All right.
So the first thing I want to do is I want you just load up a command prompt and we'll go ahead and do
that.
I'm going to change directory to my downloads folder.
That's where I have power of you.
And then the first command we're going to run is we're going to run power show and then we'll do E.P.
that stands for execution policy.
You can also write it out like like this execution policy.
But I just like doing E.P. because that's shorthand and it still works.
So we're just gonna say execution policy bypass and this bypasses the execution policy.
Now something to note about execution policy is it's not for security purposes right.
The reason the execution policy exists is that it's just there to stop us from executing scripts that
we don't want to do.
You know like accidentally executing a script.
So we're specifically saying hey just go ahead and shut that off.
So we're going to bypass it here with with power shall E.P. bypass.
And this is pretty common you're gonna see this a lot if you utilize power shell.
So the next thing we're going to do is we're going to go ahead and call our program.
So we're going to do that by doing this.
We're going to say dot and then dot backslash like that and you could start typing in power of you.
Yes one auto tab hit enter and now that's going to happen.
Nothing's going to show or tell you OK it's just hey you've loaded it so power view is an incredibly
powerful tool.
We can do so many things and what we're going to do with it in this course is only going to scratch
the surface.
So my recommendation to you is to go and read up on it.
I will put a reference down in the description below where you can find a cheat sheet.
And then the rest is going to be up to you for googling and finding out what more can do at the end
of this course.
The 80 portion of the course I'm going to provide some additional references in terms of active directory
security and blogs and certifications and courses that you can take and all of those will cover power
of you in a much deeper level.
But these are just some of the high level things that you should know when it comes to enumerating a
domain and how power view is powerful.
So let's go ahead and look at our first command.
Our first command is going to just be get net domain and what is this going to do.
This is going to get information for us about the domain.
So go ahead and hit enter on that and you could see that we have a forest in it's Marvel dot local.
We have a domain controller here of Hydra DC Marvel dot local and that's all it tells us.
We have a very simple domain but if we were in a complex domain this would be a little bit more interesting
to us just to kind of know you know what's going on where are the domain controllers.
And if we want to see specifically what domain controllers are there we can say get net domain controllers
like this or a controller I should say and hit enter and then it will tell you hey the domain controller
is right here at 1 9 2 1 6 8 fifty seven dot one forty and the domain controllers name is Hydra dash
DC dot Marvel dot local.
So it gives you information specifically about the domain controller and some networks have multiple
domain controllers and this would provide all that information about those to make a choice but you
now know say before you had no idea where the domain controller was in your network you've done some
scanning but you really weren't able to identify it.
You got your exploit in on a machine you logged in and you dumped power of you on that machine.
Now you know the domain controller you know where to target next or where your end goal might be.
So that's just two quick examples more examples we could say hey let's get the domain policy and this
will show you all the different policies in the domain for example we can look at B cover us policy
the system access etc..
So let's take a look at like the let's take a look at the system access.
We can do something like this.
So in parentheses go ahead and just type and get domain policy like that and you should be on the auto
tab.
And then put a dot and just say system access like this and then hit enter and what is this telling
us.
Well this tells us a little bit about the policy here.
So we can see that the minimum password age is one day the maximum password age is forty two.
We have lockout counts of zero meaning it's not set password complexity of one.
So you can look through here and you see like what's the minimum pass your password length seven.
OK.
So now I know that the minimum password length is seven.
I'm going to go ahead and just spray seven character passwords or you know I should be pretty easy to
crack a lot of passwords in the network where it's seven but you should be able to spray passwords across
that network that are pretty weak and probably gain access to some user accounts.
So this is a very good indicator of what you're up against.
And you know it's super nice just to have access to these these different policies and what to look
at.
Same thing with cobras.
You can look at the ticketing age and you know just see how long a curve gross ticket lasts.
And you will get more into that when we get into golden tickets.
But just something to keep in mind on the curb road side as well so from here we could also look at
users one command that you can run just for the sake of showing it to you is get net user.
Now this one's gonna be a little dirty OK so now we're here and we just dump this big long list of all
the users and it looks dirty like we can pull down all the users here and it's interesting if we want
to take our time and kind of read through this you could see OK well here's Frank Castle and it's Frank
Castle marveled out local here's his name here's the same account name right here which is f Castle
you kind of read through these and maybe if you look through these you might be able to look at the
descriptions and find an interesting description here with a password in it which we do have like this
one here a description password is my password wanted to pound.
So this is another way to compromise an account by you know just viewing the descriptions here.
We did that with the man in Middlesex but this is just another way to do it.
Now we could do something like this.
We could say because like you see how how dirty this output is with just just like seven or eight users
imagine a enterprise network where there's hundreds of users that would take forever so he could say
something like SELECT CNN and that will just pull down all the user names or all the users or we could
do Sam account name instead like Sam account name and just pull down the account names here if you wanted
to try to get the descriptions we could do description and you could see the my passwords my password
one two three.
We'd be like Where did that belong.
So quick dirty way just to kind of sort through these these users and find out a little bit of information
about them and we could look at certain things on here too like what was the last user log in.
How many bad password accounts do they have.
What is their user account control or there are I.D. number which five hundred would be the advent.
Right.
