_raw: $GPOgroups = Get-DomainGPOLocalGroup @CommonArguments -ResolveMembersToSIDs | ForEach-Object {


_raw: Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Effective target domain SIDs: $TargetSIDs"


_raw: Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Target localgroup SID: $TargetLocalSID"


_raw: $TargetSIDs += Get-DomainGroup @CommonArguments -Properties 'objectsid' -MemberIdentity $TargetSid | Select-Object -ExpandProperty objectsid


_raw: Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Enumerating nested group memberships for: '$TargetSid'"


_raw: Throw "[Get-DomainGPOUserLocalGroupMapping] Unable to retrieve SID for identity '$Identity'"


_raw: $TargetSIDs += Get-DomainObject @CommonArguments -Identity $Identity | Select-Object -Expand objectsid


_raw: if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain }


_raw: [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: group memberships they're a part of through GPO correlation.


_raw: A custom PSObject containing any target identity information and what local


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Find all computers that dfm user has local administrator rights to in


_raw: Get-DomainGPOUserLocalGroupMapping -Identity dfm -Domain dev.testlab.local


_raw: of the local administrators group on target machines.


_raw: Find all user/group -> machine relationships where the user/group is a member


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to enumerate GPOs for, defaults to the current domain.


_raw: or a custom local SID. Defaults to local 'Administrators'.


_raw: Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555),


_raw: The local group to check access against.


_raw: for the user/group to identity GPO local group mappings for.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: If no user/group is specified, all user/group -> machine mappings discovered through


_raw: 6.  querying for all computers under the given OUs or sites


_raw: 5.  enumerating all OUs and sites and applicable GPO GUIs are


_raw: to enumerate all GPO the user is effectively applied with


_raw: 4.  matching the target SID list to the queried GPO SID list


_raw: 3.  pulling all GPOs that set 'Restricted Groups' or Groups.xml by calling


_raw: and extracting all target SIDs to build a target SID list


_raw: 2.  enumerating all groups the user/group is a current part of


_raw: 1.  resolving the user/group to its proper SID


_raw: the user/group has local admin (or RDP) rights to.


_raw: Takes a user/group name and optional domain, and determines the computers in the domain


_raw: Required Dependencies: Get-DomainGPOLocalGroup, Get-DomainObject, Get-DomainComputer, Get-DomainOU, Get-DomainSite, Get-DomainGroup


_raw: local group, all through GPO correlation. If no user/group is specified, all


_raw: Enumerates the machines where a specific domain user/group is a member of a specific


_raw: $_ | Add-Member Noteproperty 'GPOType' 'GroupPolicyPreferences'


_raw: $_ | Add-Member Noteproperty 'GPOName' $GPOName


_raw: $_ | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName


_raw: $MemberSID = ConvertTo-SID -Domain $Domain -ObjectName $Member


_raw: if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain }


_raw: $ConvertToArguments = @{'ObjectName' = $Groupname}


_raw: # if the resulting member is username and not a SID, attempt to resolve it


_raw: if ($Member -and ($Member.Trim() -ne '')) {


_raw: Get-GroupsXML @ParseArgs | ForEach-Object {


_raw: # now try to the parse group policy preferences file (Groups.xml) if it exists


_raw: $GPOGroup | Add-Member Noteproperty 'GroupMembers' $Membership.Value.Members


_raw: $GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Membership.Value.Memberof


_raw: $GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID


_raw: $GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $GPOGroup | Add-Member Noteproperty 'Filters' $Null


_raw: $GPOGroup | Add-Member Noteproperty 'GPOType' 'RestrictedGroups'


_raw: $GPOGroup | Add-Member Noteproperty 'GPOPath' $GPOPath


_raw: $GPOGroup | Add-Member Noteproperty 'GPOName' $GPOName


_raw: $GPOGroup | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName


_raw: $GroupSID = ConvertTo-SID @ConvertToArguments


_raw: elseif ($Groupname -match 'Remote Desktop') {


_raw: if ($Groupname -match 'Administrators') {


_raw: if ($GroupName -and ($GroupName.Trim() -ne '')) {


_raw: $GroupName = ConvertFrom-SID -ObjectSID $GroupSID @ConvertArguments


_raw: if ($GroupSID -and ($GroupSID.Trim() -ne '')) {


_raw: # if the SID is already resolved (i.e. begins with *) try to resolve SID to a name


_raw: if ($Membership -and $Membership.Key -and ($Membership.Key -match '^\*')) {


_raw: ForEach ($Membership in $Memberships.GetEnumerator()) {


_raw: if ($MembershipValue -isnot [System.Array]) {$MembershipValue = @($MembershipValue)}


