Skip to content
Disclaimer: This material is provided solely for educational purposes. You are fully responsible for how you use the information.
We do not encourage any kind of illegal or harmful activity.

ACTIVE DIRECTORY POWERSHELL MODULE

The Active Directory PowerShell module provides cmdlets for administering and querying an AD environment from the command line.

  1. Loading the Active Directory Module
    Import-Module ActiveDirectory

  2. Enumerating Domain Information
    Get-ADDomain

  3. Enumerating Users with Service Principal Names
    Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

  4. Checking for Trust Relationships
    Get-ADTrust -Filter *

  5. Enumerating Groups
    Get-ADGroup -Filter *

  6. Detailed Group Information
    Get-ADGroup -Identity "[GROUP]"

  7. Enumerating Group Members
    Get-ADGroupMember -Identity "[GROUP]"

USING POWERVIEW

PowerView is a powerful PowerShell tool designed to enhance situational awareness in an AD environment.

  1. Get-DomainUser
    Get-DomainUser -Identity "[USERNAME]"

  2. Get-DomainGroupMember
    Get-DomainGroupMember -Identity "Domain Admins" -Recurse

  3. Get-DomainTrustMapping
    Get-DomainTrustMapping

  4. Test-AdminAccess
    Test-AdminAccess -ComputerName "[COMPUTERNAME]"

USING SHARPVIEW

SharpView is the .NET implementation of PowerView, providing similar functionality for AD enumeration.

  1. Using SharpView:
    .\SharpView.exe Get-DomainUser -Identity "[USERNAME]"

  2. Enumerate All Domain Users:
    .\SharpView.exe Get-DomainUser

USING SNAFFLER

Snaffler is a tool for locating sensitive data within an AD environment by enumerating network shares and directories.

  1. Executing Snaffler:
    .\Snaffler.exe -d "domain" -s -v data -o "output.log"

USING BLOODHOUND

BloodHound is an tool for analyzing AD trust relationships and identifying potential attack paths.

  1. Running SharpHound to Collect Data
    .\SharpHound.exe -c All --zipfilename "output.zip"

  2. Ingesting Data into BloodHound

  3. Open BloodHound

  4. Click "Upload Data"

  5. Select the zip file generated by SharpHound

  6. Analyze the data using pre-built and custom queries