And we just can go through all this information and kind of look through it and pick apart anything
that might be of interest to us and we'll talk about some of these features here in just a second or
why they might be interesting so let's talk about and shift actually on this to user properties so we
could say get user property and this is going to show you all the properties that a user might have.
And we wish we just covered all of these these are exactly what's through through and through on these
user accounts.
Right.
But let's say for example go ahead and just tab up but let's just say we want to get the properties
of the password last set
OK.
We can look at the different users and when their password was last set and that might be useful we
can know.
OK.
There's an old stale password out in the network or these password accounts are new like you see the
administrator password was the last one changed on eleven thirty and then the newer users from the man
the middle attack was on twelve nine.
And you can kind just look through this same thing like you could look at for example log on account.
And this is a good way to actually identify honeypot accounts.
So you want to be able to see how many times this user has logged in and if you see an account that
has never logged in before that might be a honeypot account.
You might not want to try to attack that account you might want to avoid that completely because they
might just be letting that sit there for you to capture and then once you capture it it's going to alert
their system.
So think about that as well these properties can be incredibly useful.
You could also look at like the bad password account
and just see who's been entering in bad passwords and if there is one there that has like hundreds of
them.
You know you could see that if it's maybe been under attack.
If you're an administrator for example so there's all kinds of useful information.
I recommend that you just kind of play through this as well and see you know go back and look at some
of these in here and say OK.
How can I sort through this and what might be interesting to me.
Again reading the the reference guides that I put in the references that are going to be super important
as well.
So from here.
Let's talk about computers just like getting the users.
We can also get the computers in the domain so we can just say get net computer like this.
You can be able to auto tab.
I screwed up computer and hit enter and okay.
It'll it'll list out here all the computers in the domain.
We only have three which is useful.
If this were a bigger domain be much more.
Now that's not a lot of information there.
So if we want more information we could say full data like this hit enter and then we get probably too
much information.
But we can come through here and look at it like here Spider Man's machine.
You can see the last bad password time you could see a log on count you could see a lot of information
here.
Like what's the operating system.
And you can start to identify operating systems if you want or you could just sort these out like for
example if you tab up you could say select operating system and sort.
So select just just like grab right you're just pulling down specific information so select operating
system and then you could see OK well I've got one server 20 19 and Windows 10 machines in here so that
we could start picking and pulling apart.
What are the servers in the domain and what are the windows 10 machines or what are the user machines
and kind of start separating them out and getting that information.
So from here we can also look at groups.
So for example we could say getting that group which is going to output quite a bit and these are all
built in groups.
We haven't made anything new.
So but we can look through here and see if there's any interesting groups for us because we haven't
done anything new it's really not going to be interesting but we can sort through this and say what
about getting that group by group name.
And we just say domain admins OK.
And then we'll we'll pull down any of the any of the domain admins this way.
Or we can actually sought to buy just a wild card instead of specifying all the admin here.
What if we just say.
Or just domain Edmonds what do we say we want to know specifically what avenues are out there.
So there's administrators hyper v administrators enterprise domain key Edmonds so you can look for all
the ad and group names as well and we can get the members of these groups if we want so we can say get
net group member and then we're just gonna go ahead and say group name and we can pick one of these
groups.
We could just say domain advertise again.
So this will this out all of our domain admins.
So we know that sequel service to start an administrator are all domain admins in our network.
So useful information to have here as well.
So a couple more things I want to point out.
There is a tool in here called invoke share finder.
This is a nice one because you can look and find all the S&P shares in the network.
You can see what files are being shared and where they're being shared.
So we know about admin see IPC on every machine.
But what about this share here that we have and then Hackney came up.
Right.
So it's good to look through these shares and see if there's anything of interest and identify potential
interesting shares for us.
And then two more I want to show you we're really one more in two different ways.
So let's look at this.
We're going to get net GPO.
So this is going to show us all the group policies.
Now I added a special one in here just to show you that we can pull down a bunch of them but so look
it's going to look interesting.
It's going to pull down that heavy data again and sometimes it's overwhelming.
But we can see like disable Windows Defender.
That's when we added in there right.
And then I added and disable S&P signing.
Even though we didn't have to do that I just added that one and to show you a few more in here so let's
say we want to select something on here.
I like to do this.
I like a select display name.
And I also like to select when changed and that'll show us.
OK here's the display names so it gives us an idea of what's going on.
So we know that there is default domain policies and then we've got to disable Windows Defender disable
SMB signing so we know that that's going on in the network and we can learn about their policies that
are going on and just collect more information and then we can we can learn when these were changed
in the network.
Right.
So it's important to just dig in and get as much information as possible now this may have been overwhelming
this may have been a lot and it may have went really quick.
My advice probably to go back and watch this one more time play around with this or just look at your
notes play around in here and take good notes on what you did and you can go to the references and pull
down more information and see how you can utilize that in the future.
I think this is one of the greatest tools you can use for enumeration.
So once or on a machine we want to enumerate the network.
This is a great way to do so and you can see how quick we can get information about the domain the domain
policies users user properties computers groups group policy it could do so much more than what I showed
you.
But this is a really good baseline for you to understand and know about.
So that is it for power view from here we're going to go ahead and move onto a tool called bloodhound
which is incredibly fun to use and you're gonna see how beneficial it can be.
So we'll have a high level overview of bloodhound and then we'll move on into our next section.