_raw: $MemberSID = ConvertTo-SID @ConvertToArguments


_raw: if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain }


_raw: $ConvertToArguments = @{'ObjectName' = $Member}


_raw: if ($Member -and ($Member.Trim() -ne '')) {


_raw: # if the resulting member is username and not a SID, attempt to resolve it


_raw: $MembershipValue = $Membership.Value | Where-Object {$_} | ForEach-Object { $_.Trim('*') } | Where-Object {$_}


_raw: $Group, $Relation = $Membership.Key.Split('__', $SplitOption) | ForEach-Object {$_.Trim()}


_raw: ForEach ($Membership in $Inf.'Group Membership'.GetEnumerator()) {


_raw: # parse the members/memberof fields for each entry


_raw: if ($Inf -and ($Inf.psbase.Keys -contains 'Group Membership')) {


_raw: # first parse the 'Restricted Groups' file (GptTmpl.inf) if it exists


_raw: if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential }


_raw: $ParseArgs =  @{ 'GptTmplPath' = "$GPOPath\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" }


_raw: Get-DomainGPO @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $ConvertArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $Domain }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return any GPO-set groups for the GPO with the given display name.


_raw: Return any GPO-set groups for the GPO with the given name/GUID.


_raw: and resolve any members to their domain SIDs.


_raw: Returns all local groups set by GPO along with their members and memberof,


_raw: Returns all local groups set by GPO along with their members and memberof.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Switch. Indicates that any member names should be resolved to their domain SIDs.


_raw: A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'),


_raw: Get-GroupsXML and those memberships are returned as well.


_raw: section data is processed if present. Any found Groups.xml files are parsed with


_raw: GptTmpl.inf files found, the file is parsed with Get-GptTmpl and any 'Group Membership'


_raw: group membership is set through Group Policy Preferences groups.xml files. For any


_raw: arguments, and for each GPO checks if 'Restricted Groups' are set with GptTmpl.inf or


_raw: First enumerates all GPOs in the current/target domain using Get-DomainGPO with passed


_raw: Required Dependencies: Get-DomainGPO, Get-GptTmpl, Get-GroupsXML, ConvertTo-SID, ConvertFrom-SID


_raw: or Group Policy preferences. Also return their user membership mappings, if they exist.


_raw: Returns all GPOs in a domain that modify local group memberships through 'Restricted Groups'


_raw: Write-Verbose "[Get-DomainGPO] Error disposing of the Results object: $_"


_raw: $GPO = Convert-LDAPProperty -Properties $Prop


_raw: Write-Verbose "[Get-DomainGPO] Error calculating gpcfilesyspath for: $($GPO.distinguishedname)"


_raw: $GPO | Add-Member Noteproperty 'gpcfilesyspath' $gpcfilesyspath


_raw: $GPODomain = $GPODN.SubString($GPODN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: if ($PSBoundParameters['SearchBase'] -and ($SearchBase -Match '^GC://')) {


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or ($a -eq 'ntsecuritydescriptor') -or ($a -eq 'logonhours')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "$Filter"


_raw: Write-Verbose "[Get-DomainGPO] filter string: $($Filter)"


_raw: Write-Verbose "[Get-DomainGPO] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1'


_raw: elseif ($IdentityInstance -match '{.*}') {


_raw: Write-Warning "[Get-DomainGPO] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $GPOSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainGPO] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: if ($IdentityInstance -match 'LDAP://|^CN=.*') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: # use the gplink as an ADS path to enumerate all GPOs for the computer


_raw: $GPOAdsPaths | Where-Object {$_ -and ($_ -ne '')} | ForEach-Object {


_raw: else { $SearcherArguments.Remove('Properties') }


_raw: if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties }


_raw: # restore the old properites to return, if set


_raw: Write-Verbose "[Get-DomainGPO] GPOAdsPaths: $GPOAdsPaths"


_raw: $_.gplink.split('][') | ForEach-Object {


_raw: # extract any GPO links for this particular domain the computer is a part of


_raw: $GPOAdsPaths += Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: # find any GPOs linked to the user/computer's domain


_raw: # extract any GPO links for this particular site the computer is a part of


_raw: $GPOAdsPaths += Get-DomainSite @SearcherArguments | ForEach-Object {


_raw: if($ComputerSite -and ($ComputerSite -notlike 'Error*')) {


_raw: $ComputerSite = (Get-NetComputerSiteName -ComputerName $TargetComputerName).SiteName


_raw: # find all the GPOs linked to the computer's site


_raw: # if this OU has GPO inheritence disabled, break so additional OUs aren't processed


_raw: # inheritance not marked as disabled yet


_raw: # if inheritance has already been disabled and this GPO is set as "enforced"


_raw: # extract any GPO links for this particular OU the computer is a part of


_raw: $GPOAdsPaths += Get-DomainOU @SearcherArguments | ForEach-Object {


_raw: # find all the GPOs linked to the user/computer's OUs


_raw: Write-Verbose "[Get-DomainGPO] object OUs: $ObjectOUs"


_raw: $ObjectOUs += $ObjectDN.split(',') | ForEach-Object {


_raw: # extract all OUs the target user/computer is a part of


_raw: Write-Verbose "[Get-DomainGPO] User '$UserIdentity' not found!"


