s1ckb0y1337/active-directory-exploitation-cheat-sheetUma folha de dicas que contém métodos comuns de enumeração e ataque para o Active Directory do Windows.
Esta folha de dicas contém métodos comuns de enumeração e ataque para o Windows Active Directory.
ℹ️ Este repositório foi criado por Nikos Katsiopis e Nikos Vourdas.
Esta folha de dicas é inspirada pelo repositório PayloadAllTheThings.
Powerview v.3.0
Wiki do PowerView
Obter Domínio Atual: Get-Domain
Enumerar Outros Domínios: Get-Domain -Domain <DomainName>
Obter SID do Domínio: Get-DomainSID
Obter Política de Domínio: ```powershell Get-DomainPolicy
#Will show us the policy configurations of the Domain about system access or kerberos Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess Get-DomainPolicy | Select-Object -ExpandProperty KerberosPolicy
Obter Controladores de Domínio: ```powershell Get-DomainController Get-DomainController -Domain
Enumerar Usuários do Domínio: ```powershell #Save all Domain Users to a file Get-DomainUser | Out-File -FilePath .\DomainUsers.txt
#Will return specific properties of a specific user Get-DomainUser -Identity [username] -Properties DisplayName, MemberOf | Format-List
#Enumerate user logged on a machine Get-NetLoggedon -ComputerName
#Enumerate Session Information for a machine Get-NetSession -ComputerName
#Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain | Select-Object UserName, SessionFromName
Enumerar Computadores do Domínio: ```powershell Get-DomainComputer -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName
#Enumerate Live machines Get-DomainComputer -Ping -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName
Enumerar Grupos e Membros do Grupo: ```powershell #Save all Domain Groups to a file: Get-DomainGroup | Out-File -FilePath .\DomainGroup.txt
#Return members of Specific Group (eg. Domain Admins & Enterprise Admins) Get-DomainGroup -Identity '' | Select-Object -ExpandProperty Member Get-DomainGroupMember -Identity '' | Select-Object MemberDistinguishedName
#Enumerate the local groups on the local (or remote) machine. Requires local admin rights on the remote machine Get-NetLocalGroup | Select-Object GroupName
#Enumerates members of a specific local group on the local (or remote) machine. Also requires local admin rights on the remote machine Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain
#Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName
Enumerar Compartilhamentos: ```powershell #Enumerate Domain Shares Find-DomainShare
#Enumerate Domain Shares the current user has access Find-DomainShare -CheckShareAccess
#Enumerate "Interesting" Files on accessible shares Find-InterestingDomainShareFile -Include passwords
Enum Políticas de Grupo: ```powershell Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName
#Enumerate all GPOs to a specific computer Get-DomainGPO -ComputerIdentity -Properties DisplayName | Sort-Object -Property DisplayName