Skip to content

Commit 07de4f4

Browse files
rolling-coderolling-code
authored
Enhance README with MSADPT script details
Added detailed documentation for MSADPT scripts, including mandatory parameters, input/output specifications, and example usage.
1 parent d6079f2 commit 07de4f4

1 file changed

Lines changed: 295 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 295 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@ PowerShell-Scripts/
6565
│ └── CheckWritableAttributesADUsers.py (Python, PowerShell version is below)
6666
│ └── CheckWritableAttributesADUsers.ps1 (is the PowerShell equivalent of Python file above)
6767
│ └── Test-ADDnsLowPrivWrite.ps1
68+
69+
## ── 📂 ├── MSADPT/
70+
│ └── MSADPT_start2.ps1
71+
│ └── MSADPT_enumerate_dc2.ps1
72+
│ └── MSADPT_enumerate_shares2.ps1
73+
│ └── MSADPT_scan_network2.ps1
74+
│ └── MMSADPT_audit_adcs_esc1_esc16.ps1
6875
└── README.md
6976
```
7077

@@ -640,3 +647,291 @@ NRPTUsage: run PowerShell as Administrator, then execute .\rmm_nrpt_block.ps1 to
640647
Removal: run .\rmm_nrpt_block.ps1 -Remove to delete only the NRPT rules created by this script.
641648
Chosen over hosts file because hosts only supports exact hostnames, while NRPT supports broader namespace/suffix blocking for local testing.
642649

650+
## ── 📂 Section: MSADPT ──
651+
---
652+
653+
### `MSADPT_start2.ps1`
654+
This script requires all input to be provided through command-line parameters.
655+
656+
It uses the supplied domain credential, target domain FQDN, and bootstrap Active Directory server to collect environment, Domain Controller, and ADCS discovery information.
657+
658+
The results are written to CSV output files.
659+
660+
---
661+
662+
## Mandatory Parameter Summary
663+
664+
| Parameter | Mandatory | Type | Description |
665+
|---|---:|---|---|
666+
| `-Credential` | Yes | `PSCredential` | Domain credential used for Active Directory enumeration operations. Typically supplied using `(Get-Credential)`. |
667+
| `-DomainFQDN` | Yes | `string` | Fully qualified domain name to enumerate. Example: `foo.bar`. |
668+
| `-AdServer` | Yes | `string` | Bootstrap Domain Controller or ADWS-capable server used to perform the initial Active Directory queries. Example: `DC1.foo.bar`. |
669+
| `-EnvironmentOutputCsvPath` | Yes | `string` | CSV output path for environment details collected by the script. |
670+
| `-DCOutputCsvPath` | Yes | `string` | CSV output path for discovered Domain Controllers. |
671+
| `-ADCSOutputCsvPath` | Yes | `string` | CSV output path for discovered Active Directory Certificate Services servers. |
672+
673+
---
674+
675+
## Input Parameters
676+
677+
> These are runtime values supplied to the script.
678+
> No input files are required by this script.
679+
680+
| Parameter | Classification | Example |
681+
|---|---|---|
682+
| `-Credential` | 🟧 **INPUT VALUE** | `(Get-Credential)` |
683+
| `-DomainFQDN` | 🟧 **INPUT VALUE** | `foo.bar` |
684+
| `-AdServer` | 🟧 **INPUT VALUE** | `DC1.foo.bar` |
685+
686+
---
687+
688+
## Output Files
689+
690+
| Parameter | Classification | Example Output File |
691+
|---|---|---|
692+
| `-EnvironmentOutputCsvPath` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_Environment_20260427.csv` |
693+
| `-DCOutputCsvPath` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_DCs_20260427.csv` |
694+
| `-ADCSOutputCsvPath` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_ADCS_20260427.csv` |
695+
696+
---
697+
698+
## Example Usage
699+
700+
```powershell
701+
.\MSADPT_start2.ps1 -Credential (Get-Credential) `
702+
-DomainFQDN "foo.bar" `
703+
-EnvironmentOutputCsvPath "C:\temp\MSADPT_Output\MSADPT_Environment_20260427.csv" `
704+
-DCOutputCsvPath "C:\temp\MSADPT_Output\MSADPT_DCs_20260427.csv" `
705+
-ADCSOutputCsvPath "C:\temp\MSADPT_Output\MSADPT_ADCS_20260427.csv" `
706+
-AdServer "DC1.foo.bar"
707+
```
708+
709+
### `MSADPT_enumerate_dc2.ps1`
710+
711+
This script enumerates details from Domain Controllers that were previously discovered by the MSADPT discovery/start script.
