Skip to content

Commit cd1e10b

Browse files
HarmJ0yHarmJ0y
committed
Turned Get-GptTmpl and Get-GroupsXML into filters
1 parent ac42eb8 commit cd1e10b

File tree

1 file changed

+121
-113
lines changed

1 file changed

+121
-113
lines changed

‎Recon/PowerView.ps1

Lines changed: 121 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -6015,7 +6015,8 @@ function Get-DFSshare {
60156015
#
60166016
########################################################
60176017

6018-
function Get-GptTmpl {
6018+
6019+
filter Get-GptTmpl {
60196020
<#
60206021
.SYNOPSIS
60216022
@@ -6046,53 +6047,48 @@ function Get-GptTmpl {
60466047
$UsePSDrive
60476048
)
60486049

6049-
begin {
6050-
if($UsePSDrive) {
6051-
# if we're PSDrives, create a temporary mount point
6052-
$Parts = $GptTmplPath.split('\')
6053-
$FolderPath = $Parts[0..($Parts.length-2)] -join '\'
6054-
$FilePath = $Parts[-1]
6055-
$RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''
6056-
6057-
Write-Verbose "Mounting path $GptTmplPath using a temp PSDrive at $RandDrive"
6050+
if($UsePSDrive) {
6051+
# if we're PSDrives, create a temporary mount point
6052+
$Parts = $GptTmplPath.split('\')
6053+
$FolderPath = $Parts[0..($Parts.length-2)] -join '\'
6054+
$FilePath = $Parts[-1]
6055+
$RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''
60586056

6059-
try {
6060-
$Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath -ErrorAction Stop
6061-
}
6062-
catch {
6063-
Write-Verbose "Error mounting path $GptTmplPath : $_"
6064-
return $Null
6065-
}
6057+
Write-Verbose "Mounting path $GptTmplPath using a temp PSDrive at $RandDrive"
60666058

6067-
# so we can cd/dir the new drive
6068-
$TargetGptTmplPath = $RandDrive + ":\" + $FilePath
6069-
}
6070-
else {
6071-
$TargetGptTmplPath = $GptTmplPath
6072-
}
6073-
Write-Verbose "GptTmplPath: $GptTmplPath"
6074-
}
6075-
6076-
process {
60776059
try {
6078-
Write-Verbose "Parsing $TargetGptTmplPath"
6079-
$TargetGptTmplPath | Get-IniContent -ErrorAction SilentlyContinue
6060+
$Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath -ErrorAction Stop
60806061
}
60816062
catch {
6082-
Write-Verbose "Error parsing $TargetGptTmplPath : $_"
6063+
Write-Verbose "Error mounting path $GptTmplPath : $_"
6064+
return $Null
60836065
}
6066+
6067+
# so we can cd/dir the new drive
6068+
$TargetGptTmplPath = $RandDrive + ":\" + $FilePath
6069+
}
6070+
else {
6071+
$TargetGptTmplPath = $GptTmplPath
60846072
}
60856073

6086-
end {
6087-
if($UsePSDrive -and $RandDrive) {
6088-
Write-Verbose "Removing temp PSDrive $RandDrive"
6089-
Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
6090-
}
6074+
Write-Verbose "GptTmplPath: $GptTmplPath"
6075+
6076+
try {
6077+
Write-Verbose "Parsing $TargetGptTmplPath"
6078+
$TargetGptTmplPath | Get-IniContent -ErrorAction SilentlyContinue
6079+
}
6080+
catch {
6081+
Write-Verbose "Error parsing $TargetGptTmplPath : $_"
6082+
}
6083+
6084+
if($UsePSDrive -and $RandDrive) {
6085+
Write-Verbose "Removing temp PSDrive $RandDrive"
6086+
Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
60916087
}
60926088
}
60936089

60946090

6095-
function Get-GroupsXML {
6091+
filter Get-GroupsXML {
60966092
<#
60976093
.SYNOPSIS
60986094
@@ -6117,100 +6113,93 @@ function Get-GroupsXML {
61176113
$UsePSDrive
61186114
)
61196115

