Domain Enumeration with Powerview - Part - 1

Enumeration about domain

Using dot sourcing to load powerview in the powershell session.

. .\PowerView.ps1

If powerview is detected by defender:

Set-MpPreference -DisableRealtimeMonitoring $true

Get info of current domain:

Get-NetDomain

Get info of other domain:

Get-NetDomain -Domain moneycorp.local

To know domain sid:

Get-DomainSID

Get domain policy for the current domain:

Get-DomainPolicy

(Get-DomainPolicy)."system access"

(Get-DomainPolicy)."kerberos policy"  (kerberos policy enumeration is required when we forge golden or silver tickets otherwise ATA will catch us)

Get domain controller for the current domain:

Get-NetDomainController

Get domain controller for other domain:

Get-NetDomainController -Domain moneycorp.local

Get list of users in the current domain:

Get-NetUser | select cn or select -ExpandProperty cn

Get-NetUser -Username student1

Get list of users in other domain if domain trust is established:

Get-NetUser -Domain eurocorp.local

Get list of all properties for users in the current domain:

Get-UserProperty 

Get-UserProperty -properties pwdlastset  (when you give this command then left column will be filled by usernames and right column will be property pwdlastset)

Search for a particular string in users attributes or user fields:

Find-UserField -SearchField Description -SearchTerm "build" or "password" or "pass"  (sometimes admins writes shared users password or service accounts password in this description field)

Domain enumeration - computer and groups:

Get a list of computers in the current domain:  

Get-NetComputer 

Get-NetComputer -FullData  (It will show all properties of all computers)

Get-NetComputer -FullData | Select OperatingSystem

Get-NetComputer -OperatingSystem "server 2016"

Get all the groups in the current domain:

Get-NetGroup

Get-NetGroup -GroupName "Domain Admins" -FullData

Get-NetGroup -Fulldata    (It will show all properties of all groups)

Get groups of other domain:

Get-NetGroup -Domain <target domain>

Get all the groups containing the word "admin" in group name:

Get-NetGroup -GroupName *admin*

Get all the groups containing the word "admin" in group name of other domain:

Get-NetGroup -GroupName *admin* -Domain moneycorp.local

Get all members of the domain admins group: 

Get-NetGroupMember -GroupName "Domain Admins" -Recurse  (Recurse for if there are nested groups we can also then know members name as well)

Get group member of other domain:

Get-NetGroupMember -GroupName "Enterprise Admins" -Domain moneycorp.local

Get the group membership of a user:

Get-NetGroup -Username "student1"

List all the local groups on a machine (admin privs required for non-dc machines):

Get-NetLocalGroup -ComputerName dcorp-dc.dollarcorp.moneycorp.local -ListGroups

Get members from all local groups (admin privs required for non-dc machines):

Get-NetLocalGroup -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Recurse

Get actively logged on users on a computer (needs local admin rights on the target):

Get-NetLoggedOn -ComputerName <target server name>

Get locally logged on users on a computer (needs remote registry on the target - started by default on server os)

Get-LoggedonLocal -ComputerName dcorp-dc.dollarcorp.moneycorp.local

Get last logged on users on a computer (needs local admin rights on the target):

Get-LastLoggedOn -ComputerName <target server name>

Find shares on hosts in current domain:

Invoke-ShareFinder -Verbose

Invoke-ShareFinder -ExcludeStandard -ExcludePrint -ExcludeIPC -Verbose

Find sensitive files on computers in domain:

Invoke-FileFinder -Verbose

Get all file servers in the domain:

Get-NetFileServer -Verbose

Domain enumeration GPO

Get list of GPO in current domain:

Get-NetGPO | select displayname

Get the name of a GPO that is applied on a particular computer:

Get-NetGPO -ComputerName dcorp-student1.dollarcorp.moneycorp.local | select displayname

Get GPO's which use restricted groups or groups.xml for interesting users:

Get-NetGPOGroup   (Say i want in my local administrators group, only domain admins should included, in this case my local administrators group will be treated as restricted group)

Get users who have local admin rights of a given machine or any machine using GPO:

Find-GPOComputerAdmin

Find-GPOComputerAdmin -ComputerName dcorp-student1.dollarcorp.moneycorp.local

Get machines where the given user is a member of a specific group: 

Find-GPOLocation -UserName student1 -verbose  (Say 5 machines out of 10, there is a group called rdpusers and student1 is a member of that group)

Get-NetGPOUser: Lists the user accounts that are linked to a specific GPO.

Get-NetGPOComputer: Lists the computer accounts that are linked to a specific GPO

Get OU in a domain:

Get-NetOU | select name

Get-NetOU -FullData

If you want to see some specific OU is applied under which computers:

Get-NetOU -OUName StudentMachines | %{Get-NetComputer -ADSPath $_}

Get what gpo applied on what ou? Because of this you need gplink property value which you will get by running the previous Get-NetOU -FullData command. 

Get-NetGPO -GPOName '{value}'

Say you want to find out what gpo is applied on studentmachines ou. So follow this:

(Get-NetOU StudentMachines -FullData).gplink

You will get LDAP://cn=value   (copy this value)

Get-NetGPO -GPOName '{paste the value here}'

List GPO's:

Get-NetGPO

ACL's

Get the acl's associated with specific object for example a user or group:  

Get-ObjectAcl -SamAccountName "student1" -ResolveGUIDs -Verbose (for user)  

Get-ObjectAcl -SamAccountName "users" -ResolveGUIDs -Verbose (for group)

Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs -Verbose (for group)

Get the acl's associated with the specified prefix to be used for search:

Get-ObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -Verbose

Get the acl's associated with the specified LDAP path to be used for search:

Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose

Search for interesting ACE's:

Invoke-ACLScanner -ResolveGUIDs

If we want to find out what are the modifiable rights/permission of a particular user or group:

Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReference -match "student15" or RDPUsers}

Get the acl's associated with the specified path:

Get-PathAcl -Path "\\dcorp-dc.dollarcorp.moneycorp.local\sysvol"

Domain enumeration - Trusts

Get a list of all domain trust including parent-child-external for the current domain:

Get-NetDomainTrust

Get-NetDomainTrust -Domain us.dollarcorp.moneycorp.local

Get details about the current forest:

Get-NetForest 

Get-NetForest -Forest eurocorp.local

Get all domains in the current forest:

Get-NetForestDomain -Verbose

Get-NetForestDomain -Forest eurocorp.local

Finding out to whom root domain eurocorp.local has the external trust:

Get-NetForestDomain -Forest eurocorp.local -Verbose | Get-NetDomainTrust

Get a global catalogs for the current forest:

Get-NetForestCatalog

Get-NetForestCatalog -Forest eurocorp.local

Map trusts of a forest:

Get-NetForestTrust

Get-NetForestTrust -Forest eurocorp.local

Domain enumeration - user hunting:

Find all machines on the current domain where current user has local admin access:

Find-LocalAdminAccess -Verbose

If the above does not work because of port blockage then try below:

. .\Find-WmiLocalAdminAccess.ps1

Find-WmiLocalAdminAccess -ComputerFile .\Computer.txt -Verbose

Find local admins of all machines of the domain (need admin privs on non-dc machines):

Invoke-EnumerateLocalAdmin -Verbose

Find computers where a domain admin or specified users or groups has sessions:

Invoke-UserHunter

Invoke-UserHunter -GroupName "RDPUsers"

To confirm admin access:

Invoke-UserHunter -CheckAccess

Find computers where a domain admin is logged-in:

Invoke-UserHunter -Stealth

To see who is connected with you now: (you need to run this from your machine in this case the dcorp-dc)

Get-NetSession -ComputerName dcorp-dc.dollarcorp.moneycorp.local