silverhack / voyeur

VOYEUR's main purpose is to generate a fast (and pretty) Active Directory report. The tool is developed entirely in PowerShell (a powerful scripting language) without dependencies (just .Net Framework 3.5 and Ofiice Excel if you want an useful and pretty report). The generated report is a perfect starting point for well-established forensic, incident response team, or security researchers who want to quickly analyze threats in Active Directory Services.

Introduction

VOYEUR's main purpose is to automate several tasks of an Active Directory build review or security assessment. Also, the tool is able to create a fast (and pretty) Active Directory report. The tool is developed entirely in PowerShell (a powerful scripting language) without dependencies like Microsoft Remote Administration tools. (Just .Net Framework 2.0 and Office Excel if you want a useful and pretty report). The generated report is a perfect starting point for well-established forensic, incident response team, security consultants or security researchers who want to quickly analyze threats in Active Directory Services.

Features

• Return a huge number of attributes on computers, users, containers/OUs, groups, ACL, etc...
• Search for locked accounts, expired password, no password policy, etc...
• Return a list of all privileged account in domain. (The script search in SID value instead in a group name)
• Return a list of group’s modification (Users added/deleted for a specific group, etc...)
• Multi-Threading support
• Plugin Support

Usage scenarios

VOYEUR can be used in two ways scenarios:

• Able for using on local or remote computer
• Able for using on joined machine or workgroup machine

Screenshots

Reporting

Support for exporting data driven to several formats like CSV, XML or JSON (Experimental).

The following screenshot shows an example report in JSON format

Office Support

Support for exporting data driven to EXCEL format. The tool also support table style modification, chart creation, company logo or independent language support. At the moment only Office Excel 2010 and Office Excel 2013 are supported by the tool.

Sample reports

An example of report generated by Voyeur can be downloaded from Voyeur_Report_20160609.xlsx

Prerequisites

Voyeur works out of the box with PowerShell version 2.x. You can check your Windows PowerShell version executing the command $PsVersionTable:

PS C:\Users\silverhack> $psversiontable

Name                           Value
----                           -----
CLRVersion                     2.0.50727.5420
BuildVersion                   6.1.7601.17514
PSVersion                      2.0
WSManStackVersion              2.0
PSCompatibleVersions           {1.0, 2.0}
SerializationVersion           1.1.0.1
PSRemotingProtocolVersion      2.1

Installation

You can download the latest zip by clicking [https://github.com/silverhack/voyeur/archive/master.zip here].

Preferably, you can download voyeur by cloning the [https://github.com/silverhack/voyeur] repository:

git clone https://github.com/silverhack/voyeur

Usage

To get a list of basic options and switches use:

get-help .\voyeur.ps1

To get a list of examples use:

get-help .\voyeur.ps1 -Examples

To get a list of all options and examples with detailed info use:

get-help .\voyeur.ps1 -Detailed

Examples

This example retrieve information of an Active Directory for a specific domain. Also, retrieve Organizational Unit information and ACL values. Next, export all data driven to JSON format.

.\voyeur.ps1 -Domain "test.example.local" -ExportACL -ExportOU -ExportTo JSON

This example retrieve information of an Active Directory for a specific domain with explicit credentials and export results to CSV format.

.\voyeur.ps1 -Domain "test.example.local" -AlternateCredential -ExportTo CSV

This example retrieve information of an Active Directory for a specific domain and for specific Organizational Unit (OU). Also, retrieve Organizational Unit information and ACL values. Next, export all data driven to all supported formats

.\voyeur.ps1 -Domain "test.example.local" -SearchRoot "OU=Domain,DC=test,DC=example,DC=local" -ExportACL -ExportOU -ExportTo XML,JSON,CSV,EXCEL

voyeur's Issues

Excel - Invalid Index

silverhack,

I was trying to run this script today and export to excel. I was met with:

"Exception getting "Item": "Invalid index. (Exception from HRESULT: 0x8002000B (DISP_E_BADINDEX))"

I've been reading about the error online and see some solutions talking about $var.workbook.add() vs. $var.worksheet.add(), but I'm unsure where it's failing.

