Supported Authentication

Authentication	Flags	Port	Supported
LDAP	--use-ldap	389	✔️
LDAP	--use-ldaps	636	✔️
LDAP GC	--use-gc	3268	✔️
LDAPS GC	--use-gc-ldaps	3269	✔️
Pass The Hash	-H	XXXX	✔️
AES	--aes-key	XXXX	✔️
Kerberos	--kerberos, -k	XXXX	✔️
PFX	--pfx	XXXX	✔️
ADWS	--use-adws	9389	✔️
XXXX	XXXX	XXXX	❌

Important

Connection Behavior in PowerView

By default, if no specific flags are provided, PowerView automatically attempts to connect using the following order of preference:

1. LDAPS (Secure LDAP)

   • If LDAPS is available, PowerView connects over LDAPS.
   • If LDAPS requires channel binding, it will attempt to use channel binding before failing.

2. LDAP (Unencrypted LDAP)

   • If LDAPS is not available, PowerView falls back to standard LDAP.
   • If the LDAP server requires signing, PowerView will upgrade the connection using sign & seal mechanisms.

3. Global Catalog (GC)

   • If neither LDAPS nor LDAP are available, PowerView makes a final attempt to connect through the Global Catalog service.

Examples

• LDAP --use-ldap(Port 389)

powerview domain.local/user:'Password123!'@10.10.10.10 --use-ldap

• LDAPS --use-ldaps (Port 636)

powerview domain.local/user:'Password123!'@10.10.10.10 --use-ldaps

• Global Catalogue --use-gc (Port 3268)

powerview domain.local/user:'Password123!'@10.10.10.10 --use-gc

• Secure Global Catalogue--use-gc-ldaps (Port 3269)

powerview domain.local/user:'Password123!'@10.10.10.10 --use-gc-ldaps

• Pass the Hash -H

powerview domain.local/user@10.10.10.10 -H "b38ff50264b74508085d82c69794a4d8" 

• AES Key --aes-key (kerberos)

# aes128-cts-hmac-sha1-96
powerview domain.local/user@10.10.10.10 --aes-key "1e7b2dab87d6c796cecaf7187d9e55db"

# aes256-cts-hmac-sha1-9
powerview domain.local/user@10.10.10.10 --aes-key "22bb483611e18c5f350ae00463de646371dda29e59229a4607265fc302e873ab"

• -k @ --kerberos (Kerberos @ Pass the ccache)

Note

Kerberos authentication required full fqdn (i.e. DC01.example.com). So you might need to modify your /etc/hosts file and use --use-system-nameserver to disable hostname resolution from the domain controller (by default)

# Steps to get .ccache
getTGT.py -dc-ip 10.10.10.10 -hashes ":b38ff50264b74508085d82c69794a4d8" domain.local/user
export KRB5CCNAME=user.ccache

# Commands (With .ccache)
powerview domain.local/user@10.10.10.10 -k --no-pass

# Commands (Without .ccache)
powerview domain.local/user:'Password123!'@10.10.10.10 -k

• Schannel --pfx

powerview 10.10.10.10 --pfx administrator.pfx

• ADWS --use-adws(Port 9389)

powerview domain.local/user:'Password123!'@10.10.10.10 --use-adws