_raw: $User = Get-DomainUser @SearcherArguments -FindOne | Select-Object -First 1


_raw: Write-Verbose "[Get-DomainGPO] Computer '$ComputerIdentity' not found!"


_raw: $Computer = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1


_raw: if ($PSBoundParameters['ComputerIdentity'] -or $PSBoundParameters['UserIdentity']) {


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: The raw DirectoryServices.SearchResult object, if -Raw is enabled.


_raw: Custom PSObject with translated GPO property fields.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Get-DomainGPO -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon


_raw: Return the GPOs with the name of "{F260B76D-55C8-46C5-BEF1-9016DD98E272}" and the display


_raw: Returns all GPOs applied windows1.testlab.local


_raw: Return all GPOs for the testlab.local domain


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Return all GPO objects applied to a given user identity (name, SID, DistinguishedName, etc.).


_raw: Return all GPO objects applied to a given computer identity (name, dnsname, DistinguishedName, etc.).


_raw: A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'),


_raw: a particular machine, use -ComputerName X.


_raw: the current domain are returned. To enumerate all GPOs that are applied to


_raw: "-Properties samaccountname,usnchanged,...". By default, all GPO objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Get-DomainComputer, Get-DomainUser, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainObject, Convert-LDAPProperty


_raw: Return all GPOs or specific GPO objects in AD.


_raw: $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ }


_raw: Write-Verbose "[Get-GroupsXML] Error parsing $TargetGroupsXMLPath : $_"


_raw: $GroupsXML | Add-Member Noteproperty 'GroupMembers' $Members


_raw: $GroupsXML | Add-Member Noteproperty 'GroupMemberOf' $Null


_raw: $GroupsXML | Add-Member Noteproperty 'GroupSID' $GroupSID


_raw: $GroupsXML | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $GroupsXML | Add-Member Noteproperty 'Filters' $Filters


_raw: $GroupsXML | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath


_raw: if ($Members -isnot [System.Array]) { $Members = @($Members) }


_raw: New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}


_raw: $Filters = $_.filters.GetEnumerator() | ForEach-Object {


_raw: # extract out any/all filters...I hate you GPP


_raw: $Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {


_raw: # extract out members added to this group


_raw: $GroupSID = ConvertTo-SID -ObjectName $Groupname


_raw: $GroupSID = ConvertTo-SID -ObjectName $Groupname -Credential $Credential


_raw: elseif ($Groupname -match 'Remote Desktop') {


_raw: if ($Groupname -match 'Administrators') {


_raw: # extract the localgroup sid for memberof


_raw: $GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object {


_raw: # process all group properties in the XML


_raw: [XML]$GroupsXMLcontent = Get-Content -Path $GroupsXMLPath -ErrorAction Stop


_raw: Add-RemoteConnection -Path $SysVolPath -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: $SysVolPath = "\\$((New-Object System.Uri($GroupsXMLPath)).Host)\SYSVOL"


_raw: if (($GroupsXMLPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the groups.xml file path name to parse.


_raw: the files are parsed, and the connection is destroyed later with Remove-RemoteConnection.


_raw: Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds,


_raw: Parses a groups.xml into a custom object. If -Credential is passed,


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, ConvertTo-SID


_raw: Helper to parse a groups.xml file path into a custom object.


_raw: $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ }


_raw: Write-Verbose "[Get-GptTmpl] Error parsing $TargetGptTmplPath : $_"


_raw: $Contents = Get-IniContent -Path $TargetGptTmplPath -ErrorAction Stop


_raw: $Contents | Add-Member Noteproperty 'Path' $TargetGptTmplPath


_raw: $Contents = Get-IniContent -Path $TargetGptTmplPath -OutputObject -ErrorAction Stop


_raw: Write-Verbose "[Get-GptTmpl] Parsing GptTmplPath: $TargetGptTmplPath"


_raw: $TargetGptTmplPath += '\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf'


_raw: if (-not $TargetGptTmplPath.EndsWith('.inf')) {


_raw: Add-RemoteConnection -Path $SysVolPath -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: $SysVolPath = "\\$((New-Object System.Uri($GptTmplPath)).Host)\SYSVOL"


_raw: if (($GptTmplPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Ouputs a hashtable representing the parsed GptTmpl.inf file.


_raw: Parse the default domain policy .inf for dev.testlab.local using alternate credentials.