712+
713+
It reads a Domain Controller CSV file as input, connects to Active Directory using explicit credentials, targets an explicitly supplied ADWS-capable Domain Controller, and writes per-DC enumeration output to a specified output directory.
714+
715+
The script does not assume that the host running it is domain joined.
716+
717+
---
718+
719+
## Mandatory Parameter Summary
720+
721+
| Parameter | Mandatory | Type | Description |
722+
|---|---:|---|---|
723+
| `-InputDcCsvPath` | Yes | `string` | Path to the input CSV file containing discovered Domain Controllers. The file must exist before the script runs. |
724+
| `-OutputBaseDir` | Yes | `string` | Base directory where per-DC output folders and CSV files will be written. |
725+
| `-Credential` | Yes | `PSCredential` | Domain credential used for all Active Directory enumeration operations. Typically supplied using `(Get-Credential)`. |
726+
| `-DomainFQDN` | Yes | `string` | Fully qualified domain name to enumerate. Example: `foo.bar`. |
727+
| `-AdServer` | Yes | `string` | Domain Controller or ADWS-capable server used for all Active Directory queries. Example: `DC1.foo.bar`. |
728+
729+
---
730+
731+
## Input Files and Input Values
732+
733+
> These are files or runtime values required by the script.
734+
735+
| Parameter / Item | Classification | Example |
736+
|---|---|---|
737+
| `-InputDcCsvPath` | 🟧 **INPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_DCs.csv` |
738+
| `MSADPT.Helpers.psm1` | 🟧 **REQUIRED LOCAL DEPENDENCY FILE** | `.\MSADPT.Helpers.psm1` |
739+
| `-Credential` | 🟧 **INPUT VALUE** | `(Get-Credential)` |
740+
| `-DomainFQDN` | 🟧 **INPUT VALUE** | `foo.bar` |
741+
| `-AdServer` | 🟧 **INPUT VALUE** | `DC1.foo.bar` |
742+
743+
---
744+
745+
## Output Location
746+
747+
| Parameter | Classification | Example Output Location |
748+
|---|---|---|
749+
| `-OutputBaseDir` | 🟩 **OUTPUT DIRECTORY** | `C:\temp\MSADPT_Output\DC_Enumeration` |
750+
751+
---
752+
753+
## Example Usage
754+
755+
```powershell
756+
.\MSADPT_enumerate_dc2.ps1 `
757+
-InputDcCsvPath "C:\temp\MSADPT_Output\MSADPT_DCs.csv" `
758+
-OutputBaseDir "C:\temp\MSADPT_Output\DC_Enumeration" `
759+
-Credential (Get-Credential) `
760+
-DomainFQDN "foo.bar" `
761+
-AdServer "DC1.foo.bar"
762+
```
763+
764+
### `MSADPT_enumerate_shares2.ps1`
765+
766+
This script enumerates network shares on previously discovered Domain Controllers and prepares per-DC output locations for share enumeration results.
767+
768+
It consumes a Domain Controller CSV file generated by a previous MSADPT discovery script, uses explicit domain credentials for operations, and writes output under a specified base directory.
769+
770+
The script does not assume that the host running it is domain joined.
771+
772+
---
773+
774+
## Mandatory Parameter Summary
775+
776+
| Parameter | Mandatory | Type | Description |
777+
|---|---:|---|---|
778+
| `-InputDcCsvPath` | Yes | `string` | Path to the input CSV file containing discovered Domain Controllers. The file must exist before the script runs. |
779+
| `-OutputBaseDir` | Yes | `string` | Base output directory where per-DC share enumeration output folders and files will be written. |
780+
| `-Credential` | Yes | `PSCredential` | Domain credential used for Active Directory and share enumeration operations. Typically supplied using `(Get-Credential)`. |
781+
782+
---
783+
784+
## Input Files and Input Values
785+
786+
> These are files or runtime values required by the script.
