# 12.Credentialed Enumeration - from Windows

**1. Active Directory PowerShell Module**

**Function:** Administers Active Directory from the command line.

**Key Cmdlets:**

* `Get-Module`: Lists available modules.
* `Import-Module ActiveDirectory`: Loads the module.
* `Get-ADDomain`: Retrieves domain information.
* `Get-ADUser`: Retrieves user information.
* `Get-ADTrust`: Retrieves domain trust relationships.
* `Get-ADGroup`: Retrieves group information.
* `Get-ADGroupMember`: Retrieves group membership.

**Commands:**

```powershell
Get-Module
Import-Module ActiveDirectory
Get-ADDomain
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName
Get-ADTrust -Filter *
Get-ADGroup -Filter * | select name
Get-ADGroup -Identity "Backup Operators"
Get-ADGroupMember -Identity "Backup Operators"
```

**Significance:** Built-in and stealthy enumeration.

***

**2.** [**PowerView**](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon)**/SharpView**

**Function:** Gains situational awareness within an AD environment.

**Key Functions (PowerView):**

* `Get-DomainUser`: Retrieves user information.
* `Get-DomainGroupMember`: Retrieves group membership.
* `Get-DomainTrustMapping`: Retrieves domain trust mappings.
* `Test-AdminAccess`: Tests for local admin access.
* `Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName`: Finds users with SPN.
* `Get-DomainGPO`: Enumerates Group Policy Objects.
* `Get-DomainUser -TrustedToAuth`: Finds users with unconstrained delegation.

**Key Functions (SharpView):**

* `Get-DomainUser`: Retrieves user information.

**PowerView Commands:**

```powershell
Get-DomainUser -Identity mmorgan -Domain inlanefreight.local | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,useraccountcontrol
Get-DomainGroupMember -Identity "Domain Admins" -Recurse
Get-DomainTrustMapping
Test-AdminAccess -ComputerName ACADEMY-EA-MS01
Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName
Get-DomainGPO
Get-DomainUser -TrustedToAuth
```

**SharpView Commands:**

```powershell
.\SharpView.exe Get-DomainUser -Identity forend
.\SharpView.exe Get-DomainUser -Help
```

**Significance:** Comprehensive enumeration and relationship mapping.

***

**3. Snaffler**

**Function:** Acquires credentials and sensitive data from file shares.

**Commands:**

```powershell
Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data
Snaffler.exe -s \\fileserver\shared -o snaffler.log -v data
```

**Significance:** Efficient sensitive data discovery.

***

#### Key Takeaways:

* Windows-based enumeration provides access to powerful tools.
* The ActiveDirectory PowerShell module offers stealthy built-in capabilities.
* PowerView/SharpView excels at relationship mapping and situational awareness.
* Snaffler quickly finds sensitive data within file shares.
* Always use the `-help` flag to learn available options.

#### Additional Considerations:

1.  **PowerShell's Get-Help:**

    ```powershell
    Get-Help Get-ADUser -Full
    ```

    * Similar to Linux `man` pages, PowerShell has built-in help.
2.  **PowerShell Module Discovery:**

    ```powershell
    Get-Command -Module ActiveDirectory
    ```

    * This helps in discovering available cmdlets.
3.  **PowerView Loading:**

    ```powershell
    Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
    Import-Module .\PowerView.ps1
    ```

    * Required since PowerView is not a built-in module and may need an execution policy bypass.
4.  **Snaffler Output Handling:**

    ```powershell
    Select-String -Path snaffler.log -Pattern "password|creds|admin"
    ```

    * Filters results for sensitive keywords.
5.  **Checking Active Directory Replication Metadata:**

    ```powershell
    Get-ADReplicationMetadata -Object "CN=Administrator,CN=Users,DC=domain,DC=com" -Server DC01
    ```

    * Useful for investigating AD replication.
