupMember -GroupName "Domain Admins" -Recurse
Get-NetLocalGroup -ComputerName <servername> -ListGroups
Get-NetLocalGroup -ComputerName <servername> -Recurse
Get-NetLoggedon -ComputerName <servername>
Get-LoggedonLocal -ComputerName <servername>
Get-LastLoggedon -ComputerName <servername>
Invoke-ShareFinder -Verbose // Finds shares
Invoke-FileFinder -Verbose // Finds sensitive files
Get-NetFileServer // Gets all the file-servers
GPO Enumeration
GPO's are specific settings applied to the OU's, they can differ within them
Allows configurations of
Registry-based policy settings
GPP - like startup, shutdown, log-on/off
Get-NetGPO
Get-NetGPO -ComputerName <servername>
Get-GPO -All (GroupPolicy module)
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Users\Administrator\report.html (Provides RSoP)
gpresult /R /V (GroupPolicy Results of current machine)
Get-NetGPOGroup # groups.xml
Find-GPOComputerAdmin -ComputerName <servername>
Get-NetOU -FullData
Get-NetGPO -GPOname "{AB306569-220D-43FF-BO3B-83E8F4EF8081}"
Get-GPO -Guid AB306569-220D-43FF-B03B-83E8F4EF8081 (GroupPolicy module)
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')}
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'
ACL Enumeration
ACLs help control who can access different parts of the network, like files or folders, and what they can do with them
Access Tokens - Identity and Privs
Security Descriptors - SID owner, DACL and SACL
DACL tells who has the permission to access, and SACL contains the audit log, loggin and logging off - when a sysadmin monitors
Get-ObjectAcl -SamAccountName akash -ResolveGUIDs
Get-ObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -Verbose
Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose
Invoke-ACLScanner -ResolveGUIDs
Get-PathAcl -Path "\\dc.hydra.local\sysvol"
Trusts Enumeration
allows user of a domain or forest to access resources in another domain or forest
two-way trust exists between domains, even in forests too
trust relationships need to be created between forests
One-Way Trust
A => B
if A is the printer we are trying to access, then the trust relationship will be from A to B
Two-Way Trust
A <=> B
users in both domains can access each other’s resources
Transitive Trust
A <=> B <=> C
relationships that are extended with other domains, parent-child
Trust Types
Domain Trusts
Parent-child trust is created automatically between new domain and existing domain
Forest Trusts
Established between root domains of forests, can be one-way or two-way
Get-NetDomainTrust
Get-NetDomainTrust -Domain <domain>
Get-NetForest
Get-NetForest -Forest <forest>
Get-NetForestDomain
Get-NetForestDomain -Forest <forest>
Get-NetForestCatalog
Get-NetForestCatalog -Forest <forest>
User Hunting
Find-LocalAdminAccess -Verbose
Invoke-UserHunter
Invoke-UserHunter -GroupName "RDPUsers"
Invoke-UserHunter -CheckAccess
Invoke-UserHunter -Stealth
Get-DomainForeingUser
Get-DomainForeignGroupMember
BloodHound Enumeration
. .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All,LoggedOn
Invoke-Bloodhound -CollectionMethod All -Domain CONTROLLER.local -ZipFileName loot.zip
Invoke-BloodHound -CollectionMethod All -ExcludeDC # To avoid ATA detection