PowerShellEmpire / PowerTools

PowerTools is a collection of PowerShell projects with a focus on offensive operations.
Other
2.03k stars 817 forks source link

Dfs v2 #54

Closed Meatballs1 closed 8 years ago

Meatballs1 commented 8 years ago

Adds ability to query for v2 DFS shares (Win2k8 R2 upwards afaik).

My previous domain was Win2k8 functional level. By upgrading to 2k8R2, then adding a DFS share (ticking the Win2008 option) I created a DFS share.

I think with V2 you create a share root by default, with no folders/links. If you then add a folder you should see links appear in LDAP which can then be queried.

PS C:\Users\Administrator> Get-DFSsharev1

Name                                                               RemoteServerName                                                 
----                                                               ----------------                                                 
TestDFS                                                            WIN-2DE8F2QP867    
PS C:\Users\Administrator> Get-DFSsharev2

Name                                                               RemoteServerName                                                 
----                                                               ----------------                                                 
TestDFSRootv2/Home                                                 WIN-2DE8F2QP867    
PS C:\Users\Administrator> Get-DFSshare

Name                                                               RemoteServerName                                                 
----                                                               ----------------                                                 
TestDFS                                                            WIN-2DE8F2QP867                                                  
TestDFSRootv2/Home                                                 WIN-2DE8F2QP867  

The shares in v2 are in an UTF-16 XML ADSI hex array, but seems to have a couple of weird bytes at the start, which we strip.

Meatballs1 commented 8 years ago

Cool thanks :)