787+
788+
| Parameter / Item | Classification | Example |
789+
|---|---|---|
790+
| `-InputDcCsvPath` | 🟧 **INPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_DCs.csv` |
791+
| `MSADPT.Helpers.psm1` | 🟧 **REQUIRED LOCAL DEPENDENCY FILE** | `.\MSADPT.Helpers.psm1` |
792+
| `-Credential` | 🟧 **INPUT VALUE** | `(Get-Credential)` |
793+
794+
---
795+
796+
## Output Location
797+
798+
| Parameter | Classification | Example Output Location |
799+
|---|---|---|
800+
| `-OutputBaseDir` | 🟩 **OUTPUT DIRECTORY** | `C:\temp\MSADPT_Output\Shares` |
801+
802+
---
803+
804+
## Example Usage
805+
806+
```powershell
807+
.\MSADPT_enumerate_shares2.ps1 `
808+
-InputDcCsvPath "C:\temp\MSADPT_Output\MSADPT_DCs.csv" `
809+
-OutputBaseDir "C:\temp\MSADPT_Output\Shares" `
810+
-Credential (Get-Credential)
811+
```
812+
813+
### `MSADPT_scan_network2.ps1`
814+
815+
This script performs explicit network discovery and service checks against one or more operator-supplied IPv4 target ranges.
816+
817+
It does not automatically derive local network ranges, does not assume the host is domain joined, and does not rely on a configuration file or session-scoped credentials.
818+
819+
The script can optionally attempt to use `nmap` if it is available in `PATH`, and can optionally perform SMB signing checks depending on the supplied parameter values.
820+
821+
---
822+
823+
## Mandatory Parameter Summary
824+
825+
| Parameter | Mandatory | Type | Description |
826+
|---|---:|---|---|
827+
| `-Credential` | Yes | `PSCredential` | Credential used for remote operations that require authentication. Typically supplied using `(Get-Credential)`. |
828+
| `-NetworkRanges` | Yes | `string[]` | One or more explicit IPv4 target ranges to process. Supports CIDR ranges and start/end IP ranges. |
829+
| `-CommonPorts` | Yes | `int[]` | One or more TCP ports to check. Ports must be between `1` and `65535`. |
830+
| `-UseNmapIfAvailable` | Yes | `bool` | Indicates whether the script should attempt to use `nmap` if it is present in `PATH`. |
831+
| `-CheckSMBSigning` | Yes | `bool` | Indicates whether SMB signing checks should be performed in the main scan logic. |
832+
| `-OutputBaseDir` | Yes | `string` | Base directory for any per-run or raw output artifacts. |
833+
| `-OutputHostsCsvPath` | Yes | `string` | Explicit CSV output path for discovered hosts. |
834+
| `-OutputOpenPortsCsvPath` | Yes | `string` | Explicit CSV output path for discovered open ports. |
835+
| `-OutputSmbSigningCsvPath` | Yes | `string` | Explicit CSV output path for SMB signing results. |
836+
837+
---
838+
839+
## Input Files and Input Values
840+
841+
> These are files, dependencies, or runtime values required by the script.
842+
843+
| Parameter / Item | Classification | Example |
844+
|---|---|---|
845+
| `MSADPT.Helpers.psm1` | 🟧 **REQUIRED LOCAL DEPENDENCY FILE** | `.\MSADPT.Helpers.psm1` |
846+
| `-Credential` | 🟧 **INPUT VALUE** | `(Get-Credential)` |
847+
| `-NetworkRanges` | 🟧 **INPUT VALUE** | `"10.10.10.0/24","10.20.30.10-10.20.30.20"` |
848+
| `-CommonPorts` | 🟧 **INPUT VALUE** | `445,3389,5985` |
849+
| `-UseNmapIfAvailable` | 🟧 **INPUT VALUE** | `$true` |
850+
| `-CheckSMBSigning` | 🟧 **INPUT VALUE** | `$true` |
851+
852+
---
853+
854+
## Output Locations and Files
855+
856+
| Parameter | Classification | Example Output Location |
857+
|---|---|---|
858+
| `-OutputBaseDir` | 🟩 **OUTPUT DIRECTORY** | `C:\temp\MSADPT_Output\Network` |
859+
| `-OutputHostsCsvPath` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_Network_Hosts.csv` |
860+
| `-OutputOpenPortsCsvPath` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_OpenPorts.csv` |
861+
| `-OutputSmbSigningCsvPath` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\MSADPT_SMBSigning_Status.csv` |
862+
863+
---
864+
865+
## Example Usage
866+
867+
```powershell
868+
.\MSADPT_scan_network2.ps1 `
869+
-Credential (Get-Credential) `
870+
-NetworkRanges "10.10.10.0/24","10.20.30.10-10.20.30.20" `
871+
-CommonPorts 445,3389,5985 `
872+
-UseNmapIfAvailable $true `
873+
-CheckSMBSigning $true `
874+
-OutputBaseDir "C:\temp\MSADPT_Output\Network" `
875+
-OutputHostsCsvPath "C:\temp\MSADPT_Output\MSADPT_Network_Hosts.csv" `
876+
-OutputOpenPortsCsvPath "C:\temp\MSADPT_Output\MSADPT_OpenPorts.csv" `
877+
-OutputSmbSigningCsvPath "C:\temp\MSADPT_Output\MSADPT_SMBSigning_Status.csv"
878+
```
879+
880+
### `MSADPT_audit_adcs_esc1_esc16.ps1`
881+
882+
This script performs a defensive, configuration-focused audit of an Active Directory Certificate Services (AD CS) deployment for likely exposure indicators associated with ESC1 through ESC16.