_raw: Get-GptTmpl -Credential $Cred -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Parse the GptTmpl.inf policy for the GPO with display name of 'testing'.


_raw: Parse the default domain policy .inf for dev.testlab.local


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Output a custom PSObject instead of a hashtable.


_raw: Specifies the GptTmpl.inf file path name to parse.


_raw: the files are parsed, and the connection is destroyed later with Remove-RemoteConnection.


_raw: Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds,


_raw: is constructed and assumed to be the parse target. If -Credential is passed,


_raw: GPO object is passed, GPOPATH\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf


_raw: Parses a GptTmpl.inf into a custom hashtable using Get-IniContent. If a


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, Get-IniContent


_raw: Helper to parse a GptTmpl.inf policy file path into a hashtable.


_raw: $DFSshares | Sort-Object -Property ('RemoteServerName','Name') -Unique


_raw: $DFSshares += Get-DomainDFSShareV2 @SearcherArguments


_raw: $DFSshares += Get-DomainDFSShareV1 @SearcherArguments


_raw: $DFSshares | Sort-Object -Unique -Property 'RemoteServerName'


_raw: Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV2 error : $_"


_raw: Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_"


_raw: Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV2 error in parsing target : $_"


_raw: New-Object -TypeName PSObject -Property @{'Name'="$DFSroot$ShareName";'RemoteServerName'=$Target.split('\')[2]}


_raw: $DFSshares += $xml.targets.ChildNodes | ForEach-Object {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $DFSsearcher = Get-DomainSearcher @PSBoundParameters


_raw: Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV1 error : $_"


_raw: New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_}


_raw: # \\null\TestNameSpace\folder\.DFSFolderLink so we do actually want to match


_raw: # If a folder doesn't have a redirection it will have a target like


_raw: Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error disposing of the Results object: $_"


_raw: Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error in parsing DFS share : $_"


_raw: New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_.split('\')[2]}


_raw: $DFSshares += $RemoteNames | ForEach-Object {


_raw: $object_list += New-Object -TypeName PSObject -Property $dfs_pkt_properties


_raw: $share_name_end = $share_name_start + $share_name_size - 1


_raw: $share_name_start = $share_name_size_end + 1


_raw: $share_name_size_end = $share_name_size_start + 1


_raw: $share_name_size_start = $server_name_end + 1


_raw: $server_name_end = $server_name_start + $server_name_size - 1


_raw: $server_name_start = $server_name_size_end + 1


_raw: $server_name_size_end = $server_name_size_start + 1


_raw: $server_name_size_start = $target_type_end + 1


_raw: $target_type_end = $target_type_start + 3


_raw: $target_type_start = $target_state_end + 1


_raw: $target_state_end = $target_state_start + 3


_raw: $target_state_start = $target_time_stamp_end + 1


_raw: # FILETIME again or special if priority rank and priority class 0


_raw: $target_time_stamp_end = $target_time_stamp_start + 7


_raw: $target_time_stamp_start = $target_entry_size_end + 1


_raw: $target_entry_size_end = $target_entry_size_start + 3


_raw: $target_count_end = $target_count_start + 3


_raw: $referral_ttl_end = $referral_ttl_start + 3


_raw: $referral_ttl_start = $reserved_blob_end + 1


_raw: $reserved_blob_end = $reserved_blob_start + $reserved_blob_size - 1


_raw: $reserved_blob_start = $reserved_blob_size_end + 1


_raw: $reserved_blob_size_end = $reserved_blob_size_start + 3


_raw: $reserved_blob_size_start = $dfs_targetlist_blob_end + 1


_raw: $dfs_targetlist_blob_end = $dfs_targetlist_blob_start + $dfs_targetlist_blob_size - 1


_raw: $dfs_targetlist_blob_start = $dfs_targetlist_blob_size_end + 1


_raw: $dfs_targetlist_blob_size_end = $dfs_targetlist_blob_size_start + 3


_raw: $dfs_targetlist_blob_size_start = $version_end + 1


_raw: # Parse rest of DFSNamespaceRootOrLinkBlob here


_raw: $version_start = $comment_timestamp_end  + 1


_raw: $comment_timestamp_end = $comment_timestamp_start + 7


_raw: $comment_timestamp_start = $state_timestamp_end + 1


_raw: $state_timestamp_end = $state_timestamp_start + 7


_raw: $state_timestamp_start = $prefix_timestamp_end + 1


_raw: $prefix_timestamp = $blob_data[$prefix_timestamp_start..$prefix_timestamp_end] #dword lowDateTime #dword highdatetime


