Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit f4f5fb1

Browse files
HarmJ0yHarmJ0y
committed
Added Set-DomainUserPassword to reset a particular user's password.
Reformatted documentation.
1 parent 813eab4 commit f4f5fb1

File tree

8 files changed

+298
-184
lines changed

8 files changed

+298
-184
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ Displays Windows vault credential objects including cleartext web credentials.
132132

133133
Generates a full-memory minidump of a process.
134134

135-
#### 'Get-MicrophoneAudio'
135+
#### `Get-MicrophoneAudio`
136136

137137
Records audio from system microphone and saves to disk
138138

‎Recon/PowerView.ps1

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4894,6 +4894,119 @@ http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-
48944894
}
48954895

48964896

4897+
function Set-DomainUserPassword {
4898+
<#
4899+
.SYNOPSIS
4900+
4901+
Sets the password for a given user identity and returns the user object.
4902+
4903+
Author: Will Schroeder (@harmj0y)
4904+
License: BSD 3-Clause
4905+
Required Dependencies: Get-PrincipalContext
4906+
4907+
.DESCRIPTION
4908+
4909+
First binds to the specified domain context using Get-PrincipalContext.
4910+
The bound domain context is then used to search for the specified user -Identity,
4911+
which returns a DirectoryServices.AccountManagement.UserPrincipal object. The
4912+
SetPassword() function is then invoked on the user, setting the password to -AccountPassword.
4913+
4914+
.PARAMETER Identity
4915+
4916+
A user SamAccountName (e.g. User1), DistinguishedName (e.g. CN=user1,CN=Users,DC=testlab,DC=local),
4917+
SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1113), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201)
4918+
specifying the user to reset the password for.
4919+
4920+
.PARAMETER AccountPassword
4921+
4922+
Specifies the password to reset the target user's to. Mandatory.
4923+
4924+
.PARAMETER Domain
4925+
4926+
Specifies the domain to use to search for the user identity, defaults to the current domain.
4927+
4928+
.PARAMETER Credential
4929+
4930+
A [Management.Automation.PSCredential] object of alternate credentials
4931+
for connection to the target domain.
4932+
4933+
.EXAMPLE
4934+
4935+
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
4936+
Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword
4937+
4938+
Resets the password for 'andy' to the password specified.
4939+
4940+
.EXAMPLE
4941+
4942+
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
4943+
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
4944+
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
4945+
Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword -Credential $Cred
4946+
4947+
Resets the password for 'andy' usering the alternate credentials specified.
4948+
4949+
.OUTPUTS
4950+
4951+
DirectoryServices.AccountManagement.UserPrincipal
4952+
4953+
.LINK
4954+
4955+
http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/
4956+
#>
4957+
4958+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
4959+
[OutputType('DirectoryServices.AccountManagement.UserPrincipal')]
4960+
Param(
4961+
[Parameter(Position = 0, Mandatory = $True)]
4962+
[Alias('UserName', 'UserIdentity', 'User')]
4963+
[String]
4964+
$Identity,
4965+
4966+
[Parameter(Mandatory = $True)]
4967+
[ValidateNotNullOrEmpty()]
4968+
[Alias('Password')]
4969+
[Security.SecureString]
4970+
$AccountPassword,
4971+
4972+
[ValidateNotNullOrEmpty()]
4973+
[String]
4974+
$Domain,
4975+
4976+
[Management.Automation.PSCredential]
4977+
[Management.Automation.CredentialAttribute()]
4978+
$Credential = [Management.Automation.PSCredential]::Empty
4979+
)
4980+
4981+
$ContextArguments = @{ 'Identity' = $Identity }
4982+
if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }
4983+
if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }
4984+
$Context = Get-PrincipalContext @ContextArguments
4985+
4986+
if ($Context) {
4987+
$User = [System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($Context.Context, $Identity)
4988+
4989+
if ($User) {
4990+
Write-Verbose "[Set-DomainUserPassword] Attempting to set the password for user '$Identity'"
4991+
try {
4992+
$TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)
4993+
$User.SetPassword($TempCred.GetNetworkCredential().Password)
4994+
4995+
$Null = $User.Save()
4996+
Write-Verbose "[Set-DomainUserPassword] Password for user '$Identity' successfully reset"
4997+
$User
4998+
}
4999+
catch {
5000+
Write-Warning "[Set-DomainUserPassword] Error setting password for user '$Identity' : $_"
5001+
}
5002+
}
5003+
else {
5004+
Write-Warning "[Set-DomainUserPassword] Unable to find user '$Identity'"
5005+
}
5006+
}
5007+
}
5008+
5009+
48975010
function Get-DomainUserEvent {
48985011
<#
48995012
.SYNOPSIS

‎Recon/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ an array of hosts from the pipeline.
5858
Find-DomainObjectPropertyOutlier- inds user/group/computer objects in AD that have 'outlier' properties set
5959
Get-DomainUser - return all users or specific user objects in AD
6060
New-DomainUser - creates a new domain user (assuming appropriate permissions) and returns the user object
61+
Set-DomainUserPassword - sets the password for a given user identity and returns the user object
6162
Get-DomainUserEvent - enumerates account logon events (ID 4624) and Logon with explicit credential events
6263
Get-DomainComputer - returns all computers or specific computer objects in AD
6364
Get-DomainObject - returns all (or specified) domain objects in AD