I took a stab at it and commented out lines 33-36 and the scripts appears to have run successfully and produced a pretty excel file for me. It looks like those lines were attempting to delete the extra two worksheets that usually get created with a new Excel file. I don't know if it changed in Excel 2013 or if the environment I'm in has anything in place to limit the number of worksheets in a newly created workbook.

I don't know if this is something you'd want to add an if-statement to in order to determine the Office version before attempting to delete the excess sheets.

Thanks for the tool though. I'm looking forward to really reading through the script to learn more about how you're pulling this information.

-Chris

GppPasswords isn't catching groups.xml with cpassword

When running the script against a DC known to have multiple groups.xml files with one or more cpassword values populated the script is consistently returning "WARNING: No group policy preferences found on Domain...."

In the event that the script is still targetting the wrong DC I've tried:

• hardcoding the IP address of the DC
• flushing DNS til the nslookup for matches the IP of a known target
• rerunning the script with different variables modified in GppPasswords.ps1

Initial thoughts are that the script is running into issues crawling the policies so I tried setting the "-errorAction" flag to something other than "Error" but still no luck.

This is being run from a non-domain joined machine using the "-AlternateCredentials" flag
Let me know what other information I can provide

Issues while using "-ExportACL" switch

Hello,

if anyone experienced program code execution issues while using "-ExportACL" switch, i suggest "Plugins\ACL.ps1" file code changes:

Change following line:
---cut-----------------------------------------------
"Risk" = (Get-Icon $acl.ActiveDirectoryRights)
"Risk" = (Get-Icon $acl.ActiveDirectoryRights).ToString()
"AppliesTo" = [String]$AppliesTo
---cut-----------------------------------------------

to following code (basically comment the line of code):
---cut-----------------------------------------------
"Risk" = (Get-Icon $acl.ActiveDirectoryRights)
#"Risk" = (Get-Icon $acl.ActiveDirectoryRights).ToString()
"AppliesTo" = [String]$AppliesTo
---cut-----------------------------------------------

In any case big thank you to the author of the voyeur!

code mistype in main GPP plugin (Plugins\GppPasswords.ps1)

There is mistype in "Plugins\GppPasswords.ps1", which leads to not-functioning main GPP process.
Suggest change following code:
---cut-----------------------------------------------
Write-Host ("{0}: {1}" -f "Group Policy task ID $bgRunspaceID", "Retrieve potential files with Username:passwords from $DomainName")`
-ForegroundColor Magenta
---cut-----------------------------------------------

to following code:
---cut-----------------------------------------------
Write-Host ("{0}: {1}" -f "Group Policy task ID $bgRunspaceID", "Retrieve potential files with **Username:passwords from $DomainName") -ForegroundColor Magenta
---cut-----------------------------------------------

"All Groups" tab only returns single column

When running the tool and exporting to excel I am only seeing a single column (in this case, "whenChanged") I have tried the following:

• default config setting, as well as
• defining custom filters

Not sure what the culprit could be here, thoughts?

XML search function problem due to ErrorAction in GPP plugin (Plugins\GppPasswords.ps1)

There is possible XML search function problem due to "-ErrorAction Stop" in GPP plugin (Plugins\GppPasswords.ps1).
Suggest change following code:
---cut-----------------------------------------
$AllFiles = Get-ChildItem "\$DomainName\SYSVOL" -Recurse -ErrorAction Stop -Include 'Groups.xml','Services.xml','ScheduledTasks.xml','DataSources.xml','Drives.xml'
---cut-----------------------------------------

to following code:
---cut-----------------------------------------
$AllFiles = Get-ChildItem "\$DomainName\SYSVOL" -Recurse -ErrorAction Continue -Include 'Groups.xml','Services.xml','ScheduledTasks.xml','DataSources.xml','Drives.xml'
---cut-----------------------------------------