_raw: $prefix_timestamp_end = $prefix_timestamp_start + 7


_raw: $prefix_timestamp_start = $comment_end + 1


_raw: $comment_end = $comment_start + $comment_size - 1


_raw: $comment_size_end = $comment_size_start + 1


_raw: $short_prefix_end = $short_prefix_start + $short_prefix_size - 1


_raw: $short_prefix_start = $short_prefix_size_end + 1


_raw: $short_prefix_size_end = $short_prefix_size_start + 1


_raw: $short_prefix_size_start = $prefix_end + 1


_raw: $prefix_end = $prefix_start + $prefix_size - 1


_raw: $prefix_size_end = $prefix_size_start + 1


_raw: $prefix_size_start = $root_or_link_guid_end + 1


_raw: $guid = New-Object Guid(,$root_or_link_guid) # should match $guid_str


_raw: # Parse DFSNamespaceRootOrLinkBlob object. Starts with variable length DFSRootOrLinkIDBlob which we parse first...


_raw: $blob_data_end = $blob_data_start + $blob_data_size - 1


_raw: $blob_data_start = $blob_data_size_end + 1


_raw: $blob_data_size_end = $blob_data_size_start + 3


_raw: $blob_data_size_start = $blob_name_end + 1


_raw: $blob_name_end = $blob_name_start + $blob_name_size - 1


_raw: $blob_name_start = $blob_name_size_end + 1


_raw: for($i=1; $i -le $blob_element_count; $i++){


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A custom PSObject describing the distributed file systems.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all distributed file system shares for the 'testlab.local' domain.


_raw: Returns all distributed file system shares for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the domains to use for the query, defaults to the current domain.


_raw: The server data is parsed appropriately and returned.


_raw: matching (objectClass=fTDfs) or (objectClass=msDFS-Linkv2), respectively


_raw: 1, 2, or both depending on -Version X) by searching for domain objects


_raw: This function searches for all distributed file systems (either version


_raw: Returns a list of all fault-tolerant distributed file systems


_raw: $(ForEach($UserResult in $UserSearcher.FindAll()) {if ($UserResult.Properties['homedirectory']) {Split-Path($UserResult.Properties['homedirectory'])}if ($UserResult.Properties['scriptpath']) {Split-Path($UserResult.Properties['scriptpath'])}if ($UserResult.Properties['profilepath']) {Split-Path($UserResult.Properties['profilepath'])}}) | Sort-Object -Unique


_raw: $UserSearcher = Get-DomainSearcher @SearcherArguments


_raw: # get all results w/o the pipeline and uniquify them (I know it's not pretty)


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($Path -and ($Path.split('\\').Count -ge 3)) {


_raw: # short internal helper to split UNC server paths


_raw: [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: One or more strings representing file server names.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns active file servers for the 'testing.local' domain.


_raw: Returns active file servers for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: with non-null homedirectory, scriptpath, or profilepath fields, and extracting/uniquifying


_raw: Returns a list of likely fileservers by searching for all users in Active Directory


_raw: Returns a list of servers likely functioning as file servers.


_raw: $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity)


_raw: Write-Verbose "[Remove-DomainGroupMember] Removing member '$Member' from group '$Identity'"


_raw: $UserContext = Get-PrincipalContext @ContextArguments


_raw: Write-Warning "[Remove-DomainGroupMember] Error finding the group identity '$Identity' : $_"


_raw: $GroupContext = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True)]


_raw: Removes harmj0y from 'Domain Admins' in the current domain using the alternate credentials.


_raw: Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Removes harmj0y from 'Domain Admins' in the current domain.


_raw: Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y'


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName


_raw: specifying the group to remove members from.


_raw: A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: each entry in -Members, each member identity is similarly searched for and removed


_raw: which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For


_raw: The bound domain context is then used to search for the specified -GroupIdentity,


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: Removes a domain user (or group) from an existing domain group, assuming


_raw: $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity)


_raw: Write-Verbose "[Add-DomainGroupMember] Adding member '$Member' to group '$Identity'"


_raw: $UserContext = Get-PrincipalContext @ContextArguments


_raw: $ContextArguments['Domain'] = ($Member -split '\\')[0]


_raw: $ContextArguments['Identity'] = ($Member -split '\\')[1]


_raw: Write-Warning "[Add-DomainGroupMember] Error finding the group identity '$Identity' : $_"


_raw: $GroupContext = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True)]


_raw: alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember


_raw: Creates the 'andy' user with the specified description and password, using the specified


_raw: New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred


_raw: $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Adds harmj0y to 'Domain Admins' in the current domain using the alternate credentials.


_raw: Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred


_raw: Adds harmj0y to 'Domain Admins' in the current domain.


