Skip to content

Commit 9cd0955

Browse files
HarmJ0yHarmJ0y
committed
Cleaned up Get-NetGroup's logic a bit, removed filtering for primary group ID (i.e. domain users)
Modified Get-DomainSID to simplify Changed group determination in Get-NetLocalGroup -API Few optimizations to Find-ForeignUser and Find-ForeignGroup Changed DNS resolution method for Invoke-UserHunter Added 'PowerView.GPOLocalGroup' type to Find-GPOLocation
1 parent 0f2bd1d commit 9cd0955

File tree

1 file changed

+96
-76
lines changed

1 file changed

+96
-76
lines changed

‎Recon/PowerView.ps1

Lines changed: 96 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1071,17 +1071,17 @@ filter Convert-ADName {
10711071
)
10721072

10731073
$NameTypes = @{
1074-
"Canonical" = 2
1075-
"NT4" = 3
1076-
"Simple" = 5
1074+
'Canonical' = 2
1075+
'NT4' = 3
1076+
'Simple' = 5
10771077
}
10781078

1079-
if(!$PSBoundParameters['InputType']) {
1079+
if(-not $PSBoundParameters['InputType']) {
10801080
if( ($ObjectName.split('/')).Count -eq 2 ) {
10811081
$ObjectName = $ObjectName.replace('/', '\')
10821082
}
10831083

1084-
if($ObjectName -match "^[A-Za-z]+\\[A-Za-z ]+$") {
1084+
if($ObjectName -match "^[A-Za-z]+\\[A-Za-z ]+") {
10851085
$InputType = 'NT4'
10861086
}
10871087
elseif($ObjectName -match "^[A-Za-z ]+@[A-Za-z\.]+") {
@@ -1099,7 +1099,7 @@ filter Convert-ADName {
10991099
$ObjectName = $ObjectName.replace('/', '\')
11001100
}
11011101

1102-
if(!$PSBoundParameters['OutputType']) {
1102+
if(-not $PSBoundParameters['OutputType']) {
11031103
$OutputType = Switch($InputType) {
11041104
'NT4' {'Canonical'}
11051105
'Simple' {'NT4'}
@@ -5009,8 +5009,10 @@ function Get-DomainSID {
50095009

50105010
$DCSID = Get-NetComputer -Domain $Domain -DomainController $DomainController -FullData -Filter '(userAccountControl:1.2.840.113556.1.4.803:=8192)' | Select-Object -First 1 -ExpandProperty objectsid
50115011
if($DCSID) {
5012-
$Parts = $DCSID.split("-")
5013-
$Parts[0..($Parts.length -2)] -join "-"
5012+
$DCSID.Substring(0, $DCSID.LastIndexOf('-'))
5013+
}
5014+
else {
5015+
Write-Warning "Error extracting domain SID for $Domain"
50145016
}
50155017
}
50165018

@@ -5147,35 +5149,40 @@ function Get-NetGroup {
51475149

51485150
if ($UserName) {
51495151
# get the raw user object
5150-
$User = Get-ADObject -SamAccountName $UserName -Domain $Domain -DomainController $DomainController -Credential $Credential -ReturnRaw -PageSize $PageSize
5152+
$User = Get-ADObject -SamAccountName $UserName -Domain $Domain -DomainController $DomainController -Credential $Credential -ReturnRaw -PageSize $PageSize | Select-Object -First 1
51515153

5152-
# convert the user to a directory entry
5153-
$UserDirectoryEntry = $User.GetDirectoryEntry()
5154+
if($User) {
5155+
# convert the user to a directory entry
5156+
$UserDirectoryEntry = $User.GetDirectoryEntry()
51545157

5155-
# cause the cache to calculate the token groups for the user
5156-
$UserDirectoryEntry.RefreshCache("tokenGroups")
5158+
# cause the cache to calculate the token groups for the user
5159+
$UserDirectoryEntry.RefreshCache("tokenGroups")
51575160