‎Recon/Recon.psd1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ FunctionsToExport = @(
4646
'Find-DomainObjectPropertyOutlier',
4747
'Get-DomainUser',
4848
'New-DomainUser',
49+
'Set-DomainUserPassword',
4950
'Get-DomainUserEvent',
5051
'Get-DomainComputer',
5152
'Get-DomainObject',

‎docs/Recon/Set-DomainUserPassword.md

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# Set-DomainUserPassword
2+
3+
## SYNOPSIS
4+
Sets the password for a given user identity and returns the user object.
5+
6+
Author: Will Schroeder (@harmj0y)
7+
License: BSD 3-Clause
8+
Required Dependencies: Get-PrincipalContext
9+
10+
## SYNTAX
11+
12+
```
13+
Set-DomainUserPassword [-Identity] <String> -AccountPassword <SecureString> [-Domain <String>]
14+
[-Credential <PSCredential>]
15+
```
16+
17+
## DESCRIPTION
18+
First binds to the specified domain context using Get-PrincipalContext.
19+
The bound domain context is then used to search for the specified user -Identity,
20+
which returns a DirectoryServices.AccountManagement.UserPrincipal object.
21+
The
22+
SetPassword() function is then invoked on the user, setting the password to -AccountPassword.
23+
24+
## EXAMPLES
25+
26+
### -------------------------- EXAMPLE 1 --------------------------
27+
```
28+
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
29+
```
30+
31+
Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword
32+
33+
Resets the password for 'andy' to the password specified.
34+
35+
### -------------------------- EXAMPLE 2 --------------------------
36+
```
37+
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
38+
```
39+
40+
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
41+
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
42+
Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword -Credential $Cred
43+
44+
Resets the password for 'andy' usering the alternate credentials specified.
45+
46+
## PARAMETERS
47+
48+
### -Identity
49+
A user SamAccountName (e.g.
50+
User1), DistinguishedName (e.g.
51+
CN=user1,CN=Users,DC=testlab,DC=local),
52+
SID (e.g.
53+
S-1-5-21-890171859-3433809279-3366196753-1113), or GUID (e.g.
54+
4c435dd7-dc58-4b14-9a5e-1fdb0e80d201)
55+
specifying the user to reset the password for.
56+
57+
```yaml
58+
Type: String
59+
Parameter Sets: (All)
60+
Aliases: UserName, UserIdentity, User
61+
62+
Required: True
63+
Position: 1
64+
Default value: None
65+
Accept pipeline input: False
66+
Accept wildcard characters: False
67+
```
68+
69+
### -AccountPassword
70+
Specifies the password to reset the target user's to.
71+
Mandatory.
72+
73+
```yaml
74+
Type: SecureString
75+
Parameter Sets: (All)
76+
Aliases: Password
77+
78+
Required: True
79+
Position: Named
80+
Default value: None
81+
Accept pipeline input: False
82+
Accept wildcard characters: False
83+
```
84+
85+
### -Domain
86+
Specifies the domain to use to search for the user identity, defaults to the current domain.
87+
88+
```yaml
89+
Type: String
90+
Parameter Sets: (All)
91+
Aliases:
92+
93+
Required: False
94+
Position: Named
95+
Default value: None
96+
Accept pipeline input: False
97+
Accept wildcard characters: False
98+
```
99+
100+
### -Credential
101+
A \[Management.Automation.PSCredential\] object of alternate credentials
102+
for connection to the target domain.
103+
104+
```yaml
105+
Type: PSCredential
106+
Parameter Sets: (All)
107+
Aliases:
108+
109+
Required: False
110+
Position: Named
111+
Default value: [Management.Automation.PSCredential]::Empty
112+
Accept pipeline input: False
113+
Accept wildcard characters: False
114+
```
115+
116+
## INPUTS
117+
118+
## OUTPUTS
119+
120+
### DirectoryServices.AccountManagement.UserPrincipal
121+
122+
## NOTES
123+
124+
## RELATED LINKS
125+
126+
[http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/](http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/)
127+

‎docs/Recon/index.md

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,3 @@
1-
To install this module, drop the entire Recon folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable.
2-
3-
The default per-user module path is: "$Env:HomeDrive$Env:HOMEPATH\Documents\WindowsPowerShell\Modules"
4-
The default computer-level module path is: "$Env:windir\System32\WindowsPowerShell\v1.0\Modules"
5-
6-
To use the module, type `Import-Module Recon`
7-
8-
To see the commands imported, type `Get-Command -Module Recon`
9-
10-
For help on each individual command, Get-Help is your friend.
11-
12-
Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability.
13-
14-
151
## PowerView
162

173
PowerView is a PowerShell tool to gain network situational awareness on

0 commit comments

Comments
 (0)