From 6aca12a956452ca40168c71303032c8a80ebf0b4 Mon Sep 17 00:00:00 2001 From: HarmJ0y Date: Mon, 12 Dec 2016 20:36:42 -0500 Subject: Typo correction and Recon README.md update --- Recon/PowerView.ps1 | 12 ++-- Recon/README.md | 164 +++++++++++++++++++++++++--------------------------- Recon/Recon.psd1 | 2 +- 3 files changed, 87 insertions(+), 91 deletions(-) (limited to 'Recon') diff --git a/Recon/PowerView.ps1 b/Recon/PowerView.ps1 index af2d36d..91484d8 100755 --- a/Recon/PowerView.ps1 +++ b/Recon/PowerView.ps1 @@ -8642,7 +8642,7 @@ function Get-DomainGroupMember { <# .SYNOPSIS -Return the memberes of a specific domain group. +Return the members of a specific domain group. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause @@ -11635,7 +11635,7 @@ function Get-NetLocalGroup { <# .SYNOPSIS -Eunmerates the local groups on the local (or remote) machine. +Enumerates the local groups on the local (or remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause @@ -11815,7 +11815,7 @@ function Get-NetLocalGroupMember { <# .SYNOPSIS -Eunmerates members of a specific local group on the local (or remote) machine. +Enumerates members of a specific local group on the local (or remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause @@ -13594,7 +13594,7 @@ function Get-WMIProcess { <# .SYNOPSIS -Gets a list of processes and their owners on the local or remote machine +Returns a list of processes and their owners on the local or remote machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause @@ -14069,7 +14069,7 @@ function Find-DomainUserLocation { <# .SYNOPSIS -Finds domains machines where specific users are logged into. +Finds domain machines where specific users are logged into. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause @@ -17758,7 +17758,7 @@ function Get-DomainTrustMapping { <# .SYNOPSIS -This function enumeartes all trusts for the current domain and then enumerates +This function enumerates all trusts for the current domain and then enumerates all trusts for each domain it finds. Author: Will Schroeder (@harmj0y) diff --git a/Recon/README.md b/Recon/README.md index 6e28a30..acc2627 100644 --- a/Recon/README.md +++ b/Recon/README.md @@ -34,96 +34,92 @@ an array of hosts from the pipeline. ### Misc Functions: Export-PowerViewCSV - thread-safe CSV append - Set-MacAttribute - Sets MAC attributes for a file based on another file or input (from Powersploit) - Copy-ClonedFile - copies a local file to a remote location, matching MAC properties - Get-IPAddress - resolves a hostname to an IP - Test-Server - tests connectivity to a specified server - Convert-NameToSid - converts a given user/group name to a security identifier (SID) - Convert-SidToName - converts a security identifier (SID) to a group/user name - Convert-NT4toCanonical - converts a user/group NT4 name (i.e. dev/john) to canonical format - Get-Proxy - enumerates local proxy settings + Resolve-IPAddress - resolves a hostname to an IP + ConvertTo-SID - converts a given user/group name to a security identifier (SID) + Convert-ADName - converts object names between a variety of formats + ConvertFrom-UACValue - converts a UAC int value to human readable form + Add-RemoteConnection - pseudo "mounts" a connection to a remote path using the specified credential object + Remove-RemoteConnection - destroys a connection created by New-RemoteConnection + Invoke-UserImpersonation - creates a new "runas /netonly" type logon and impersonates the token + Invoke-RevertToSelf - reverts any token impersonation + Get-DomainSPNTicket - request the kerberos ticket for a specified service principal name (SPN) + Invoke-Kerberoast - requests service tickets for kerberoast-able accounts and returns extracted ticket hashes Get-PathAcl - get the ACLs for a local/remote file path with optional group recursion - Get-UserProperty - returns all properties specified for users, or a set of user:prop names - Get-ComputerProperty - returns all properties specified for computers, or a set of computer:prop names - Find-InterestingFile - search a local or remote path for files with specific terms in the name - Invoke-CheckLocalAdminAccess - check if the current user context has local administrator access to a specified host - Get-DomainSearcher - builds a proper ADSI searcher object for a given domain - Get-ObjectAcl - returns the ACLs associated with a specific active directory object - Add-ObjectAcl - adds an ACL to a specified active directory object - Get-LastLoggedOn - return the last logged on user for a target host - Get-CachedRDPConnection - queries all saved RDP connection entries on a target host - Invoke-ACLScanner - enumerate -1000+ modifable ACLs on a specified domain - Get-GUIDMap - returns a hash table of current GUIDs -> display names - Get-DomainSID - return the SID for the specified domain - Invoke-ThreadedFunction - helper that wraps threaded invocation for other functions - - -### net * Functions: - Get-NetDomain - gets the name of the current user's domain - Get-NetForest - gets the forest associated with the current user's domain - Get-NetForestDomain - gets all domains for the current forest - Get-NetDomainController - gets the domain controllers for the current