Active Directory Oscp Cheat sheet

shaik

Get System Architecture

$env:PROCESSOR_ARCHITECTURE

[Environment]::Is64BitOperatingSystem  #prints whether the system is 64 bit or not

Enumeration using net tools

• lists all domain users

net user /domain

• prints out detailed info of the user shaik

net user shaik /domain 

• changes the password of user shaik to Frishta123!!! on domain

net user shaik "Frishta123!!!" /domain

• changes the password of user shaik locally

net user shaik "Frishta123!!!"

• user will be added to domain .

net user shaik "Frishta123!!!" /add /domain

• adds user to local group administrator

net localgroup Administrators shaik /add 

• adds user shaik to group domain admins

net group "Domain Admins" shaik /add /domain

Enumeration using Powershell

• list local users

Get-LocalUser

• list local groups

Get-LocalGroup

• list all members of the local group administrators

Get-LocalGroupMember Administrators

Enumeration using Powerview

• Import powerview

import-module ./powerview.ps1

• List domain users

Get-Netuser|select cn

• List domain groups

Get-Netgroup

• List all pcs/hosts in domain

Get-Netcomputer

• List all members of a group

Get-NetGroup "Managers" | select member

• check if the current user owned by us has admin privileges on other domain pcs

Find-LocalAdminAccess

• Check who has a session on a pc cube25 in the domain

Get-NetSession -ComputerName cube25

Getting service principal names

• GET SPNS (Powerview)

setspn -L iis_service
get-netuser |select samaccountname,serviceprincipalname

• spn can also be found when we do Kerboroasting(impacket tools)

impacket-GetNPUsers -dc-ip 192.168.50.70 -request -outputfile hashes cube.com/shaik