5158-
$UserDirectoryEntry.TokenGroups | ForEach-Object {
5159-
# convert the token group sid
5160-
$GroupSid = (New-Object System.Security.Principal.SecurityIdentifier($_,0)).Value
5161-
5162-
# ignore the built in users and default domain user group
5163-
if(!($GroupSid -match '^S-1-5-32-545|-513$')) {
5164-
if($FullData) {
5165-
$Group = Get-ADObject -SID $GroupSid -PageSize $PageSize -Domain $Domain -DomainController $DomainController -Credential $Credential
5166-
$Group.PSObject.TypeNames.Add('PowerView.Group')
5167-
$Group
5168-
}
5169-
else {
5170-
if($RawSids) {
5171-
$GroupSid
5161+
$UserDirectoryEntry.TokenGroups | ForEach-Object {
5162+
# convert the token group sid
5163+
$GroupSid = (New-Object System.Security.Principal.SecurityIdentifier($_,0)).Value
5164+
5165+
# ignore the built in groups
5166+
if($GroupSid -notmatch '^S-1-5-32-.*') {
5167+
if($FullData) {
5168+
$Group = Get-ADObject -SID $GroupSid -PageSize $PageSize -Domain $Domain -DomainController $DomainController -Credential $Credential
5169+
$Group.PSObject.TypeNames.Add('PowerView.Group')
5170+
$Group
51725171
}
51735172
else {
5174-
Convert-SidToName $GroupSid
5173+
if($RawSids) {
5174+
$GroupSid
5175+
}
5176+
else {
5177+
Convert-SidToName -SID $GroupSid
5178+
}
51755179
}
51765180
}
51775181
}
51785182
}
5183+
else {
5184+
Write-Warning "UserName '$UserName' failed to resolve."
5185+
}
51795186
}
51805187
else {
51815188
if ($SID) {
@@ -5456,11 +5463,39 @@ function Get-NetGroupMember {
54565463
$GroupMember | Add-Member Noteproperty 'GroupDomain' $TargetDomain
54575464
$GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName
54585465

5466+
if($Properties.objectSid) {
5467+
$MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectSid[0],0).Value)
5468+
}
5469+
else {
5470+
$MemberSID = $Null
5471+
}
5472+
54595473
try {
54605474
$MemberDN = $Properties.distinguishedname[0]
5461-
5462-
# extract the FQDN from the Distinguished Name
5463-
$MemberDomain = $MemberDN.subString($MemberDN.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'
5475+
5476+
if (($MemberDN -match 'ForeignSecurityPrincipals') -and ($MemberDN -match 'S-1-5-21')) {
5477+
try {
5478+
if(-not $MemberSID) {
5479+
$MemberSID = $Properties.cn[0]
5480+
}
5481+
$MemberSimpleName = Convert-SidToName -SID $MemberSID | Convert-ADName -InputType 'NT4' -OutputType 'Simple'
5482+
if($MemberSimpleName) {
5483+
$MemberDomain = $MemberSimpleName.Split('@')[1]
5484+
}
5485+
else {
5486+
Write-Warning "Error converting $MemberDN"
5487+
$MemberDomain = $Null
5488+
}
5489+
}
5490+
catch {
5491+
Write-Warning "Error converting $MemberDN"
5492+
$MemberDomain = $Null
5493+
}
5494+
}
5495+
else {
5496+
# extract the FQDN from the Distinguished Name
5497+
$MemberDomain = $MemberDN.subString($MemberDN.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'
5498+
}
54645499
}
54655500
catch {
54665501
$MemberDN = $Null
@@ -5481,17 +5516,10 @@ function Get-NetGroupMember {
54815516
$MemberName = $Properties.cn
54825517
}
54835518
}
5484-
5485-
if($Properties.objectSid) {
5486-
$MemberSid = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectSid[0],0).Value)
5487-
}
5488-
else {
5489-
$MemberSid = $Null
5490-
}
54915519