computer's domain - Get-NetUser - returns all user objects, or the user specified (wildcard specifiable) - Add-NetUser - adds a local or domain user - Get-NetComputer - gets a list of all current servers in the domain - Get-NetPrinter - gets an array of all current computers objects in a domain - Get-NetOU - gets data for domain organization units - Get-NetSite - gets current sites in a domain - Get-NetSubnet - gets registered subnets for a domain - Get-NetGroup - gets a list of all current groups in a domain - Get-NetGroupMember - gets a list of all current users in a specified domain group - Get-NetLocalGroup - gets the members of a localgroup on a remote host or hosts - Add-NetGroupUser - adds a local or domain user to a local or domain group - Get-NetFileServer - get a list of file servers used by current domain users - Get-DFSshare - gets a list of all distribute file system shares on a domain - Get-NetShare - gets share information for a specified server - Get-NetLoggedon - gets users actively logged onto a specified server - Get-NetSession - gets active sessions on a specified server - Get-NetRDPSession - gets active RDP sessions for a specified server (like qwinsta) - Get-NetProcess - gets the remote processes and owners on a remote server - Get-UserEvent - returns logon or TGT events from the event log for a specified host - Get-ADObject - takes a domain SID and returns the user, group, or computer - object associated with it - Set-ADObject - takes a SID, name, or SamAccountName to query for a specified - domain object, and then sets a specified 'PropertyName' to a - specified 'PropertyValue' + + +### Domain/LDAP Functions: + Get-DomainDNSZone - enumerates the Active Directory DNS zones for a given domain + Get-DomainDNSRecord - enumerates the Active Directory DNS records for a given zone + Get-Domain - returns the domain object for the current (or specified) domain + Get-DomainController - return the domain controllers for the current (or specified) domain + Get-Forest - returns the forest object for the current (or specified) forest + Get-ForestDomain - return all domains for the current (or specified) forest + Get-ForestGlobalCatalog - return all global catalogs for the current (or specified) forest + Find-DomainObjectPropertyOutlier- inds user/group/computer objects in AD that have 'outlier' properties set + Get-DomainUser - return all users or specific user objects in AD + New-DomainUser - creates a new domain user (assuming appropriate permissions) and returns the user object + Get-DomainUserEvent - enumerates account logon events (ID 4624) and Logon with explicit credential events + Get-DomainComputer - returns all computers or specific computer objects in AD + Get-DomainObject - returns all (or specified) domain objects in AD + Set-DomainObject - modifies a gven property for a specified active directory object + Get-DomainObjectAcl - returns the ACLs associated with a specific active directory object + Add-DomainObjectAcl - adds an ACL for a specific active directory object + Find-InterestingDomainAcl - finds object ACLs in the current (or specified) domain with modification rights set to non-built in objects + Get-DomainOU - search for all organization units (OUs) or specific OU objects in AD + Get-DomainSite - search for all sites or specific site objects in AD + Get-DomainSubnet - search for all subnets or specific subnets objects in AD + Get-DomainSID - returns the SID for the current domain or the specified domain + Get-DomainGroup - return all groups or specific group objects in AD + New-DomainGroup - creates a new domain group (assuming appropriate permissions) and returns the group object + Get-DomainManagedSecurityGroup - returns all security groups in the current (or target) domain that have a manager set + Get-DomainGroupMember - return the members of a specific domain group + Add-DomainGroupMember - adds a domain user (or group) to an existing domain group, assuming appropriate permissions to do so + Get-DomainFileServer - returns a list of servers likely functioning as file servers + Get-DomainDFSShare - returns a list of all fault-tolerant distributed file systems for the current (or specified) domain ### GPO functions - Get-GptTmpl - parses a GptTmpl.inf to a custom object - Get-NetGPO - gets all current GPOs for a given domain - Get-NetGPOGroup - gets all GPOs in a domain that set "Restricted Groups" - on on target machines - Find-GPOLocation - takes a user/group and makes machines they have effective - rights over through GPO enumeration and correlation - Find-GPOComputerAdmin - takes a computer and determines who has admin rights over it - through GPO enumeration - Get-DomainPolicy - returns the default domain or DC policy + Get-DomainGPO - returns all GPOs or specific GPO objects in AD + Get-DomainGPOLocalGroup - returns all GPOs in a domain that modify local group memberships through 'Restricted Groups' or Group Policy preferences + Get-DomainGPOUserLocalGroupMapping - enumerates the machines where a specific domain user/group is a member of a specific local group, all through GPO correlation + Get-DomainGPOComputerLocalGroupMapping - takes a computer (or GPO) object and determines what users/groups are in the specified local group for the machine through GPO correlation + Get-DomainPolicy - returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller -### User-Hunting Functions: - Invoke-UserHunter - finds machines on the local domain where specified users are logged into, and can optionally check if the current user has local admin access to found machines - Invoke-StealthUserHunter - finds all file servers utilizes in user HomeDirectories, and checks the sessions one each file server, hunting for particular users - Invoke-ProcessHunter - hunts for processes with a specific name or owned by a specific user on domain machines - Invoke-UserEventHunter - hunts for user logon events in domain controller event logs +### Computer Enumeration Functions + + Get-NetLocalGroup - enumerates the local groups on the local (or remote) machine + Get-NetLocalGroupMember - enumerates members of a specific local group on the local (or remote) machine + Get-NetShare - returns open shares on the local (or a remote) machine + Get-NetLoggedon - returns users logged on the local (or a remote) machine + Get-NetSession - returns session information for the local (or a remote) machine + Get-RegLoggedOn - returns who is logged onto the local (or a remote) machine through enumeration of remote registry keys + Get-NetRDPSession - returns remote desktop/session information for the local (or a remote) machine + Test-AdminAccess - rests if the current user has administrative access to the local (or a remote) machine + Get-NetComputerSiteName - returns the AD site where the local (or a remote) machine resides + Get-WMIRegProxy - enumerates the proxy server and WPAD conents for the current user + Get-WMIRegLastLoggedOn - returns the last user who logged onto the local (or a remote) machine + Get-WMIRegCachedRDPConnection - returns information about RDP connections outgoing from the local (or remote) machine + Get-WMIRegMountedDrive - returns information about saved network mounted drives for the local (or remote) machine + Get-WMIProcess - returns a list of processes and their owners on the local or remote machine + Find-InterestingFile - searches for files on the given path that match a series of specified criteria -### Domain Trust Functions: - Get-NetDomainTrust - gets all trusts for the current user's domain - Get-NetForestTrust - gets all trusts for the forest associated with the current user's domain - Find-ForeignUser - enumerates users who are in groups outside of their principal domain - Find-ForeignGroup - enumerates all the members of a domain's groups and finds users that are outside of the queried domain - Invoke-MapDomainTrust - try to build a relational mapping of all domain trusts - - -### MetaFunctions: - Invoke-ShareFinder - finds (non-standard) shares on hosts in the local domain - Invoke-FileFinder - finds potentially sensitive files on hosts in the local domain - Find-LocalAdminAccess - finds machines on the domain that the current user has local admin access to - Find-ManagedSecurityGroups - searches for active directory security groups which are managed and identify users who have write access to - - those groups (i.e. the ability to add or remove members) - Find-UserField - searches a user field for a particular term - Find-ComputerField - searches a computer field for a particular term - Get-ExploitableSystem - finds systems likely vulnerable to common exploits - Invoke-EnumerateLocalAdmin - enumerates members of the local Administrators groups across all machines in the domain +### Threaded 'Meta'-Functions + + Find-DomainUserLocation - finds domain machines where specific users are logged into + Find-DomainProcess - finds domain machines where specific processes are currently running + Find-DomainUserEvent - finds logon events on the current (or remote domain) for the specified users + Find-DomainShare - finds reachable shares on domain machines + Find-InterestingDomainShareFile - searches for files matching specific criteria on readable shares in the domain + Find-LocalAdminAccess - finds machines on the local domain where the current user has local administrator access + Find-DomainLocalGroupMember - enumerates the members of specified local group on machines in the domain + + +### Domain Trust Functions: + Get-DomainTrust - returns all domain trusts for the current domain or a specified domain + Get-ForestTrust - returns all forest trusts for the current forest or a specified forest + Get-DomainForeignUser - enumerates users who are in groups outside of the user's domain + Get-DomainForeignGroupMember - enumerates groups with users outside of the group's domain and returns each foreign member + Get-DomainTrustMapping - this function enumerates all trusts for the current domain and then enumerates all trusts for each domain it finds diff --git a/Recon/Recon.psd1 b/Recon/Recon.psd1 index 64953b0..6cdcfba 100644 --- a/Recon/Recon.psd1 +++ b/Recon/Recon.psd1 @@ -90,7 +90,7 @@ FunctionsToExport = @( 'Find-DomainShare', 'Find-InterestingDomainShareFile', 'Find-LocalAdminAccess', - 'Get-DomainLocalGroupMember', + 'Find-DomainLocalGroupMember', 'Get-DomainTrust', 'Get-ForestTrust', 'Get-DomainForeignUser', -- cgit v1.2.3