Recon Modules Domain

Domain Controllers

Overview

Retrieves a list of Domain Controllers from LDAP

PowerShell

[WheresMyImplant.Recon]::DomainControllers()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,DomainControllers

Domain Computers

Overview

Retrieves a list of Domain Computers from LDAP

PowerShell

[WheresMyImplant.Recon]::DomainComputers()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,DomainComputers

Domain Groups

Overview

Retrieves a list of Domain Groups from LDAP

PowerShell

[WheresMyImplant.Recon]::DomainGroups()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,DomainGroups

Domain Users

Overview

Retrieves a list of Domain Users from LDAP

PowerShell

[WheresMyImplant.Recon]::DomainUsers()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,DomainUsers

Kerberos Pre-Authentication

Overview

Retrieves a list of Accounts with Kerberos PreAuthentication Enabled

PowerShell

[WheresMyImplant.Recon]::KerberosPreauthentication()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,KerberosPreauthentication

Password Never Expires

Overview

Retrieves a list of accounts with Password that are set to never expire

PowerShell

[WheresMyImplant.Recon]::PasswordNeverExpires()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,PasswordNeverExpires

Password Not Required

Overview

Retrieves a list of legacy accounts which do not require a password

PowerShell

[WheresMyImplant.Recon]::PasswordNotRequired()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,PasswordNotRequired

Service Principal Name

Overview

Retrieves a list of registered SPN

PowerShell

[WheresMyImplant.Recon]::ServicePrincipalName()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,ServicePrincipalName

LAPS

Overview

Retrieves the attributes for LAPS enabled systems

PowerShell

[WheresMyImplant.Recon]::LAPS()

rundotnetdll32

rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Recon,LAPS