Ein Spickzettel, der gängige Aufzählungs- und Angriffsmethoden für Windows Active Directory enthält.
Dieses Spickzettel enthält allgemeine Aufzählungs- und Angriffsmethoden für Windows Active Directory.
ℹ️ Dieses Repository wurde erstellt von Nikos Katsiopis und Nikos Vourdas.
Dieses Spickzettel ist inspiriert vom PayloadAllTheThings Repository.
Powerview v.3.0
Powerview Wiki
Aktuelle Domäne abrufen: Get-Domain
Andere Domänen aufzählen: Get-Domain -Domain <Domänenname>
Domänen-SID abrufen: Get-DomainSID
Domänenrichtlinie abrufen: ```powershell Get-DomainPolicy
#Will show us the policy configurations of the Domain about system access or kerberos Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess Get-DomainPolicy | Select-Object -ExpandProperty KerberosPolicy
Domänencontroller abrufen: ```powershell Get-DomainController Get-DomainController -Domain
Domänenbenutzer auflisten: ```powershell #Save all Domain Users to a file Get-DomainUser | Out-File -FilePath .\DomainUsers.txt
#Will return specific properties of a specific user Get-DomainUser -Identity [username] -Properties DisplayName, MemberOf | Format-List
#Enumerate user logged on a machine Get-NetLoggedon -ComputerName
#Enumerate Session Information for a machine Get-NetSession -ComputerName
#Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain | Select-Object UserName, SessionFromName
Enum Domain Computers: ```powershell Get-DomainComputer -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName
#Enumerate Live machines Get-DomainComputer -Ping -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName
Gruppen und Gruppenmitglieder aufzählen: ```powershell #Save all Domain Groups to a file: Get-DomainGroup | Out-File -FilePath .\DomainGroup.txt
#Return members of Specific Group (eg. Domain Admins & Enterprise Admins) Get-DomainGroup -Identity '' | Select-Object -ExpandProperty Member Get-DomainGroupMember -Identity '' | Select-Object MemberDistinguishedName
#Enumerate the local groups on the local (or remote) machine. Requires local admin rights on the remote machine Get-NetLocalGroup | Select-Object GroupName
#Enumerates members of a specific local group on the local (or remote) machine. Also requires local admin rights on the remote machine Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain
#Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName
Auflisten der Freigaben: ```powershell #Enumerate Domain Shares Find-DomainShare
#Enumerate Domain Shares the current user has access Find-DomainShare -CheckShareAccess
#Enumerate "Interesting" Files on accessible shares Find-InterestingDomainShareFile -Include passwords
Gruppenrichtlinien aufzählen: ```powershell Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName
#Enumerate all GPOs to a specific computer Get-DomainGPO -ComputerIdentity -Properties DisplayName | Sort-Object -Property DisplayName