Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit a0b95c3

Browse files
HarmJ0yHarmJ0y
committed
Domain local group query fix.
Added ConvertFrom-UACValue to convert binary UAC values to human readable format. Corrected logic in Set-ADObject.
1 parent e44df18 commit a0b95c3

1 file changed

Lines changed: 140 additions & 30 deletions

File tree

‎Recon/PowerView.ps1‎

Lines changed: 140 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1228,6 +1228,118 @@ function Convert-CanonicaltoNT4 {
12281228
}
12291229

12301230

1231+
function ConvertFrom-UACValue {
1232+
<#
1233+
.SYNOPSIS
1234+
1235+
Converts a UAC int value to human readable form.
1236+
1237+
.PARAMETER Value
1238+
1239+
The int UAC value to convert.
1240+
1241+
.PARAMETER ShowAll
1242+
1243+
Show all UAC values, with a + indicating the value is currently set.
1244+
1245+
.EXAMPLE
1246+
1247+
PS C:\> ConvertFrom-UACValue -Value 66176
1248+
1249+
Convert the UAC value 66176 to human readable format.
1250+
1251+
.EXAMPLE
1252+
1253+
PS C:\> Get-NetUser jason | select useraccountcontrol | ConvertFrom-UACValue
1254+
1255+
Convert the UAC value for 'jason' to human readable format.
1256+
1257+
.EXAMPLE
1258+
1259+
PS C:\> Get-NetUser jason | select useraccountcontrol | ConvertFrom-UACValue -ShowAll
1260+
1261+
Convert the UAC value for 'jason' to human readable format, showing all
1262+
possible UAC values.
1263+
#>
1264+
1265+
[CmdletBinding()]
1266+
param(
1267+
[Parameter(ValueFromPipeline=$True)]
1268+
$Value,
1269+
1270+
[Switch]
1271+
$ShowAll
1272+
)
1273+
1274+
begin {
1275+
1276+
# values from https://support.microsoft.com/en-us/kb/305144
1277+
$UACValues = New-Object System.Collections.Specialized.OrderedDictionary
1278+
$UACValues.Add("SCRIPT", 1)
1279+
$UACValues.Add("ACCOUNTDISABLE", 2)
1280+
$UACValues.Add("HOMEDIR_REQUIRED", 8)
1281+
$UACValues.Add("LOCKOUT", 16)
1282+
$UACValues.Add("PASSWD_NOTREQD", 32)
1283+
$UACValues.Add("PASSWD_CANT_CHANGE", 64)
1284+
$UACValues.Add("ENCRYPTED_TEXT_PWD_ALLOWED", 128)
1285+
$UACValues.Add("TEMP_DUPLICATE_ACCOUNT", 256)
1286+
$UACValues.Add("NORMAL_ACCOUNT", 512)
1287+
$UACValues.Add("INTERDOMAIN_TRUST_ACCOUNT", 2048)
1288+
$UACValues.Add("WORKSTATION_TRUST_ACCOUNT", 4096)
1289+
$UACValues.Add("SERVER_TRUST_ACCOUNT", 8192)
1290+
$UACValues.Add("DONT_EXPIRE_PASSWORD", 65536)
1291+
$UACValues.Add("MNS_LOGON_ACCOUNT", 131072)
1292+
$UACValues.Add("SMARTCARD_REQUIRED", 262144)
1293+
$UACValues.Add("TRUSTED_FOR_DELEGATION", 524288)
1294+
$UACValues.Add("NOT_DELEGATED", 1048576)
1295+
$UACValues.Add("USE_DES_KEY_ONLY", 2097152)
1296+
$UACValues.Add("DONT_REQ_PREAUTH", 4194304)
1297+
$UACValues.Add("PASSWORD_EXPIRED", 8388608)
1298+
$UACValues.Add("TRUSTED_TO_AUTH_FOR_DELEGATION", 16777216)
1299+
$UACValues.Add("PARTIAL_SECRETS_ACCOUNT", 67108864)
1300+
1301+
}
1302+
1303+
process {
1304+
1305+
$ResultUACValues = New-Object System.Collections.Specialized.OrderedDictionary
1306+
1307+
if($Value -is [Int]) {
1308+
$IntValue = $Value
1309+
}
1310+
1311+
if ($Value -is [PSCustomObject]) {
1312+
if($Value.useraccountcontrol) {
1313+
$IntValue = $Value.useraccountcontrol
1314+
}
1315+
}
1316+
1317+
if($IntValue) {
1318+
1319+
if($ShowAll) {
1320+
foreach ($UACValue in $UACValues.GetEnumerator()) {
1321+
if( ($IntValue -band $UACValue.Value) -eq $UACValue.Value) {
1322+
$ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)+")
1323+
}
1324+
else {
1325+
$ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)")
1326+
}
1327+
}
1328+
}
1329+
else {
1330+
foreach ($UACValue in $UACValues.GetEnumerator()) {
1331+
if( ($IntValue -band $UACValue.Value) -eq $UACValue.Value) {
1332+
$ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)")
1333+
}
1334+
}
1335+
}
1336+
}
1337+
1338+
$ResultUACValues
1339+
}
1340+
}
1341+
1342+
12311343
function Get-Proxy {
12321344
<#
12331345
.SYNOPSIS
@@ -1379,7 +1491,7 @@ function Get-PathAcl {
13791491
$Names = @()
13801492
$SIDs = @($Object.objectsid)
13811493

1382-
if ($Recurse -and ($Object.samAccountType -eq "268435456")) {
1494+
if ($Recurse -and ($Object.samAccountType -ne "805306368")) {
13831495
$SIDs += Get-NetGroupMember -SID $Object.objectsid | Select-Object -ExpandProperty MemberSid
13841496
}
13851497