6120-
begin {
6121-
if($UsePSDrive) {
6122-
# if we're PSDrives, create a temporary mount point
6123-
$Parts = $GroupsXMLPath.split('\')
6124-
$FolderPath = $Parts[0..($Parts.length-2)] -join '\'
6125-
$FilePath = $Parts[-1]
6126-
$RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''
6127-
6128-
Write-Verbose "Mounting path $GroupsXMLPath using a temp PSDrive at $RandDrive"
6116+
if($UsePSDrive) {
6117+
# if we're PSDrives, create a temporary mount point
6118+
$Parts = $GroupsXMLPath.split('\')
6119+
$FolderPath = $Parts[0..($Parts.length-2)] -join '\'
6120+
$FilePath = $Parts[-1]
6121+
$RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''
61296122

6130-
try {
6131-
$Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath -ErrorAction Stop
6132-
}
6133-
catch {
6134-
Write-Verbose "Error mounting path $GroupsXMLPath : $_"
6135-
return $Null
6136-
}
6123+
Write-Verbose "Mounting path $GroupsXMLPath using a temp PSDrive at $RandDrive"
61376124

6138-
# so we can cd/dir the new drive
6139-
$TargetGroupsXMLPath = $RandDrive + ":\" + $FilePath
6125+
try {
6126+
$Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath -ErrorAction Stop
61406127
}
6141-
else {
6142-
$TargetGroupsXMLPath = $GroupsXMLPath
6128+
catch {
6129+
Write-Verbose "Error mounting path $GroupsXMLPath : $_"
6130+
return $Null
61436131
}
6144-
}
61456132

6146-
process {
6133+
# so we can cd/dir the new drive
6134+
$TargetGroupsXMLPath = $RandDrive + ":\" + $FilePath
6135+
}
6136+
else {
6137+
$TargetGroupsXMLPath = $GroupsXMLPath
6138+
}
61476139

6148-
try {
6149-
[XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop
6140+
try {
6141+
[XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop
61506142

6151-
# process all group properties in the XML
6152-
$GroupsXMLcontent | Select-Xml "//Groups" | Select-Object -ExpandProperty node | ForEach-Object {
6143+
# process all group properties in the XML
6144+
$GroupsXMLcontent | Select-Xml "//Groups" | Select-Object -ExpandProperty node | ForEach-Object {
61536145

6154-
$Groupname = $_.Group.Properties.groupName
6146+
$Groupname = $_.Group.Properties.groupName
61556147

6156-
# extract the localgroup sid for memberof
6157-
$GroupSID = $_.Group.Properties.GroupSid
6158-
if(-not $LocalSid) {
6159-
if($Groupname -match 'Administrators') {
6160-
$GroupSID = 'S-1-5-32-544'
6161-
}
6162-
elseif($Groupname -match 'Remote Desktop') {
6163-
$GroupSID = 'S-1-5-32-555'
6164-
}
6165-
elseif($Groupname -match 'Guests') {
6166-
$GroupSID = 'S-1-5-32-546'
6167-
}
6168-
else {
6169-
$GroupSID = Convert-NameToSid -ObjectName $Groupname | Select-Object -ExpandProperty SID
6170-
}
6148+
# extract the localgroup sid for memberof
6149+
$GroupSID = $_.Group.Properties.GroupSid
6150+
if(-not $LocalSid) {
6151+
if($Groupname -match 'Administrators') {
6152+
$GroupSID = 'S-1-5-32-544'
61716153
}
6172-
6173-
# extract out members added to this group
6174-
$Members = $_.Group.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
6175-
if($_.sid) { $_.sid }
6176-
else { $_.name }
6154+
elseif($Groupname -match 'Remote Desktop') {
6155+
$GroupSID = 'S-1-5-32-555'
6156+
}
6157+
elseif($Groupname -match 'Guests') {
6158+
$GroupSID = 'S-1-5-32-546'
61776159
}
6160+
else {
6161+
$GroupSID = Convert-NameToSid -ObjectName $Groupname | Select-Object -ExpandProperty SID
6162+
}
6163+
}
61786164

6179-
if ($Members) {
6165+
# extract out members added to this group
6166+
$Members = $_.Group.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
6167+
if($_.sid) { $_.sid }
6168+
else { $_.name }
6169+
}
61806170

