Powerview on MrAzoth https://az0th.it/tags/powerview/ Recent content in Powerview on MrAzoth Hugo -- 0.154.5 en-us Enumeration & Discovery — From Windows https://az0th.it/ad/windows/enumeration/ Mon, 01 Jan 0001 00:00:00 +0000 https://az0th.it/ad/windows/enumeration/ <h2 id="quick-reference">Quick Reference</h2> <table> <thead> <tr> <th>Technique</th> <th>Tool</th> <th>Privilege Needed</th> </tr> </thead> <tbody> <tr> <td>Domain / forest info</td> <td>Native AD cmdlets, PowerView</td> <td>Domain user</td> </tr> <tr> <td>User / group / computer enumeration</td> <td>Get-ADUser, Get-DomainUser</td> <td>Domain user</td> </tr> <tr> <td>SPN discovery (Kerberoast candidates)</td> <td>Get-ADUser, PowerView</td> <td>Domain user</td> </tr> <tr> <td>AdminSDHolder / privileged objects</td> <td>Get-ADObject</td> <td>Domain user</td> </tr> <tr> <td>ACL enumeration</td> <td>PowerView</td> <td>Domain user</td> </tr> <tr> <td>Local admin discovery</td> <td>Find-LocalAdminAccess</td> <td>Domain user</td> </tr> <tr> <td>Share discovery</td> <td>Find-DomainShare, Snaffler</td> <td>Domain user</td> </tr> <tr> <td>Full graph collection</td> <td>SharpHound</td> <td>Domain user</td> </tr> <tr> <td>Host recon</td> <td>Seatbelt</td> <td>Local user (some checks need admin)</td> </tr> <tr> <td>Session enumeration</td> <td>SharpHound, NetSessionEnum</td> <td>Local admin (remote hosts)</td> </tr> <tr> <td>GPO enumeration</td> <td>PowerView</td> <td>Domain user</td> </tr> <tr> <td>Trust mapping</td> <td>Get-DomainTrust, nltest</td> <td>Domain user</td> </tr> </tbody> </table> <hr> <h2 id="native-ad-cmdlets">Native AD Cmdlets</h2> <p>No extra tooling required. Requires the <code>ActiveDirectory</code> PowerShell module, which is present on domain-joined systems with RSAT installed, or can be imported from a DC.</p> Delegation Attacks — From Windows https://az0th.it/ad/windows/delegation-attacks/ Mon, 01 Jan 0001 00:00:00 +0000 https://az0th.it/ad/windows/delegation-attacks/ Abusing Kerberos delegation (Unconstrained, Constrained, RBCD, Shadow Credentials) from a Windows foothold using Rubeus, PowerView, and PowerMad. Domain & Forest Trusts — From Windows https://az0th.it/ad/windows/domain-trusts/ Mon, 01 Jan 0001 00:00:00 +0000 https://az0th.it/ad/windows/domain-trusts/ Enumerating and exploiting Active Directory domain and forest trusts from a Windows foothold: SID history injection, golden ticket cross-domain, inter-realm key abuse.