883+
884+
The script enumerates enterprise Certification Authorities, published certificate templates, PKI-related objects in the Configuration partition, template ACLs, selected PKI object ACLs, selected CA registry flags, selected Domain Controller certificate-mapping posture indicators, and web enrollment exposure indicators where possible.
885+
886+
The script does not exploit anything, request or forge certificates, or modify templates, ACLs, registry keys, or CA settings.
887+
888+
---
889+
890+
## Mandatory Parameter Summary
891+
892+
| Parameter | Mandatory | Type | Description |
893+
|---|---:|---|---|
894+
| `-OutputBaseDir` | Yes | `string` | Directory where CSV and log outputs are written. |
895+
| `-IncludeUnpublishedTemplates` | Yes | `switch` | Controls whether all certificate templates in Active Directory are evaluated. When omitted behavior is not allowed because the parameter is mandatory. Use `-IncludeUnpublishedTemplates` to enable, or `-IncludeUnpublishedTemplates:$false` to disable. |
896+
| `-SkipRemoteChecks` | Yes | `switch` | Controls whether best-effort remote registry and web endpoint checks against CA servers and Domain Controllers are skipped. Use `-SkipRemoteChecks` to skip remote checks, or `-SkipRemoteChecks:$false` to perform them. |
897+
| `-DirectoryServer` | Yes | `string` | Domain Controller or directory server to use for Active Directory queries. Example: `DC1.foo.bar`. |
898+
| `-Credential` | Yes | `PSCredential` | Credential used for Active Directory queries and remote checks. Typically supplied using `(Get-Credential)` or a credential variable. |
899+
900+
---
901+
902+
## Input Files and Input Values
903+
904+
> These are files, dependencies, switches, or runtime values required by the script.
905+
906+
| Parameter / Item | Classification | Example |
907+
|---|---|---|
908+
| `MSADPT.Helpers.psm1` | 🟧 **REQUIRED LOCAL DEPENDENCY FILE** | `.\MSADPT.Helpers.psm1` |
909+
| `-DirectoryServer` | 🟧 **INPUT VALUE** | `DC1.foo.bar` |
910+
| `-Credential` | 🟧 **INPUT VALUE** | `$cred` |
911+
| `-IncludeUnpublishedTemplates` | 🟧 **INPUT SWITCH** | `-IncludeUnpublishedTemplates:$false` |
912+
| `-SkipRemoteChecks` | 🟧 **INPUT SWITCH** | `-SkipRemoteChecks:$false` |
913+
914+
---
915+
916+
## Output Locations and Files
917+
918+
| Parameter / Output | Classification | Example |
919+
|---|---|---|
920+
| `-OutputBaseDir` | 🟩 **OUTPUT DIRECTORY** | `C:\temp\MSADPT_Output\ADCS` |
921+
| `MSADPT_ADCS_ESC_Audit_<timestamp>.csv` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\ADCS\MSADPT_ADCS_ESC_Audit_<timestamp>.csv` |
922+
| `MSADPT_ADCS_ESC_Audit_Log_<timestamp>.txt` | 🟩 **OUTPUT FILE** | `C:\temp\MSADPT_Output\ADCS\MSADPT_ADCS_ESC_Audit_Log_<timestamp>.txt` |
923+
924+
---
925+
926+
## Example Usage: Standard Audit
927+
928+
```powershell
929+
$cred = Get-Credential
930+
931+
.\MSADPT_audit_adcs_esc1_esc16.ps1 `
932+
-DirectoryServer "DC1.foo.bar" `
933+
-Credential $cred `
934+
-OutputBaseDir "C:\temp\MSADPT_Output\ADCS" `
935+
-IncludeUnpublishedTemplates:$false `
936+
-SkipRemoteChecks:$false
937+
```

0 commit comments

Comments
 (0)