_raw: Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y'


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName


_raw: A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: each entry in -Members, each member identity is similarly searched for and added


_raw: which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For


_raw: The bound domain context is then used to search for the specified -GroupIdentity,


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: Adds a domain user (or group) to an existing domain group, assuming


_raw: Write-Verbose "[Get-DomainGroupMemberDeleted] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'"


_raw: $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN


_raw: $Output | Add-Member NoteProperty 'TimesAdded' ($TempObject.dwVersion / 2)


_raw: $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange


_raw: $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted


_raw: $Output | Add-Member NoteProperty 'TimeFirstAdded' $TempObject.ftimeCreated


_raw: $Output | Add-Member NoteProperty 'MemberDN' $TempObject.pszObjectDn


_raw: $Output | Add-Member NoteProperty 'GroupDN' $ObjectDN


_raw: if (($TempObject.pszAttributeName -Match 'member') -and (($TempObject.dwVersion % 2) -eq 0 )) {


_raw: $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue


_raw: ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) {


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: 'LDAPFilter'    =   '(objectCategory=group)'


_raw: 'Properties'    =   'msds-replvaluemetadata','distinguishedname'


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated replication metadata fields.


_raw: LastOriginatingDsaDN  : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First


_raw: MemberDN              : CN=dfm,CN=Users,DC=testlab,DC=local


_raw: GroupDN               : CN=Domain Admins,CN=Users,DC=testlab,DC=local


_raw:
    Logon Time:                   10/15/2025 12:15:06 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       NT SERVICE
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    SplunkForwarder
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:
    Logon Id:                     997


_raw:
  ExpiryDate         : 10/13/2035 7:57:49 AM
  HasPrivateKey      : True
  StoreLocation      : LocalMachine
  KeyExportable      : False
  Thumbprint         : EE5B6A624563CB6BE98AD605C9D758E756B53DB1
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Searching known files that can contain creds in home
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for documents --limit 100--
    C:\Users\All Users\chocolatey\CREDITS.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Templates\Press_Release_Template.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-01_30C4.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-02_4D9F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-03_3731.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-04_BF41.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-05_7752.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-06_C188.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-07_46E9.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-08_F853.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-09_9F07.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-10_04DC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-11_CB3B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-12_5AF3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-13_5836.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-14_E7D1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-15_641F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-16_4C06.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-17_6F01.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-18_0F52.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-19_72A3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-20_0346.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-21_80E5.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-22_59FB.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-23_10F9.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-24_25C6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-25_1D34.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-26_6837.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-27_2090.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-28_362E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-29_F2E8.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-30_915F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-31_DC25.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-32_F5D6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-33_A08D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-34_0E3A.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-35_10DC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Templates\Maintenance_Request_Form.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-01_312C.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-02_FF2A.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-03_770E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-04_F461.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-05_00EC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-06_177B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-07_2216.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-08_A18D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-09_F066.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-10_8C9D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-11_3136.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-12_6452.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-13_81A8.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-14_83D9.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-15_7E76.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-16_6D9D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-17_60AB.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-18_BC1D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-19_C7A0.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-20_2E21.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-21_E3F4.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-22_3BDB.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-23_2765.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-24_9DAF.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-25_258B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-26_F27F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-27_0D55.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-28_A472.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-29_727A.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-30_C63B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-31_D10F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-32_192E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-33_07D6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-34_1C25.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-35_4A13.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Templates\Ship_Departure_Clearance_Form.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-01_1BF7.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-02_81DC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-03_A059.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-04_E55E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-05_213B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-06_41AF.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-07_D5F2.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-08_56DD.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-09_E509.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-10_8CB3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-11_929B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-12_31F6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-13_ECC4.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-14_7714.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-15_997C.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-16_B24B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-17_93C3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-18_0347.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-19_3952.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-20_ECE1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-21_0F41.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-22_A0CD.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-23_6938.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-24_9AC1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-25_1AE1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-26_A712.pdf
ÉÍÍÍÍÍÍÍÍÍÍ¹ Office Most Recent Files -- limit 50

  Last Access Date           User                                           Application           Document
ÉÍÍÍÍÍÍÍÍÍÍ¹ Recent files --limit 70--
   rdavis :


_raw:
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: ldap/apt-dc-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/15/2025 8:10:42 AM
    EndTime: 10/15/2025 6:10:42 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 12:13:24 PM
    EndTime: 10/18/2025 10:13:24 PM
    RenewTime: 10/25/2025 12:13:24 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: ldap/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 12:13:24 PM
    EndTime: 10/18/2025 10:13:24 PM
    RenewTime: 10/25/2025 12:13:24 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for saved Wifi credentials
  [X] Exception: Unable to load DLL 'wlanapi.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
Enumerating WLAN using wlanapi.dll failed, trying to enumerate using 'netsh'
No saved Wifi credentials found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking AppCmd.exe
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking SSClient.exe
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#scclient--sccm
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating SSCM - System Center Configuration Manager settings
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Security Packages Credentials
  Version: NetNTLMv1
  Hash:    rdavis::APT:636d487731d2c86e9a33544c8a88d9da053b9dd17ff0d274:636d487731d2c86e9a33544c8a88d9da053b9dd17ff0d274:1122334455667788