54925520
$GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain
54935521
$GroupMember | Add-Member Noteproperty 'MemberName' $MemberName
5494-
$GroupMember | Add-Member Noteproperty 'MemberSid' $MemberSid
5522+
$GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID
54955523
$GroupMember | Add-Member Noteproperty 'IsGroup' $IsGroup
54965524
$GroupMember | Add-Member Noteproperty 'MemberDN' $MemberDN
54975525
$GroupMember.PSObject.TypeNames.Add('PowerView.GroupMember')
@@ -5507,7 +5535,6 @@ function Get-NetGroupMember {
55075535
}
55085536
}
55095537
}
5510-
55115538
}
55125539
}
55135540
}
@@ -7063,26 +7090,29 @@ function Find-GPOLocation {
70637090
$OUComputers = Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $_.ADSpath -PageSize $PageSize
70647091
}
70657092

7066-
if($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)}
7093+
if($OUComputers) {
7094+
if($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)}
70677095

7068-
ForEach ($TargetSid in $TargetObjectSIDs) {
7069-
$Object = Get-ADObject -SID $TargetSid -Domain $Domain -DomainController $DomainController -Credential $Credential -PageSize $PageSize
7096+
ForEach ($TargetSid in $TargetObjectSIDs) {
7097+
$Object = Get-ADObject -SID $TargetSid -Domain $Domain -DomainController $DomainController -Credential $Credential -PageSize $PageSize
70707098

7071-
$IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype
7099+
$IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype
70727100

7073-
$GPOLocation = New-Object PSObject
7074-
$GPOLocation | Add-Member Noteproperty 'ObjectName' $Object.samaccountname
7075-
$GPOLocation | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname
7076-
$GPOLocation | Add-Member Noteproperty 'ObjectSID' $Object.objectsid
7077-
$GPOLocation | Add-Member Noteproperty 'Domain' $Domain
7078-
$GPOLocation | Add-Member Noteproperty 'IsGroup' $IsGroup
7079-
$GPOLocation | Add-Member Noteproperty 'GPODisplayName' $GPOname
7080-
$GPOLocation | Add-Member Noteproperty 'GPOGuid' $GPOGuid
7081-
$GPOLocation | Add-Member Noteproperty 'GPOPath' $GPOPath
7082-
$GPOLocation | Add-Member Noteproperty 'GPOType' $GPOType
7083-
$GPOLocation | Add-Member Noteproperty 'ContainerName' $_.distinguishedname
7084-
$GPOLocation | Add-Member Noteproperty 'ComputerName' $OUComputers
7085-
$GPOLocation
7101+
$GPOLocation = New-Object PSObject
7102+
$GPOLocation | Add-Member Noteproperty 'ObjectName' $Object.samaccountname
7103+
$GPOLocation | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname
7104+
$GPOLocation | Add-Member Noteproperty 'ObjectSID' $Object.objectsid
7105+
$GPOLocation | Add-Member Noteproperty 'Domain' $Domain
7106+
$GPOLocation | Add-Member Noteproperty 'IsGroup' $IsGroup
7107+
$GPOLocation | Add-Member Noteproperty 'GPODisplayName' $GPOname
7108+
$GPOLocation | Add-Member Noteproperty 'GPOGuid' $GPOGuid
7109+
$GPOLocation | Add-Member Noteproperty 'GPOPath' $GPOPath
7110+
$GPOLocation | Add-Member Noteproperty 'GPOType' $GPOType
7111+
$GPOLocation | Add-Member Noteproperty 'ContainerName' $_.distinguishedname
7112+
$GPOLocation | Add-Member Noteproperty 'ComputerName' $OUComputers
7113+
$GPOLocation.PSObject.TypeNames.Add('PowerView.GPOLocalGroup')
7114+
$GPOLocation
7115+
}
70867116
}
70877117
}
70887118

