powerview

PowerView.ps1

Bypass execution policy

powershell -ep bypass

Get all users

Get-NetUser

net users /domain

Get all users with filter

Get-NetUser | select cn, memberof

Get information of a particular user

Get-NetUser -UserName admin

Get all groups

Get-NetGroup

User description check

#userdescription #checkuserdescription

Get-DomainUser * | Select-Object samaccountname,description |Where-Object {$_.Description -ne $null}

nxc ldap 10.10.11.32 -u '' -p '' --users | grep 'TypeUser'

User info field check

#userdescription #checkuserdescription

bloodyAD -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -d support.htb --host dc.support.htb --dns 10.10.11.174 get search --attr info

Limit groups to a particular domain

Get-NetGroup -Domain inlanefreight.local

Get all admin names

Get-NetGroup -AdminCount

Get all groups a user is member of

Get-NetGroup -UserName admin

Get specific group's users

Get-NetGroupMember -GroupName "Administrators"

Get all other computers in the domain

Get-NetComputer

Check all other computers are online

#livehosts #ping #scanhosts

Get-NetComputer -Ping

Get other computer OS information

Get-NetComputer -fulldata

Filter out computer OS information

Get-NetComputer -fulldata | select cn, operatingsystem

Domain enumeration (current domain information)

Get-NetDomain

Get SID of the current domain

Get-DomainSID

Get current domain policy

Get-DomainPolicy

Get domain controller information

Get-NetDomainController

Which computer we have admin access (IF you are DC)

Find-LocalAdminAccess

Get all local admins

Invoke-EnumerateLocalAdmin

Get domain policies

Get-NetGPO

Get all active sessions/logon users

Get-NetLoggedon -ComputerName domain-controller.inlanefreight.local

Get last loggedon users

Get-LastLoggedon -ComputerName domain-controller.inlanefreight.local

Get RDP sessions

Get-NetRDPSession -ComputerName domain-controller.inlanefreight.local

Check recycle bin

[System.IO.Directory]::GetDirectories("C:\`$Recycle.Bin")

Cheat sheet

[PowerView-3.0 tips and tricks · GitHub](https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993)

---

AD PowerView

Get user info

Get-DomainUser -Identity mmorgan -Domain inlanefreight.local | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,useraccountcontrol

Get group membership recursive info

Get-DomainGroupMember -Identity "Domain Admins" -Recurse

Get domain trust info

Get-DomainTrustMapping

Testing for local admin/remote admin access

Test-AdminAccess -ComputerName <hostname>

Find users with SPN set (it may be subjected to a kerberoasting attack)

Get-DomainUser -SPN -Properties samaccountname, ServicePrincipleName