Objective 3

任务

枚举以下内容在dollarcorp domain:

1. 域管理员组的ACL
2. 所有改变的studentx的权限

运行 invishell 脚本以避免增强日志记录 否则导入PowerView.ps1会被av拦截

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat

加载Powerview.ps1

. C:\AD\Tools\PowerView.ps1

域管理员组的ACL

Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs -Verbose

Get-DomainUser | select -ExpandProperty samaccountname

选一个

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "student832"}

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}