AD Module and PowerView

• Generate Metasploit payloads using msfvenom

• Using Metasploit payloads with an AMSI bypass stager from memory

Tools

Tool	GIT
AD Module	https://github.com/samratashok/ADModule
PowerView	https://github.com/PowerShellMafia/PowerSploit
SharpView	https://github.com/tevora-threat/SharpView

PowerView Enumeration

Command	Description
Get-NetDomain	Get current domain
Get-DomainSID	Get domain SID for the current domain
Get-NetDomainController	Get domain controllers for the current domain
Get-NetUser Get-NetUser –Username fileadmin	Get a list of users in the current domain
Find-UserField -SearchField Description -SearchTerm "built"	Search for a particular string in a user's attributes
Get-NetComputer Get-NetComputer –OperatingSystem "Server 2019"	Get a list of computers in the current domain
Get-NetGroup	Get all the groups in the current domain
Get-NetGroupMember -GroupName "Domain Admins" -Recurse	Get all the members of the Domain Admins group
Get-NetGroup –UserName "fileadmin"	Get the group membership for a user

AD Module Enumeration

Command	Description
Get-ADDomain	Get current domain
(Get-ADDomain).DomainSID	Get domain SID for the current domain
Get-ADDomainController	Get domain controllers for the current domain
Get-ADUser -Filter * -Properties * Get-ADUser -Identity fileadmin -Properties *	Get a list of users in the current domain
Get-ADUser -Filter 'Description -like "built"' -Properties Description | select name,Description	Search for a particular string in a user's attributes
Get-ADComputer -Filter * | select Name Get-ADComputer -Filter 'OperatingSystem -like "Server 2019"' - Properties OperatingSystem | select Name,OperatingSystem	Get a list of computers in the current domain
Get-ADGroup -Filter * | select Name	Get all the groups in the current domain
Get-ADGroupMember -Identity "Domain Admins" -Recursive	Get all the members of the Domain Admins group
Get-ADPrincipalGroupMembership -Identity fileadmin	Get the group membership for a user