ACL Enumeration

Just another cheatcheet

PowerView

Import-Module .\PowerView.ps1
$sid = Convert-NameToSid <USER>
$sid = Convert-NameToSid "<GROUP>"
# Return guid of ACE
Get-DomainObjectACL -Identity * | ? {$_.SecurityIdentifier -eq $sid}
# Search ACE by using GUID
$guid= "00299570-246d-11d0-a768-00aa006e0529"
Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -like 'ControlAccessRight'} -Properties * |Select Name,DisplayName,DistinguishedName,rightsGuid| ?{$_.rightsGuid -eq $guid} | fl
# With ResolveGUIDs will return ACE as human readable
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid} 

Trick để search nhanh

# Creating a List of Domain Users
Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > ad_users.txt
# Use for loop to search
foreach($line in [System.IO.File]::ReadLines("C:\Users\htb-student\Desktop\ad_users.txt")) {get-acl  "AD:\$(Get-ADUser $line)" | Select-Object Path -ExpandProperty Access | Where-Object {$_.IdentityReference -match 'INLANEFREIGHT\\wley'}}

Sharhound

.\SharpHound.exe -c All --zipfilename <filename>