@@ -3531,6 +3643,12 @@ function Set-ADObject {
35313643
PS C:\> Set-ADObject -SamAccountName matt.admin -PropertyName countrycode -PropertyValue 0
35323644
35333645
Set the countrycode for matt.admin to 0
3646+
3647+
.EXAMPLE
3648+
3649+
PS C:\> Set-ADObject -SamAccountName matt.admin -PropertyName useraccountcontrol -PropertyXorValue 65536
3650+
3651+
Set the password not to expire on matt.admin
35343652
#>
35353653

35363654
[CmdletBinding()]
@@ -3582,32 +3700,24 @@ function Set-ADObject {
35823700
# get the modifiable object for this search result
35833701
$Entry = $RawObject.GetDirectoryEntry()
35843702

3585-
# if the property name doesn't already exist
3586-
if(!$Entry.$PropertyName) {
3587-
$Entry.put($PropertyName, $PropertyValue)
3588-
$Entry.setinfo()
3703+
if($ClearValue) {
3704+
Write-Verbose "Clearing value"
3705+
$Entry.$PropertyName.clear()
3706+
$Entry.commitchanges()
35893707
}
35903708

3591-
else {
3592-
if($ClearValue) {
3593-
# remove the value fromt the entry
3594-
Write-Verbose "Clearing value"
3595-
$Entry.$PropertyName.clear()
3596-
}
3597-
else {
3598-
# resolve this property's type name so as can properly set it
3599-
$TypeName = $Entry.$PropertyName[0].GetType().name
3600-
3601-
# if we're binary-or'ing the current value
3602-
if($PropertyXorValue) {
3603-
# UAC value references- https://support.microsoft.com/en-us/kb/305144
3604-
$PropertyValue = $($Entry.$PropertyName) -bxor $PropertyXorValue
3605-
}
3709+
elseif($PropertyXorValue) {
3710+
$TypeName = $Entry.$PropertyName[0].GetType().name
36063711

3607-
$Entry.$PropertyName = $PropertyValue -as $TypeName
3608-
}
3712+
# UAC value references- https://support.microsoft.com/en-us/kb/305144
3713+
$PropertyValue = $($Entry.$PropertyName) -bxor $PropertyXorValue
3714+
$Entry.$PropertyName = $PropertyValue -as $TypeName
3715+
$Entry.commitchanges()
3716+
}
36093717

3610-
$Entry.commitchanges()
3718+
else {
3719+
$Entry.put($PropertyName, $PropertyValue)
3720+
$Entry.setinfo()
36113721
}
36123722
}
36133723
catch {
@@ -4265,10 +4375,10 @@ function Get-NetGroup {
42654375
}
42664376
else {
42674377
if ($SID) {
4268-
$GroupSearcher.filter = "(&(samAccountType=268435456)(objectSID=$SID)$Filter)"
4378+
$GroupSearcher.filter = "(&(objectCategory=group)(objectSID=$SID)$Filter)"
42694379
}
42704380
else {
4271-
$GroupSearcher.filter = "(&(samAccountType=268435456)(name=$GroupName)$Filter)"
4381+
$GroupSearcher.filter = "(&(objectCategory=group)(name=$GroupName)$Filter)"
42724382
}
42734383

42744384
$GroupSearcher.FindAll() | Where-Object {$_} | ForEach-Object {
@@ -4430,15 +4540,15 @@ function Get-NetGroupMember {
44304540
}
44314541
else {
44324542
if ($GroupName) {
4433-
$GroupSearcher.filter = "(&(samAccountType=268435456)(name=$GroupName)$Filter)"
4543+
$GroupSearcher.filter = "(&(objectCategory=group)(name=$GroupName)$Filter)"
44344544
}
44354545
elseif ($SID) {
4436-
$GroupSearcher.filter = "(&(samAccountType=268435456)(objectSID=$SID)$Filter)"
4546+
$GroupSearcher.filter = "(&(objectCategory=group)(objectSID=$SID)$Filter)"
44374547
}
44384548
else {
44394549
# default to domain admins
44404550
$SID = (Get-DomainSID -Domain $Domain) + "-512"
4441-
$GroupSearcher.filter = "(&(samAccountType=268435456)(objectSID=$SID)$Filter)"
4551+
$GroupSearcher.filter = "(&(objectCategory=group)(objectSID=$SID)$Filter)"
44424552
}
44434553

44444554
$GroupSearcher.FindAll() | ForEach-Object {
@@ -4510,7 +4620,7 @@ function Get-NetGroupMember {
45104620

45114621
if($Properties) {
45124622

4513-
if($Properties.samaccounttype -match '268435456') {
4623+
if($Properties.samaccounttype -notmatch '805306368') {
45144624
$IsGroup = $True
45154625
}
45164626
else {
@@ -5736,7 +5846,7 @@ function Find-GPOComputerAdmin {
57365846
$GPOComputerAdmin | Add-Member Noteproperty 'ObjectName' $Object.name
57375847
$GPOComputerAdmin | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname
57385848
$GPOComputerAdmin | Add-Member Noteproperty 'ObjectSID' $_
5739-
$GPOComputerAdmin | Add-Member Noteproperty 'IsGroup' $($Object.samaccounttype -match '268435456')
5849+
$GPOComputerAdmin | Add-Member Noteproperty 'IsGroup' $($Object.samaccounttype -notmatch '805306368')
57405850
$GPOComputerAdmin
57415851

57425852
# if we're recursing and the current result object is a group

0 commit comments

Comments
 (0)