Set variables
export DC=10.10.10.200
export DOMAIN=ootw.local
export BASE='DC=ootw,DC=local'
export USER='student'
export PASS='student'
LDAP GPO enumeration
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectClass=groupPolicyContainer)' displayName name gPCFileSysPath gPCWQLFilter versionNumber whenChanged
LDAP GPO links
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*))' objectClass name distinguishedName gPLink gPOptions
Find where one GPO is linked
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*{31B2F340-016D-11D2-945F-00C04FB984F9}*))' distinguishedName gPLink
WMI filters
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "CN=SOM,CN=WMIPolicy,CN=System,$BASE" '(objectClass=msWMI-Som)' name msWMI-Name msWMI-Parm2 distinguishedName
PowerShell GPO inventory
Import-Module GroupPolicy
Get-GPO -All | Select-Object DisplayName,Id,Owner,GpoStatus,CreationTime,ModificationTime,WmiFilter
Get-GPInheritance -Target "DC=ootw,DC=local"
Get-GPInheritance -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"
PowerShell links and filters
Get-ADObject -LDAPFilter '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*))' -Properties gPLink,gPOptions |
Select-Object DistinguishedName,gPLink,gPOptions
Get-ADObject -SearchBase "CN=SOM,CN=WMIPolicy,CN=System,DC=ootw,DC=local" -LDAPFilter '(objectClass=msWMI-Som)' -Properties msWMI-Name,msWMI-Parm2 |
Select-Object Name,msWMI-Name,msWMI-Parm2,DistinguishedName
PowerView
Import-Module .\PowerView.ps1
Get-DomainGPO | Select-Object displayname,name,gpcfilesyspath,whenchanged
Get-DomainOU -Properties name,gplink,gpoptions | Select-Object name,gplink,gpoptions
Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=ootw,DC=local" -ResolveGUIDs
SYSVOL listing
nxc smb 10.10.10.200 -u student -p 'student' --shares
smbclient "//10.10.10.200/SYSVOL" -U "ootw.local/student%student" -c 'recurse ON; ls'
Common policy files
smbclient "//10.10.10.200/SYSVOL" -U "ootw.local/student%student" -c 'get ootw.local/Policies/{GUID}/GPT.INI'
smbclient "//10.10.10.200/SYSVOL" -U "ootw.local/student%student" -c 'get ootw.local/Policies/{GUID}/Machine/Registry.pol'
smbclient "//10.10.10.200/SYSVOL" -U "ootw.local/student%student" -c 'get ootw.local/Policies/{GUID}/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf'
Recursive secret hunt from Windows
Get-ChildItem "\\ootw.local\SYSVOL\ootw.local\Policies" -Recurse -Include *.xml,*.ini,*.txt,*.ps1,*.bat,*.vbs,*.config |
Select-String -Pattern "cpassword","password","passwd","pwd","secret","token","apikey","connectionString"
Recursive secret hunt from Linux
mkdir -p sysvol
smbclient "//10.10.10.200/SYSVOL" -U "ootw.local/student%student" -c 'recurse ON; prompt OFF; mget *'
grep -RniE 'cpassword|password|passwd|pwd|secret|token|apikey|connectionString' sysvol/
GPOHound
python3 gpohound.py -u 'student' -p 'student' -d ootw.local -dc 10.10.10.200