first commit

Windows/Active Directory for OSCP/Enumeration/PowerView Enumeration.md

@@ -0,0 +1,57 @@
+
+```sh
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+<# Get-NetLoggedOn 
+		This function will execute the NetWkstaUserEnum Win32API call to query
+		a given host for actively logged on users.
+#>
+- Get-NetComputer | Get-NetLoggedon
+
+<# Get-NetUser
+Return all users or specific user objects in AD
+
+		To only return specific properties, use
+"-Properties samaccountname,usnchanged,...". By default, all user objects for
+the current domain are returned.
+#>
+- Get-NetUser -UserName student107
+
+<# Get-NetComputer
+	Return all computers or specific computer objects in AD.
+		To only return specific properties, use
+"-Properties samaccountname,usnchanged,...". By default, all computer objects for
+the current domain are returned.
+#>
+- Get-NetComputer
+- Get-NetComputer -Unconstrained
+
+<# Get-DomainShare
+	Searches for computer shares on the domain. If -CheckShareAccess is passed,
+	then only shares the current user has read access to are returned.
+#>
+-	Find-DomainShare -CheckShareAccess -Domain svcorp.com -DomainController 10.11.1.20
+
+
+<# Get-DomainOU
+	Search for all organization units (OUs) or specific OU objects in AD.
+#>
+
+Get-DomainOU -Properties Name | sort -Property Name
+
+#Get Kerberoastable SPNs
+Get-NetUser -SPN | select serviceprincipalname
+
+Request-SPNTicket -SPN "MSSQLSvc/DC.access.offsec" -Format Hashcat
+
+#Get the count of all the Domain Admins in the domain
+Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#
+Get-NetComputer | select operatingsystem,dnshostname
+
+#
+Find-LocalAdminAccess
+
+```