@@ -7106,6 +7136,7 @@ function Find-GPOLocation {
71067136
$AppliedSite | Add-Member Noteproperty 'GPOType' $GPOType
71077137
$AppliedSite | Add-Member Noteproperty 'ContainerName' $_.distinguishedname
71087138
$AppliedSite | Add-Member Noteproperty 'ComputerName' $_.siteobjectbl
7139+
$AppliedSite.PSObject.TypeNames.Add('PowerView.GPOLocalGroup')
71097140
$AppliedSite
71107141
}
71117142
}
@@ -7678,10 +7709,10 @@ function Get-NetLocalGroup {
76787709
$LocalUser | Add-Member Noteproperty 'AccountName' $Info.lgrmi2_domainandname
76797710
$LocalUser | Add-Member Noteproperty 'SID' $SidString
76807711

7681-
$IsGroup = $($Info.lgrmi2_sidusage -eq 'SidTypeGroup')
7712+
$IsGroup = $($Info.lgrmi2_sidusage -ne 'SidTypeUser')
76827713
$LocalUser | Add-Member Noteproperty 'IsGroup' $IsGroup
76837714

7684-
$LocalUser.PSObject.TypeNames.Add('PowerView.LocalUser')
7715+
$LocalUser.PSObject.TypeNames.Add('PowerView.LocalUserAPI')
76857716

76867717
$LocalUsers += $LocalUser
76877718
}
@@ -9772,23 +9803,12 @@ function Invoke-UserHunter {
97729803
$FoundUser | Add-Member Noteproperty 'SessionFrom' $CName
97739804

97749805
# Try to resolve the DNS hostname of $Cname
9775-
if ($Cname -match '[a-zA-Z]') {
9776-
Try {
9777-
$CNameDNSName = [System.Net.Dns]::GetHostByName($CName).Hostname
9778-
}
9779-
Catch {
9780-
$CNameDNSName = $Cname
9781-
}
9806+
try {
9807+
$CNameDNSName = [System.Net.Dns]::GetHostEntry($CName) | Select-Object -ExpandProperty HostName
97829808
$FoundUser | Add-Member NoteProperty 'SessionFromName' $CnameDNSName
97839809
}
9784-
else {
9785-
Try {
9786-
$CNameDNSName = [System.Net.Dns]::Resolve($Cname).HostName
9787-
}
9788-
Catch {
9789-
$CNameDNSName = $Cname
9790-
}
9791-
$FoundUser | Add-Member NoteProperty 'SessionFromName' $CnameDNSName
9810+
catch {
9811+
$FoundUser | Add-Member NoteProperty 'SessionFromName' $Null
97929812
}
97939813

97949814
# see if we're checking to see if we have local admin access on this machine
@@ -12768,7 +12788,7 @@ function Find-ForeignUser {
1276812788
$Domain = $DistinguishedDomainName -replace 'DC=','' -replace ',','.'
1276912789
}
1277012790

12771-
Get-NetUser -Domain $Domain -DomainController $DomainController -UserName $UserName -PageSize $PageSize | Where-Object {$_.memberof} | ForEach-Object {
12791+
Get-NetUser -Domain $Domain -DomainController $DomainController -UserName $UserName -PageSize $PageSize -Filter '(memberof=*)' | ForEach-Object {
1277212792
ForEach ($Membership in $_.memberof) {
1277312793
$Index = $Membership.IndexOf("DC=")
1277412794
if($Index) {
@@ -12900,7 +12920,7 @@ function Find-ForeignGroup {
1290012920
$ExcludeGroups = @("Users", "Domain Users", "Guests")
1290112921

1290212922
# get all the groupnames for the given domain
12903-
Get-NetGroup -GroupName $GroupName -Domain $Domain -DomainController $DomainController -FullData -PageSize $PageSize | Where-Object {$_.member} | Where-Object {
12923+
Get-NetGroup -GroupName $GroupName -Filter '(member=*)' -Domain $Domain -DomainController $DomainController -FullData -PageSize $PageSize | Where-Object {
1290412924
# exclude common large groups
1290512925
-not ($ExcludeGroups -contains $_.samaccountname) } | ForEach-Object {
1290612926

0 commit comments

Comments
 (0)