   =================================================================================================
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Browsers Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Showing saved credentials for Firefox
    Info: if no credentials were listed, you might need to close the browser and try again.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for Firefox DBs
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for GET credentials in Firefox history
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Showing saved credentials for Chrome
    Info: if no credentials were listed, you might need to close the browser and try again.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for Chrome DBs
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
  [X] Exception: The given key was not present in the dictionary.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for GET credentials in Chrome history
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
=== Chrome (All Users) ===
    [x] IO exception, history file likely in use (i.e. Browser is likely running):
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Chrome bookmarks
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Showing saved credentials for Opera
    Info: if no credentials were listed, you might need to close the browser and try again.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Showing saved credentials for Brave Browser
    Info: if no credentials were listed, you might need to close the browser and try again.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Showing saved credentials for Internet Explorer (unsupported)
    Info: if no credentials were listed, you might need to close the browser and try again.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current IE tabs
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for GET credentials in IE history
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
ÉÍÍÍÍÍÍÍÍÍÍ¹ IE history -- limit 50

    http://go.microsoft.com/fwlink/p/?LinkId=255142
ÉÍÍÍÍÍÍÍÍÍÍ¹ IE favorites
    Not Found
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Interesting files and registry ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Putty Sessions
=== Putty Saved Session Information (All Users) ===
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Putty SSH Host keys
=== Putty SSH Host Hosts (All Users) ===
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ SSH keys in registry
È If you find anything here, follow the link to learn how to decrypt the SSH keys https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#ssh-keys-in-registry
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ SuperPutty configuration files
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Office 365 endpoints synced by OneDrive.

    SID: S-1-5-19
   =================================================================================================
    SID: S-1-5-20
   =================================================================================================
    SID: S-1-5-21-2174222841-662385608-386699546-3386
   =================================================================================================
    SID: S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    SID: S-1-5-18
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Cloud Credentials
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Unattend Files
    C:\windows\Panther\Unattend.xml
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for common SAM & SYSTEM backups
    C:\windows\System32\config\RegBack\SAM
    File Permissions: Administrators [Allow: AllAccess]

    C:\windows\System32\config\RegBack\SYSTEM
    File Permissions: Administrators [Allow: AllAccess]

ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for McAfee Sitelist.xml Files
ÉÍÍÍÍÍÍÍÍÍÍ¹ Cached GPP Passwords
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for possible regs with creds
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#inside-the-registry
    Not Found
    Not Found
    Not Found
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for possible password files in users homes
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    C:\Users\rdavis\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt
    C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
ÉÍÍÍÍÍÍÍÍÍÍ¹ Searching for Oracle SQL Developer config files

ÉÍÍÍÍÍÍÍÍÍÍ¹ Slack files & directories
  note: check manually if something is found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for LOL Binaries and Scripts (can be slow)
È  https://lolbas-project.github.io/
   [!] Check skipped, if you want to run it, please specify '-lolbas' argument
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Outlook download files

ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating machine and user certificate files

  Issuer             : CN=Cloudbase-Init WinRM
  Subject            : CN=Cloudbase-Init WinRM
  ValidDate          : 10/14/2025 7:57:49 AM


_raw:
            "rate_limited": true,
            "status": 429
        },
        "IP in VirusTotal": {
            "rate_limited": true,
            "status": 429
        },
        "IP in MalwareWorld": {
            "malicious": false,
            "type": [],
            "urls": []
        }
    }
}
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Active Directory Quick Checks ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ gMSA readable managed passwords
È Look for Group Managed Service Accounts you can read (msDS-ManagedPassword) https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/gmsa.html
  [-] No gMSA with readable managed password found (checked 0).
ÉÍÍÍÍÍÍÍÍÍÍ¹ AD CS misconfigurations for ESC
È  https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates.html
È Check for ADCS misconfigurations in the local DC registry
  [-] Host is not a domain controller. Skipping ADCS Registry check
È
If you can modify a template (WriteDacl/WriteOwner/GenericAll), you can abuse ESC4
  [-] No templates with dangerous rights found (checked 0).
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Cloud Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Learn and practice cloud hacking in training.hacktricks.xyz
AWS EC2?                                No
Azure VM?                               No
Azure Tokens?                           No
Google Cloud Platform?                  No
Google Workspace Joined?                No
Google Cloud Directory Sync?            No
Google Password Sync?                   No
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Windows Credentials ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking Windows Vault
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking Credential manager
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault
    [!] Warning: if password contains non-printable characters, it will be printed as unicode base64 encoded string
  [!] Unable to enumerate credentials automatically, error: 'Win32Exception: System.ComponentModel.Win32Exception (0x80004005): Element not found'
Please run:
cmdkey /list
ÉÍÍÍÍÍÍÍÍÍÍ¹ Saved RDP connections
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Remote Desktop Server/Client Settings
  RDP Server Settings
    Network Level Authentication            :
    Block Clipboard Redirection             :
    Block COM Port Redirection              :
    Block Drive Redirection                 :
    Block LPT Port Redirection              :
    Block PnP Device Redirection            :
    Block Printer Redirection               :
    Allow Smart Card Redirection            :

