Permalink
Browse files

-Added negations to some -GroupScope and -GroupProperty values

  • Loading branch information...
HarmJ0y committed May 25, 2017
1 parent 783bff3 commit d9e9231755d672e98e6ee9c4a5ae90ae8dda001c
Showing with 14 additions and 9 deletions.
  1. +14 −9 Recon/PowerView.ps1
View
@@ -8751,11 +8751,12 @@ Switch. Return users with '(adminCount=1)' (meaning are/were privileged).
.PARAMETER GroupScope
Specifies the scope (DomainLocal, Global, or Universal) of the group(s) to search for.
Also accepts NotDomainLocal, NotGloba, and NotUniversal as negations.
.PARAMETER GroupProperty
Specifies a specific property to search for when performing the group search.
Possible values are Security, Distribution, and CreatedBySystem.
Possible values are Security, Distribution, CreatedBySystem, and NotCreatedBySystem.
.PARAMETER Domain
@@ -8919,12 +8920,12 @@ Custom PSObject with translated group property fields.
[Switch]
$AdminCount,
[ValidateSet('DomainLocal', 'Global', 'Universal')]
[ValidateSet('DomainLocal', 'NotDomainLocal', 'Global', 'NotGlobal', 'Universal', 'NotUniversal')]
[Alias('Scope')]
[String]
$GroupScope,
[ValidateSet('Security', 'Distribution', 'CreatedBySystem')]
[ValidateSet('Security', 'Distribution', 'CreatedBySystem', 'NotCreatedBySystem')]
[String]
$GroupProperty,
@@ -9075,18 +9076,22 @@ Custom PSObject with translated group property fields.
if ($PSBoundParameters['GroupScope']) {
$GroupScopeValue = $PSBoundParameters['GroupScope']
$Filter = Switch ($GroupScopeValue) {
'DomainLocal' { '(groupType:1.2.840.113556.1.4.803:=4)' }
'Global' { '(groupType:1.2.840.113556.1.4.803:=2)' }
'Universal' { '(groupType:1.2.840.113556.1.4.803:=8)' }
'DomainLocal' { '(groupType:1.2.840.113556.1.4.803:=4)' }
'NotDomainLocal' { '(!(groupType:1.2.840.113556.1.4.803:=4))' }
'Global' { '(groupType:1.2.840.113556.1.4.803:=2)' }
'NotGlobal' { '(!(groupType:1.2.840.113556.1.4.803:=2))' }
'Universal' { '(groupType:1.2.840.113556.1.4.803:=8)' }
'NotUniversal' { '(!(groupType:1.2.840.113556.1.4.803:=8))' }
}
Write-Verbose "[Get-DomainGroup] Searching for group scope '$GroupScopeValue'"
}
if ($PSBoundParameters['GroupProperty']) {
$GroupPropertyValue = $PSBoundParameters['GroupProperty']
$Filter = Switch ($GroupPropertyValue) {
'Security' { '(groupType:1.2.840.113556.1.4.803:=2147483648)' }
'Distribution' { '(!(groupType:1.2.840.113556.1.4.803:=2147483648))' }
'CreatedBySystem' { '(groupType:1.2.840.113556.1.4.803:=1)' }
'Security' { '(groupType:1.2.840.113556.1.4.803:=2147483648)' }
'Distribution' { '(!(groupType:1.2.840.113556.1.4.803:=2147483648))' }
'CreatedBySystem' { '(groupType:1.2.840.113556.1.4.803:=1)' }
'NotCreatedBySystem' { '(!(groupType:1.2.840.113556.1.4.803:=1))' }
}
Write-Verbose "[Get-DomainGroup] Searching for group property '$GroupPropertyValue'"
}

0 comments on commit d9e9231

Please sign in to comment.