We use the following tools to enumerate:
Active Directory PowerShell Module
Import-Module C:\AD\Tools\ADModule-master\Microsoft.ActiveDirectory.Management.dll
Import-Module C:\AD\Tools\ADModule-master\ActiveDirectory\ActiveDirectory.psd1
BloodHound: https://github.com/BloodHoundAD/BloodHound
PowerView: https://github.com/ZeroDayLab/PowerSploit/blob/master/Recon/PowerView.ps1
Load PowerView:
. C:\AD\Tools\PowerView.ps1
SharpView: https://github.com/tevora-threat/SharpView/
Common Enumeration Commands
Domain Enumeration
Get Current Domain:
Get-Domain (PowerView)
Get-ADDomain (ActiveDirectory Module)
Get object of another domain
Get-Domain -Domain moneycorp.local
Get-ADDomain -Identity moneycorp.local
Get domain SID for the current domain:
Get-DomainSID
(Get-ADDomain).DomainSID
Get domain policy for current domain:
Get-DomainPolicyData
(Get-DomainPolicyData).systemaccess
Get Domain policy for another domain
(Get-DomainPolicyData -domain moneycorp.local).systemaccess
Get Domain controllers for current domain
Get-DomainController
Get-ADDomainController
Get domain controllers for another domain
Get-DomainController -Domain moneycorp.local
Get-ADDomainController -DomainName moneycorp.local -Discover
Get a list of computers in the current domain
Get-DomainComputer | select Name
Get-DomainComputer -OperatingSystem "*Server 2022*"
Get-DomainComputer -Ping
Get-ADComputer -Filter * | select Name
Get-ADComputer -Filter * -Properties *
Get-ADComputer -Filter 'OperatingSystem -like "*Server 2022*"' -Properties OperatingSystem | select Name,OperatingSystem
Get-ADComputer -Filter * -Properties DNSHostName | %{TestConnection -Count 1 -ComputerName $_.DNSHostName}
Misc
Get actively logged users on a computer (needs local admin rights on the target)
Get-NetLoggedon -ComputerName dcorp-adminsrv
Get locally logged users on a computer (needs remote registry on the target - started by-default on server OS)
Get-LoggedonLocal -ComputerName dcorp-adminsrv
Get the last logged user on a computer (needs administrative rights and remote registry on the target)
Get-LastLoggedOn -ComputerName dcorp-adminsrv
Find shares on hosts in current domain.
Invoke-ShareFinder -Verbose
Find sensitive files on computers in the domain
Invoke-FileFinder -Verbose
Get all fileservers of the domain
Last updated