# Class One - Notes

## Active Directory look like

### Structure

### PowerShell Scripts and Modules

### PowerShell Script Excecution

### Bypassing PowerShell Security

Offensive .NET - Tradecraft - AV bypass – Source\ Code Obfuscation ----------------

### Offensive .NET - Tradecraft - Payload Delivery

## Attack Methodology

*** ## Domain Enumeration {% file src="/files/nUpOCG2J3nNxe77k9W3r" %} ### Import-Module Microsoft.ActiveDirector ``` Import-Module Microsoft.ActiveDirectory.Management.dll Import-Module ActiveDirectory.psd1 . C:\AD\Tools\PowerView.ps1 ```

``` PS C:\Users\student113> Get-Domain Forest : moneycorp.local DomainControllers : {dcorp-dc.dollarcorp.moneycorp.local} Children : {us.dollarcorp.moneycorp.local} DomainMode : Unknown DomainModeLevel : 7 Parent : moneycorp.local PdcRoleOwner : dcorp-dc.dollarcorp.moneycorp.local RidRoleOwner : dcorp-dc.dollarcorp.moneycorp.local InfrastructureRoleOwner : dcorp-dc.dollarcorp.moneycorp.local Name : dollarcorp.moneycorp.local ``` ``` PS C:\Users\student113> Get-Domain -Domain moneycorp.local Forest : moneycorp.local DomainControllers : {mcorp-dc.moneycorp.local} Children : {dollarcorp.moneycorp.local} DomainMode : Unknown DomainModeLevel : 7 Parent : PdcRoleOwner : mcorp-dc.moneycorp.local RidRoleOwner : mcorp-dc.moneycorp.local InfrastructureRoleOwner : mcorp-dc.moneycorp.local Name : moneycorp.local ```

### Find Shares

### BloodHound

*** ## Domain Enumeration - ACLs

*** ## Domain Enumeration - Group Policy (GPO & OU)

*** ## Domain Trust Enumeration

### Forest Enumeration

*** ## Domain Enumeration - User Hunting

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/crtp-certified-red-team-professional/class-notes/class-one-notes.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.