使用Adfind和powerview查询域内特殊的ACL

Adfind

使用adfind查询具备有Dcsync权限的账户

AdFind.exe -s subtree -b "DC=hacktest,DC=com" -sdna nTSecurityDescriptor -sddl+++ -sddlfilter ;;;"Replicating Directory Changes All";; -recmute

AdFind.exe -s subtree -b "DC=hacktest,DC=com" -sdna nTSecurityDescriptor -sddl+++ -sddlfilter ;;;"Replicating Directory Changes";; -recmute

powerview

查询某个域用户的ACL

Get-ObjectAcl -SamAccountName cert -ResolveGUIDs

或者

Get-DomainObjectAcl -Identity cert -domain hacktest.com -ResolveGUIDs

过滤哪个主体对域用户cert有GenericAll完全控制

Get-ObjectAcl -SamAccountName cert -ResolveGUIDs | ? {$_.ActiveDirectoryRights -eq "GenericAll"}

<