• PowerSploit / PowerView

    Col­lec­tion of privsec scripts. To start, upload PowerView.ps1 and: powershell -exec bypass PS> Import-Module .\PowerView.ps1 See the github site for all commands. General enumeration powershell -exec bypass PS> . .\PowerUp.ps1 PS> Invoke-AllChecks Or: powershell.exe -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks" About users Enu­mer­ates all users. Get-NetUser Enu­mer­ate all users which does not require Ker­beros preauth. Get-NetUser -PreauthNotRequired Returns…

  • Active Directory notes

    Check­list A domain of a DC con­sists out of the fol­low­ing elements: An object in AD may have a set of ACE Access Con­trol Entries which is called ACL Access Con­trol List. An objec­t’s ACE can be retrieved in PS with Get-ObjectAcl [-Identity| $object. The SCM Ser­vice Con­trol Man­ag­er con­tains a data­base of installed ser­vices…