# Enumeration

## Basic Enumeration

```
Get-NetDomain
Get-NetDomain -Domain <domain>

Get-DomainSID

Get-DomainPolicy
(Get-DomainPolicy)."systemaccess","kerberospolicy"

Get-NetDomainController

Get-NetUser
Get-NetUser -Username akash


Get-UserProperty
Get-UserProperty -Properties pwdlastset,logoncount,badpwdcount
Get-UserProperty -Properties logoncount
Get-UserProperty -Properties badpwdcount

Find-UserField -SearchField Description -SearchTerm "built"

Get-NetComputer
Get-NetComputer -OperatingSystem "*Server 2016*"
Get-NetComputer -Ping
Get-NetComputer -FullData

Get-NetGroup
Get-NetGroup -Domain <domain>
Get-NetGroup -FullData
Get-NetComputer -Domain
Get-NetGroup *admin*
Get-NetGroup -GroupName *admin*
Get-NetGroup *admin* -FullData
Get-NetGroup -GroupName *admin* -Doamin akash.local
Get-NetGroup -UserName "akash"

Get-NetGroupMember -GroupName "Domain Admins" -Recurse

Get-NetLocalGroup -ComputerName <servername> -ListGroups
Get-NetLocalGroup -ComputerName <servername> -Recurse

Get-NetLoggedon -ComputerName <servername> 

Get-LoggedonLocal -ComputerName <servername> 

Get-LastLoggedon -ComputerName <servername>

Invoke-ShareFinder -Verbose     // Finds shares
Invoke-FileFinder -Verbose     // Finds sensitive files
Get-NetFileServer             // Gets all the file-servers
```

## GPO Enumeration

> GPO's are specific settings applied to the OU's, they can differ within them

Allows configurations of&#x20;

* security settings
* Registry-based policy settings
* GPP - like startup, shutdown, log-on/off
* Software installation

```
Get-NetGPO
Get-NetGPO -ComputerName <servername>
Get-GPO -All (GroupPolicy module)
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Users\Administrator\report.html (Provides RSoP)
gpresult /R /V (GroupPolicy Results of current machine)

Get-NetGPOGroup        # groups.xml

Find-GPOComputerAdmin -ComputerName <servername>

Get-NetOU -FullData

Get-NetGPO -GPOname "{AB306569-220D-43FF-BO3B-83E8F4EF8081}"
Get-GPO -Guid AB306569-220D-43FF-B03B-83E8F4EF8081 (GroupPolicy module) 

Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')}
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'
```

## ACL Enumeration

ACLs help control who can access different parts of the network, like files or folders, and what they can do with them

* **Access Tokens** - Identity and Privs&#x20;
* **Security Descriptors** - SID owner, DACL and SACL

**DACL** tells who has the permission to access, and **SACL** contains the audit log, loggin and logging off - when a sysadmin monitors

```
Get-ObjectAcl -SamAccountName akash -ResolveGUIDs
Get-ObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -Verbose
Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose

Invoke-ACLScanner -ResolveGUIDs
Get-PathAcl -Path "\\dc.hydra.local\sysvol" 
```

## Trusts Enumeration

* allows user of a domain or forest to access resources in another domain or forest
* two-way trust exists between domains, even in forests too
* trust relationships need to be created between forests

#### One-Way Trust

**A => B**&#x20;

* if A is the **printer** we are trying to access, then the **trust relationship** will be from A to B

#### Two-Way Trust

**A <=> B**

* users in both domains can access each other’s resources

#### Transitive Trust

**A <=> B <=> C**

* relationships that are extended with other domains, parent-child

### Trust Types

#### Domain Trusts

Parent-child trust is created automatically between new domain and existing domain

#### Forest Trusts

Established between root domains of forests, can be **one-way** or **two-way**

```
Get-NetDomainTrust
Get-NetDomainTrust -Domain <domain>

Get-NetForest
Get-NetForest -Forest <forest>

Get-NetForestDomain
Get-NetForestDomain -Forest <forest>

Get-NetForestCatalog
Get-NetForestCatalog -Forest <forest>
```

### **User Hunting**

```
Find-LocalAdminAccess -Verbose

Invoke-UserHunter
Invoke-UserHunter -GroupName "RDPUsers"
Invoke-UserHunter -CheckAccess
Invoke-UserHunter -Stealth

Get-DomainForeingUser 
Get-DomainForeignGroupMember
```

### BloodHound Enumeration

```
. .\SharpHound.ps1

Invoke-BloodHound -CollectionMethod All,LoggedOn
Invoke-Bloodhound -CollectionMethod All -Domain CONTROLLER.local -ZipFileName loot.zip
Invoke-BloodHound -CollectionMethod All -ExcludeDC    # To avoid ATA detection
```
