Objective 2

任务

枚举以下内容在dollarcorp domain:

1. 列出所有OU
2. 列出StudentMachines OU所有计算机
3. 列出GPO
4. 枚举应用在StudentMachines OU的GPO

运行 invishell 脚本以避免增强日志记录 否则导入PowerView.ps1会被av拦截

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat

加载Powerview.ps1

. C:\AD\Tools\PowerView.ps1

列出所有OU

Get-DomainOU

枚举应用在StudentMachines OU的GPO

(Get-DomainOU -Identity StudentMachines).gplink

Get-DomainGPO -Identity '{7478F170-6A0C-490C-B355-9E4618BC785D}'

或直接使用下列命令

Get-DomainGPO -Identity (Get-DomainOU -Identity StudentMachines).gplink.substring(11,(Get-DomainOU -Identity StudentMachines).gplink.length-72)