NEEDED COMMANDS

  • .\SharpUp.exe audit
  • Find what directories our current user has access to
    • Get-ChildItem -Path "C:\" -Directory -Recurse -ErrorAction SilentlyContinue | Where-Object { Test-Path $_.FullName -PathType Container } | Select-Object -ExpandProperty FullName
  • get-acl directory
    • get the permissions for a directory
  • icacls directory
    • get the permissions for a directory
  • When you run BloodHound,
    • mark the user you have as OWNED
    • always check OUTBOUND OBJECT CONTROL in Node Info
  • dir /a /s /b /r
    • /r to read alternate streams of data
  • bloodyAd
    • https://adminions.ca/books/active-directory-enumeration-and-exploitation/page/bloodyad
  • tree /f .
  • netexec smb 10.129.234.48 --generate-hosts-file hosts
  • Get-DomainObject -LDAPFilter "(isDeleted=true)"
  • Get-DomainObject -LDAPFilter "(isDeleted=true)(objectClass=user)"
  • Get-ADOptionalFeature 'Recycle Bin Feature'