Local admins powershell script

The "Get-Content" cmdlet reads content from a text file, which seems like it could be abbreviated as "gc."

$servers_list = gc file.txt

Would probably save the contents of your file as a variable, which you could then iterate through, using a For or Foreach loop.

I don't know any Powershell (or much about Windows in general haha) and too lazy to spin up a Windows VM at the moment. But if you show me what you have so far (the scripts you said worked), maybe I could put something together for you tomorrow.

Edit: Or, alternatively, if you have Python available on whatever computer you're going to run the script, maybe I could write a short Python script for you?

Just tried it out at here at work, it does work. But there is was an extra space in the code that was messing it up. Also, it just puts everything into one line... Cleaned it up a tiny bit to make easier to read with multiple computer names as well. Instead of explaining where the one extra space is here is all the code again so you can just copy and paste it. Let me know if that works on your end.


function get-localadmins{
[cmdletbinding()]
Param(
[string]$computerName
)
$group = get-wmiobject win32_group -ComputerName $computerName -Filter "LocalAccount=True AND SID='S-1-5-32-544'"
$query = "GroupComponent = `"Win32_Group.Domain='$($group.domain)'`,Name='$($group.name)'`""
$list = Get-WmiObject win32_groupuser -ComputerName $computerName -Filter $query
$list = $list | %{$_.PartComponent} | % {$_.substring($_.lastindexof("Domain=") + 7).replace("`",Name=`"","\")}
$list = ,("Computer Name: " + $computerName) + $list
$list += " "
return $list
}


import-csv -path C:\input.csv | foreach-object { get-localadmins $_.ComputerName } | out-file C:\output.csv

As a security professional you should definitely look into PowerShell Empire and the PowerView module for enumerating a Windows environment.

Great blog by the co-creator of Empire: harmj0y - security at the misfortune of others

A few of the functions of PowerView:

• Find-LocalAdminAccess - finds machines on the domain that the current user has local admin access to
• Invoke-EnumerateLocalAdmin - enumerates members of the local Administrators groups across all machines in the domain
• Invoke-UserHunter - finds machines on the local domain where specified users are logged into, and can optionally check if the current user has local admin access to found machines
• Invoke-StealthUserHunter - finds all file servers utilizes in user HomeDirectories, and checks the sessions one each file server, hunting for particular users
• Invoke-ProcessHunter - hunts for processes with a specific name or owned by a specific user on domain machines
• Invoke-UserEventHunter - hunts for user logon events in domain controller event logs

Git: https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon