search

PowerShellMafia / PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework
Other
11.96k stars 4.62k forks source link

Invoke-UserHunter does not work #279

Open mortymorty opened 6 years ago

mortymorty commented 6 years ago

I have tested it on Windows Server 2016 with Windows 7 clients. It does not show anything. I have also tested it on Windows Server 2012 with a single DC and one win7 client. also didn't work.

I used BloodHound and It successfully found connections to hosts whereas Invoke-UserHunter failed. I've also used -ShowAll flag but no difference.

BloodHound output (user_sessions.csv) : "WIN7PC2.lab.local","ADMINISTRATOR@LAB.LOCAL","1"

Invoke-UserHunter result is empty. Also all firewalls on DC and clients are turned off.

Please inform me if any other info is needed.

Thanks

DanMcInerney commented 6 years ago

I too am having this issue. I've tested Invoke-UserHunter in many different environments but I get blank output even with -ShowAll and -Verbose. All AV turned off, firewalls off, etc.

DanMcInerney commented 6 years ago

As an update, Invoke-UserHunter from Empire does work. PowerSploit version does not.