Windows Active Directory에 대한 일반적인 열거 및 공격 방법을 포함한 치트 시트입니다.
이 치트 시트는 Windows Active Directory를 위한 일반적인 열거 및 공격 방법을 포함하고 있습니다.
ℹ️ 이 저장소는 Nikos Katsiopis와 Nikos Vourdas에 의해 만들어졌습니다.
이 치트 시트는 PayloadAllTheThings 저장소에서 영감을 받았습니다.
Powerview v.3.0
Powerview Wiki
현재 도메인 가져오기: Get-Domain
다른 도메인 열거: Get-Domain -Domain <DomainName>
도메인 SID 가져오기: Get-DomainSID
도메인 정책 가져오기: ```powershell Get-DomainPolicy
#Will show us the policy configurations of the Domain about system access or kerberos Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess Get-DomainPolicy | Select-Object -ExpandProperty KerberosPolicy
도메인 컨트롤러 가져오기: ```powershell Get-DomainController Get-DomainController -Domain
도메인 사용자 열거: ```powershell #Save all Domain Users to a file Get-DomainUser | Out-File -FilePath .\DomainUsers.txt
#Will return specific properties of a specific user Get-DomainUser -Identity [username] -Properties DisplayName, MemberOf | Format-List
#Enumerate user logged on a machine Get-NetLoggedon -ComputerName
#Enumerate Session Information for a machine Get-NetSession -ComputerName
#Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain | Select-Object UserName, SessionFromName
도메인 컴퓨터 열거: ```powershell Get-DomainComputer -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName
#Enumerate Live machines Get-DomainComputer -Ping -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName
열거 그룹 및 그룹 구성원: ```powershell #Save all Domain Groups to a file: Get-DomainGroup | Out-File -FilePath .\DomainGroup.txt
#Return members of Specific Group (eg. Domain Admins & Enterprise Admins) Get-DomainGroup -Identity '' | Select-Object -ExpandProperty Member Get-DomainGroupMember -Identity '' | Select-Object MemberDistinguishedName
#Enumerate the local groups on the local (or remote) machine. Requires local admin rights on the remote machine Get-NetLocalGroup | Select-Object GroupName
#Enumerates members of a specific local group on the local (or remote) machine. Also requires local admin rights on the remote machine Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain
#Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName
공유 열거: ```powershell #Enumerate Domain Shares Find-DomainShare
#Enumerate Domain Shares the current user has access Find-DomainShare -CheckShareAccess
#Enumerate "Interesting" Files on accessible shares Find-InterestingDomainShareFile -Include passwords
그룹 정책 열거: ```powershell Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName
#Enumerate all GPOs to a specific computer Get-DomainGPO -ComputerIdentity -Properties DisplayName | Sort-Object -Property DisplayName
#Get users that are part of a Machine's local Admin group Get-DomainGPOComputerLocalGroupMapping -ComputerName
열거 OUs: ```powershell Get-DomainOU -Properties Name | Sort-Object -Property Name
ACLs 열거: ```powershell
Get-DomainObjectAcl -Identity -ResolveGUIDs
#Search for interesting ACEs Find-InterestingDomainAcl -ResolveGUIDs
#Check the ACLs associated with a specified path (e.g smb share) Get-PathAcl -Path "\Path\Of\A\Share"
도메인 트러스트 열거: ```powershell Get-DomainTrust Get-DomainTrust -Domain
#Enumerate all trusts for the current domain and then enumerates all trusts for each domain it finds Get-DomainTrustMapping
포리스트 트러스트 열거: ```powershell Get-ForestDomain Get-ForestDomain -Forest
#Map the Trust of the Forest Get-ForestTrust Get-ForestTrust -Forest
사용자 헌팅: ```powershell #Finds all machines on the current domain where the current user has local admin access Find-LocalAdminAccess -Verbose