Introduction

VOYEUR's main purpose is to automate several tasks of an Active Directory build review or security assessment. Also, the tool is able to create a fast (and pretty) Active Directory report. The tool is developed entirely in PowerShell (a powerful scripting language) without dependencies like Microsoft Remote Administration tools. (Just .Net Framework 4.5, WMF 5.0 and Office Excel if you want a useful and pretty report). The generated report is a perfect starting point for well-established forensic, incident response team, security consultants or security researchers who want to quickly analyze threats in Active Directory Services.

Features

• Return a huge number of attributes on computers, users, containers/OUs, groups, ACL, etc...
• Search for locked accounts, expired password, no password policy, etc...
• Return a list of all privileged account in domain. (The script search in SID value instead in a group name)
• Return a list of group’s modification (Users added/deleted for a specific group, etc...)
• Multi-Threading support
• Plugin Support

Usage scenarios

VOYEUR can be used in two ways scenarios:

• Able for using on local or remote computer
• Able for using on joined machine or workgroup machine

Screenshots

Reporting

Support for exporting data driven to several formats like CSV, XML or JSON (Experimental).

The following screenshot shows an example report in JSON format

Office Support

Support for exporting data driven to EXCEL format. The tool also support table style modification, chart creation, company logo or independent language support. At the moment only Office Excel 2010 and Office Excel 2013 are supported by the tool.

Sample reports

An example of report generated by Voyeur can be downloaded from Voyeur_Report_20160609.xlsx

Prerequisites

Voyeur works out of the box with PowerShell version 2.x. You can check your Windows PowerShell version executing the command $PsVersionTable:

PS C:\Users\silverhack> $psversiontable

Name                           Value
----                           -----
CLRVersion                     2.0.50727.5420
BuildVersion                   6.1.7601.17514
PSVersion                      2.0
WSManStackVersion              2.0
PSCompatibleVersions           {1.0, 2.0}
SerializationVersion           1.1.0.1
PSRemotingProtocolVersion      2.1

Installation

You can download the latest zip by clicking [https://github.com/silverhack/voyeur/archive/master.zip here].

Preferably, you can download voyeur by cloning the [https://github.com/silverhack/voyeur] repository:

git clone git clone https://github.com/silverhack/voyeur

Usage

To get a list of basic options and switches use:

get-help .\voyeur.ps1

To get a list of examples use:

get-help .\voyeur.ps1 -Examples

To get a list of all options and examples with detailed info use:

get-help .\voyeur.ps1 -Detailed

Examples

This example retrieve information of an Active Directory for a specific domain. Also, retrieve Organizational Unit information and ACL values. Next, export all data driven to JSON format.

.\voyeur.ps1 -Domain "test.example.local" -ExportACL -ExportOU -ExportTo JSON

This example retrieve information of an Active Directory for a specific domain with explicit credentials and export results to CSV format.

.\voyeur.ps1 -Domain "test.example.local" -AlternateCredential -ExportTo CSV

This example retrieve information of an Active Directory for a specific domain and for specific Organizational Unit (OU). Also, retrieve Organizational Unit information and ACL values. Next, export all data driven to all supported formats

.\voyeur.ps1 -Domain "test.example.local" -SearchRoot "OU=Domain,DC=test,DC=example,DC=local" -ExportACL -ExportOU -ExportTo XML,JSON,CSV,EXCEL