Giters

WHOISshuvam / AD-Pentesting-Notes

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

User Management (Password Reset)

Set-ADAccountPassword sophie -Reset -NewPassword (Read-Host -AsSecureString -Prompt 'New Password') -Verbose
 Set-ADUser -ChangePasswordAtLogon $true -Identity sophie -Verbose

Local Username Enumeration

  • Enumerating User
(cmd) echo %USERNAME% | whoami
thm-winfun2\administrator
(In Powershell) $env:username
Administrator

Disable Powershell Historyy first

Set-PSReadlineOption -HistorySaveStyle SaveNothing

Checking Privilege

whoami /priv

whoami /groups

Screenshot at 2023-01-04 10-37-28

  • Check Users :

  • $net user

  • $whoami /all

  • Useful Powershell Commands

  • Get-LocalUser | ft Name,Enabled,LastLogon (ft displays only those columns containing Name, Enabled, LastLogon)

Screenshot at 2023-01-04 10-46-01

  • Get-ChildItem C:\Users\ -Force | select Name

Screenshot at 2023-01-04 10-49-21

  • $net accounts (Gives minimum and maximum days of password, Useful During Bruteforce)

  • $net user Administrator (Gives Informaton About Administrator account) Screenshot at 2023-01-04 10-54-57

  • Get-LocalGroup

  • net localgroup Administrator (Lists groups of Specific User & Works on cmd )

  • Get-LocalGroup Administrators Screenshot at 2023-01-04 11-13-22

Network Enumeration

  • Check the ip address, Default gateway, hostname etc.
  • $ Get-NetIPConfiguration | InterfaceAlias,InterfaceDescription,IPv4Address
  • $ Get-DnsClientServerAddress

*Check Routing Information

  • route print

  • Get-NetRoute -AddressFamily IPv4/IPv6

  • arp -a (Prints arp table) Screenshot at 2023-01-04 11-33-17

  • Get-NetNeighbor -AddressFamily IPv4

Screenshot at 2023-01-04 11-38-32

  • netstat -ano
  • Check Firewall Status
  • netsh firewall show state
  • netsh firewall show config
  • Disable Firewall
  • netsh firewall set opmode disable (Disable Firewall)
  • netsh firewall set opmode disable (Disable all Profiles)

Antivirus and Detection

  • Get-MpComputerStatus
  • CheckFirewall logs
  • netsh advfirewall show domain

Screenshot at 2023-01-04 11-57-33

  • Set-MpPreference -DisableRealtimeMonitoring $true (Disable Realtime Monitoring)

Hunting Passwords

  • Password Hash Location in Windows
  • C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM (Combine both files using samdump and crack using john)
  • Grep Strings containing password [cd C:\ & findstr /SI /M "password" *.xml *.txt *.ini]

Check Windows Activities

  • Go to event viewer and use filters. For eg. to see login activity use filter 4624 in event id.
  • 4672 for time stamp.

About