432cc017ba
Add the EncPart param to Request-SPNTicket
...
Adds the ability to return the encrypted part of the ticket.
This portion is the encrypted data that can be brute-forced with Kerberoast/Hashcat/JtR
2016-08-25 12:27:15 +03:00
038adce56e
type
2016-07-15 17:34:23 -04:00
b74e515198
Fix for issue #167
2016-07-15 17:33:04 -04:00
325cc849d7
Use correct variable
2016-06-27 17:53:59 +02:00
5a05a024b6
Fix Get-GroupsXML for multiple <Group> tags
...
Select all <Group> nodes and iterate through them, not just the root
<Groups> node.
2016-06-27 17:52:28 +02:00
81ac124f22
Changed Get-NetGroup and Get-NetGroupMember to search for samaccountname instead of name
2016-06-24 16:51:16 -04:00
3049211f53
Fixed Find-LocalAdminAccess to properly check for the object output from Invoke-CheckLocalAdminAccess...whoops
2016-06-24 16:11:20 -04:00
cd1e10b8fd
Turned Get-GptTmpl and Get-GroupsXML into filters
2016-06-24 16:07:26 -04:00
3585c9b4ac
Add missing parenthesis
2016-06-21 20:31:28 +01:00
7dfbb059e1
Check class type
...
Recurse if localgroup as well as domaingroup
Normalize output values to empty string
2016-06-21 20:29:40 +01:00
4b40e8609c
Fixed logic bugs in Find-GPOLocation and Find-GPOComputerAdmin
2016-06-14 18:23:52 -04:00
31c2290d5e
Fixed some Invoke-MapDomainTrust and Get-NetDomainTrust logic
...
Changed domain/forest Write-Warning's to Write-Verbose
2016-06-12 20:53:36 -04:00
9cd0955c5d
Cleaned up Get-NetGroup's logic a bit, removed filtering for primary group ID (i.e. domain users)
...
Modified Get-DomainSID to simplify
Changed group determination in Get-NetLocalGroup -API
Few optimizations to Find-ForeignUser and Find-ForeignGroup
Changed DNS resolution method for Invoke-UserHunter
Added 'PowerView.GPOLocalGroup' type to Find-GPOLocation
2016-06-12 19:37:17 -04:00
8270743fb1
Fixed thread countdown timer in Invoke-ThreadedFunction, wasn't ever killing rogue jobs
2016-06-11 00:26:40 -04:00
c53cd87d8f
Fixed LDAP preference for when -ADSPath is passed to Get-NetDomainTrust
...
Fixed Get-DomainSID to allow for a -DomainController parameter
Fixed Get-NetDomainTrust logic
2016-06-08 01:35:33 -04:00
b5172c2bef
Fixed a few GC bugs in Get-DomainSearcher
...
Added attempted gpcfilesyspath resolution to Get-NetGPO
Added -ADSPath for Get-NetDomainTrust
2016-06-08 00:44:24 -04:00
d37ec66c79
bug fixes/error handling in Get-NetGPOGroup for version 2
2016-06-07 15:36:39 -04:00
b6306a0d8c
Small bug fix in Find-GPOLocation when enumerating all relationships
...
Moved GPOType check to Get-NetGPOGroup
Expanded comments and help for GPO location cmdlets
2016-06-06 21:37:36 -04:00
f6ee5cb92e
Rewrote/corrected logic for Get-NetGPOGroup, Find-GPOLocation, and Find-GPOComputerAdmin
...
Rewrote/corrected logic for Find-GPOLocation
Added Get-IniContent and rewrote Get-GptTmpl to use Get-IniContent to parse GptTmpl.inf files
Rewrote Get-GroupsXML to not resolve SIDs and return the same object type as Get-GptTmpl
2016-06-06 06:21:02 -04:00
848f7d31ce
Corrected error checking for functions that used GetLastError
...
General errors are now parsed with [ComponentModel.Win32Exception] and written with Write-Verbose
Write-Debug calls converted to Write-Verbose or removed
2016-05-31 23:14:05 -04:00
d0b21c0848
Updated functions in Recon.psd1
2016-05-22 14:41:05 -04:00
df2f92899a
-Fixed bug in Get-NetGroupMember's ranged searching logic on PowerShell v3+
...
-Corrected parameter/variable scoping bug in several functions
-TODO: fix begin{} scoping issues in Find-InterestingFile, Invoke-UserHunter, Invoke-ProcessHunter, Invoke-EventHunter, Invoke-ShareFinder, Invoke-FileFinder, Find-LocalAdminAccess, Invoke-EnumerateLocalAdmin
-Other misc. fixes
2016-05-22 14:40:40 -04:00
b568271d57
Get-LoggedOnLocal now handles the situation when multiple SIDs are returned
...
Get-LoggedOnLocal turned into a filter and given additional error handling
Standardized tab/line spacing
Removed Invoke-PSLoggedOn
2016-05-22 14:07:37 -04:00
2e6c9392c9
Merge pull request #133 from breakersall/dev
...
Adds PSLoggedOn like functionality
2016-05-22 14:02:49 -04:00
666246362f
Merge pull request #140 from Meatballs1/fix_groups_xml
...
PowerView - Fix Groups.xml Parsing
2016-05-18 11:10:18 -04:00
c89f0b9969
Logic bug fix in Get-NetDomainTrust
2016-05-13 01:11:47 -04:00
56824c1799
Get-NetDomainTrust now gets an -API option to enumerate trusts through DsEnumerateDomainTrusts()
...
Logic bug fix for Get-DNSZone
Bug fix for Get-NetLocalGroup
2016-05-13 01:07:24 -04:00
3e936765f5
Fix groupsxml parsing
2016-05-12 21:03:20 +01:00
30324b7c5e
Merge pull request #135 from Meatballs1/trust_sids
...
Retrieve Domain SIDs with -LDAP
2016-05-09 21:24:57 -07:00
7b4becfe72
Added Invoke-UserHunter field to keep output objects in sync.
2016-05-10 00:14:37 -04:00
9f7906280d
Added name resolution to custom PSObject generated by Invoke-UserHunter.
2016-05-10 00:01:38 -04:00
6ada127538
Began adding custom PSObject TypeNames to various PowerView output objects.
2016-05-09 23:22:51 -04:00
6a39c26b06
Retrieve Domain SIDs with -LDAP
2016-05-09 22:24:23 +01:00
0cedaf6142
Adds PSLoggedOn like functionality
...
Adding in Get-LoggedOnLocal which uses HKU registry checks to see who
is logged locally to a remote box and only requires user level access
rights. The benefit over NetWkstaUserEnum is less user privileges
required (admin for NetWkstaUserEnum) and is the same process
PSLoggedOn uses.
Invoke-PSLoggedOn launches both Get-LoggedOnLocal and Get-NetSessions
and outputs the same format as PSLoggedOn.exe from Sysinternals.
I did not change Invoke-UserHunter non-stealth to this option yet, but
it is beneficial in that if you use both HKU and NetSessionEnum you
only require basic user level rights not admin remote.
2016-05-05 19:12:33 -05:00
26cef85d35
Added Get-RegistryMountedDrive
2016-05-03 22:52:36 -04:00
fbf6f30833
Modified Convert-DNSRecord to return the base64 encoded record for record types not currently handled.
2016-04-27 19:11:49 -04:00
1f90c29429
Added Get-DNSZone and Get-DNSRecord to enumerate AD DNS information.
...
Added Convert-DNSRecord (ported from Michael B. Smith's code at https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1 ) - needs expansion work on record types
2016-04-27 18:42:51 -04:00
68c446b9b9
Changed some property types in Get-ObjectACL
2016-04-25 19:52:39 -04:00
4cedfa1c30
added Request-SPNTicket to request kerberos tickets for specified SPNs
2016-04-24 10:56:07 -04:00
c52f9d712c
For PowerView, added $Searcher.CacheResults = $False to Get-DomainSearcher
...
Added dispose() approach for the following cmdlets:
Get-NetUser, Get-ObjectAcl/Add-ObjectAcl, Get-GUIDMap, Get-NetComputer, Get-ADObject, Get-NetOU, Get-NetSite, Get-NetSubnet, Get-NetGroup, Get-NetGroupMember, Get-DFSshare, Get-NetGPO, Get-NetDomainTrust
2016-04-24 06:57:36 -04:00
7ed5343431
Merge pull request #128 from Meatballs1/fix_groups_xml
...
//Group -> //Groups
2016-04-24 12:17:48 +02:00
c8ff194089
Change ComputerName default to the computer's name
...
Change ComputerName default so Disabled doesn't report error
2016-04-11 11:02:31 +01:00
6daaef2706
//Group -> //Groups
2016-04-03 08:09:33 +01:00
37389e9658
Bug fix in Find-GPOLocation
2016-03-18 06:13:05 -04:00
26a0757612
Added Get-SiteName to find the site a computer is a part of
...
Added -ComputerName parameter to Get-NetGPO to enumerate all GPOs a given computer has applied
Fixed bug in Find-GPOComputerAdmin and added site enumeration for GPO links
2016-03-15 15:13:32 -04:00
dee094a993
Additional error checking in Get-DFSshare
2016-03-11 16:37:14 -05:00
2e1d49db33
Fixed bug with Get-NetGroupMember and computer accounts.
...
samaccounttype enumeration now more accurate.
2016-03-09 20:02:18 -05:00
625705781e
fix for Find-GPOComputerAdmin
2016-03-09 16:23:27 -05:00
2e0197603c
Bug fix for Invoke-EnumerateLocalAdmin
2016-03-09 15:37:38 -05:00
236b16430c
Removed Set-MacAttribute and Copy-ClonedFile
...
Combined Convert-NT4toCanonical and Convert-DomainSimpletoNT4 into Convert-ADName
2016-03-09 15:08:27 -05:00
Matan Hart