PowerView, SharpHound, and the ActiveDirectory Module: Windows-Side Domain Recon

#The Domain Is an Open Book. You Just Need to Know Which Cmdlet to Run.#link

You're RDP'd into ACADEMY-EA-MS01 as htb-student. The ActiveDirectory PowerShell module is already loaded. PowerView.ps1 sits in C:\Tools. SharpHound.exe is compiled and ready. You have three different ways to enumerate this domain, and each reveals something the others miss. Use all three.

Right there: a child domain LOGISTICS.INLANEFREIGHT.LOCAL exists. That's a potential child-to-parent trust attack later. The domain SID is the foundation for every Golden Ticket and ExtraSids attack you'll perform. Write it down.

How do you find Kerberoastable accounts with PowerView?

The -Recurse flag is critical. Without it, you'd see the Secadmins group as a member but miss that mmorgan and spong1990 inherit Domain Admin rights through nested membership. Nested groups are how organizations accidentally grant Domain Admin to the help desk. BloodHound visualizes this instantly, but PowerView gives you the raw data for scripting.

Why run SharpHound when you already have BloodHound.py output?

SharpHound running from a domain-joined host captures session data and local admin relationships that BloodHound.py cannot get from an external position. It queries the SAMR and LSARPC named pipes on each computer to determine who's actually logged in and who has local admin. This session data is what lets you find "Domain Admin X is logged into workstation Y where you have local admin."

You've enumerated from both sides now. Linux gave you the broad strokes. Windows gave you session data and real-time ACL queries. But what happens when the client hands you a locked-down managed workstation with no internet, no tool uploads, and AppLocker blocking PowerShell? You live off the land.