11 lines
902 B
Markdown
11 lines
902 B
Markdown
- Note; a lot of this info is also contained in the "Windows" and "PowerShell" sections; this is for miscellaneous AD enum
|
|
|
|
- Enumerate all nested members of a group or all nested groups of a user with a raw LDAP query using OID
|
|
- `net ads search -k -s ad. local '(CN=Domain Admins)' memberof`
|
|
- Get groups of which "Domain Admins" is a member, without OID
|
|
- `net ads search -k -5 ad. local '(member:1.2.840.113556.1.4.1941:=CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn`
|
|
- Use OID to walk the nested groups and find out that Domain Admins is actually a member of more groups
|
|
- `net ads search -k -s ad. local '(CN=Domain Admins)' member`
|
|
- Find members of Domain Admins group without OID
|
|
- `net ads search -k -5 ad.local '(memberof:1.2.840.113556.1.4.1941: =CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn`
|
|
- Use OID to walk nested groups and get ALL effective members of Domain Admins |