6181-
# extract out any/all filters...I hate you GPP
6182-
if($_.Group.filters) {
6183-
$Filters = $_.Group.filters.GetEnumerator() | ForEach-Object {
6184-
New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}
6185-
}
6186-
}
6187-
else {
6188-
$Filters = $Null
6171+
if ($Members) {
6172+
6173+
# extract out any/all filters...I hate you GPP
6174+
if($_.Group.filters) {
6175+
$Filters = $_.Group.filters.GetEnumerator() | ForEach-Object {
6176+
New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}
61896177
}
6178+
}
6179+
else {
6180+
$Filters = $Null
6181+
}
61906182

6191-
if($Members -isnot [System.Array]) { $Members = @($Members) }
6183+
if($Members -isnot [System.Array]) { $Members = @($Members) }
61926184

6193-
$GPOGroup = New-Object PSObject
6194-
$GPOGroup | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath
6195-
$GPOGroup | Add-Member Noteproperty 'Filters' $Filters
6196-
$GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName
6197-
$GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID
6198-
$GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Null
6199-
$GPOGroup | Add-Member Noteproperty 'GroupMembers' $Members
6200-
$GPOGroup
6201-
}
6185+
$GPOGroup = New-Object PSObject
6186+
$GPOGroup | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath
6187+
$GPOGroup | Add-Member Noteproperty 'Filters' $Filters
6188+
$GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName
6189+
$GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID
6190+
$GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Null
6191+
$GPOGroup | Add-Member Noteproperty 'GroupMembers' $Members
6192+
$GPOGroup
62026193
}
62036194
}
6204-
catch {
6205-
Write-Verbose "Error parsing $TargetGroupsXMLPath : $_"
6206-
}
6195+
}
6196+
catch {
6197+
Write-Verbose "Error parsing $TargetGroupsXMLPath : $_"
62076198
}
62086199

6209-
end {
6210-
if($UsePSDrive -and $RandDrive) {
6211-
Write-Verbose "Removing temp PSDrive $RandDrive"
6212-
Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
6213-
}
6200+
if($UsePSDrive -and $RandDrive) {
6201+
Write-Verbose "Removing temp PSDrive $RandDrive"
6202+
Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
62146203
}
62156204
}
62166205

@@ -6652,11 +6641,11 @@ function Get-NetGPOGroup {
66526641
66536642
.PARAMETER GPOname
66546643
6655-
The GPO name to query for, wildcards accepted.
6644+
The GPO name (GUID) to query for, wildcards accepted.
66566645
66576646
.PARAMETER DisplayName
66586647
6659-
The GPO display name to query for, wildcards accepted.
6648+
The GPO display name to query for, wildcards accepted.
66606649
66616650
.PARAMETER Domain
66626651
@@ -6689,6 +6678,25 @@ function Get-NetGPOGroup {
66896678
66906679
Returns all local groups set by GPO along with their members and memberof.
66916680
6681+
.EXAMPLE
6682+
6683+
PS C:\> Get-NetGPOGroup -ResolveMemberSIDs
6684+
6685+
Returns all local groups set by GPO along with their members and memberof,
6686+
and resolve any members to their domain SIDs.
6687+
6688+
.EXAMPLE
6689+
6690+
PS C:\> Get-NetGPOGroup -GPOName '{0847C615-6C4E-4D45-A064-6001040CC21C}'
6691+
6692+
Return any GPO-set groups for the GPO with the given name/GUID.
6693+
6694+
.EXAMPLE
6695+
6696+
PS C:\> Get-NetGPOGroup -DisplayName 'Desktops'
6697+
6698+
Return any GPO-set groups for the GPO with the given display name.
6699+
66926700
.LINK
66936701
66946702
https://morgansimonsenblog.azurewebsites.net/tag/groups/
@@ -6725,7 +6733,7 @@ function Get-NetGPOGroup {
67256733
$Option = [System.StringSplitOptions]::RemoveEmptyEntries
67266734

67276735
# get every GPO from the specified domain with restricted groups set
6728-
Get-NetGPO -GPOName $GPOname -DisplayName $GPOname -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -PageSize $PageSize | ForEach-Object {
6736+
Get-NetGPO -GPOName $GPOname -DisplayName $DisplayName -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -PageSize $PageSize | ForEach-Object {
67296737

67306738
$GPOdisplayName = $_.displayname
67316739
$GPOname = $_.name

0 commit comments

Comments
 (0)