Domain Enumeration - PowerView

Load Invisishell first

Then Load PowerView by dot sourcing

. \<path to the script>

. C:\AD\Tools\PowerView.ps1

Domain Enumeration

Get domain gives you info about current forest

Get-Domain

Forest - moneycorp.local current domain - dollarcopr.moneycorp.local domain controller 1 domainmodelevel 7 - 2016 server

Get-DomainSID

Get-Domain-Policy

(Get-DomainPolicy).KerberosPolicy

Get-DomainController

DomainUser Enumeration

To list out the user details

Get-DomainUser

Get-DomainUser | select samaccountname

Get-DomainUser -identity student315

To Find decoy,

Get-DomainUser | select cn, logoncount

Get-DomainUser -identity student315 -properties *

Get-DomainUser -LDAPFilter "description=*" | select name, description

DomainComputer Enumeration

Get-DomainComputer

Get-DomainComputer | select samaccountname

computer object

 Get-DomainComputer | select cn,logoncount

DomainGroup Enumeration

Get-DomainGroup

Get-DomainGroup | select name

Get-DomainGroup -Name *admin* | select cn

Get-DomainGroup -Name *admin*  -Domain moneycorp.local | select cn

Get-DomainGroupMember -Identity "Administrators"

Get-DomainGroupMember -Identity "Domain Admins"

sid 500 is default admin account

Get-DomainGroup -username student315 | select name

LocalGroup Enumeration

Get-NetLocalGroup -ComputerName dcorp-dc

for dc no admin rights required to list out the localgroup in dc, but in member machine need admin rights to list out

Get-NetLocalGroupMember -ComputerName dcorp-dc -GroupName Administrators

Learning Objective 1

Get-DomainGroupMember -name "Enterprise Admins" -domain moneycorp.local

Domain Group Policy Enumeration

Get-DomainGPO 

Get-DomainGPO | select displayname

Get-DomainOU

Get-DomainOU | select name,gplink

Get-DomainOU -Identity StudentMachines

(Get-DomainOU -Identity StudentMachines).distinguishedname

(Get-DomainOU -Identity StudentMachines).distinguishedname | %{Get-DomainComputer -SearchBase $_} | select cn

Domain Enumeration - ACL

Whenever the process trying wants to access an object, process could have access token (identity & privs of the user) Security Descrtiptors (SID, DACL, SACL)

	DACL - list of who have permission & what is the permission
	SACL - audit success or failure

Get-DomainObjectAcl -SamAccountName student315

Get-DomainObjectAcl -SamAccountName student315 -ResolveGUIDs

Domain Enumeration Trusts

Get-DomainTrust

Get-DomainTrust -Domain eurocorp.local

Get-Forest

Get-Forest -forest eurocorp.local

Get-ForestDomain

 Get-ForestDomain -Forest eurocorp.local

Get-ForestGlobalCatalog

Get-ForestGlobalCatalog -Forest eurocorp.local

Get-DomainUser -Domain eurocorp.local

All enumeration is valid if trusts is there

Domain user Hunting

Find-LocalAdminAccess -verbose

who has session on which computer

Invoke-SessionHunter

Invoke-SessionHunter -CheckAsAdmin