  RDP Client Settings
    Disable Password Saving                 :       True
    Restricted Remote Administration        :       False
ÉÍÍÍÍÍÍÍÍÍÍ¹ Recently run commands
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking for DPAPI Master Keys
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
    MasterKey: C:\Users\rdavis\AppData\Roaming\Microsoft\Protect\S-1-5-21-2174222841-662385608-386699546-3386\736bd595-07d0-44f4-9a99-033b3b75dfdc
    Accessed: 10/18/2025 5:03:51 PM
    Modified: 10/18/2025 5:03:51 PM
   =================================================================================================
    MasterKey: C:\Users\rdavis\AppData\Roaming\Microsoft\Protect\S-1-5-21-2174222841-662385608-386699546-3386\736bd595-07d0-44f4-9a99-033b3b75dfdc
    Accessed: 10/18/2025 5:03:51 PM
    Modified: 10/18/2025 5:03:51 PM
   =================================================================================================
    MasterKey: C:\Users\rdavis\AppData\Roaming\Microsoft\Protect\S-1-5-21-2174222841-662385608-386699546-3386\736bd595-07d0-44f4-9a99-033b3b75dfdc
    Accessed: 10/18/2025 5:03:51 PM
    Modified: 10/18/2025 5:03:51 PM
   =================================================================================================
È Follow the provided link for further instructions in how to decrypt the masterkey.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking for DPAPI Credential Files
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
    CredFile: C:\Users\rdavis\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
    Description: Local Credential Data

    MasterKey: 736bd595-07d0-44f4-9a99-033b3b75dfdc
    Accessed: 10/18/2025 5:03:54 PM
    Modified: 10/18/2025 5:03:54 PM
    Size: 11068
   =================================================================================================
    CredFile: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
    Description: Local Credential Data

    MasterKey: c397a438-01a9-4603-9f93-8282c7e9ba30
    Accessed: 10/15/2025 7:56:56 AM
    Modified: 10/15/2025 7:56:56 AM
    Size: 11136
   =================================================================================================
È Follow the provided link for further instructions in how to decrypt the creds file
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking for RDCMan Settings Files
È Dump credentials from Remote Desktop Connection Manager https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#remote-desktop-credential-manager
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for Kerberos tickets
È  https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html
    [*] Enumerated 7 ticket(s):
    [*] Enumerated 7 ticket(s):
    [*] Enumerated 4 ticket(s):
    [*] Enumerated 2 ticket(s):
    UserPrincipalName: EDACTED_EMAIL
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:03:45 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
   =================================================================================================
    UserPrincipalName: EDACTED_EMAIL
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:03:44 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: EDACTED_EMAIL
    serverName: ldap/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:11:10 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: EDACTED_EMAIL
    serverName: ProtectedStorage/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:03:50 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: EDACTED_EMAIL
    serverName: cifs/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:03:50 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: EDACTED_EMAIL
    serverName: cifs/APT-DC-01
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:03:45 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: EDACTED_EMAIL
    serverName: LDAP/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 5:03:45 PM
    EndTime: 10/19/2025 3:03:44 AM
    RenewTime: 10/25/2025 5:03:44 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 3:23:12 PM
    EndTime: 10/18/2025 11:55:47 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 1:55:47 PM
    EndTime: 10/18/2025 11:55:47 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 3:23:12 PM
    EndTime: 10/18/2025 11:55:47 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: DECKHAND-01$
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 3:23:11 PM
    EndTime: 10/18/2025 11:55:47 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: rc4_hmac
    TicketFlags: name_canonicalize, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 3:23:11 PM
    EndTime: 10/18/2025 11:55:47 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/Deckhand-02
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 2:02:32 PM
    EndTime: 10/18/2025 11:55:47 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: rc4_hmac
    TicketFlags: name_canonicalize, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/15/2025 8:10:42 AM
    EndTime: 10/15/2025 6:10:42 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 12:11:20 PM
    EndTime: 10/18/2025 10:11:20 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 12:11:20 PM
    EndTime: 10/18/2025 10:11:20 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 10/18/2025 12:26:21 PM
    EndTime: 10/18/2025 10:11:20 PM
    RenewTime: 10/22/2025 8:10:42 AM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable