github.com/aniqfakhrul/powerview.py @v2026.2.1

<img style="width: 800px;" alt="Powerview.py" src="https://github.com/user-attachments/assets/11771cef-66dc-407c-aae3-7e1c879723c5" />

---

---

Installation | Basic Usage | Obfuscation | Modules | Logging | User Defined Rules | MCP | Acknowledgements

Overview

PowerView.py is an alternative for the awesome original PowerView.ps1 script. Most of the modules used in PowerView are available here ( some of the flags are changed ). Main goal is to achieve interactive session without having to repeatedly authenticate to ldap.

Installation

https://github.com/aniqfakhrul/powerview.py/wiki/Installation-Guide

Basic Usage

[!NOTE] Note that some of the kerberos functions are still not functioning well just yet but it'll still do most of the works. Detailed usage can be found in Wiki section

• Init connection

powerview range.net/lowpriv:Password123@192.168.86.192 [-k] [--use-ldap | --use-ldaps | --use-gc | --use-gc-ldaps | --use-adws]

• Maintain persistent connection

  [!TIP] Connection persistence is disabled by default. LDAP sessions timeout after inactivity. Use --keepalive-interval to send periodic queries maintaining session state.

• Start web interface

powerview range.net/lowpriv:Password123@192.168.86.192 --web [--web-host 0.0.0.0] [--web-port 3000] [--web-auth user:password1234]

• Init connection with specific authentication. Note that --use-sign-and-seal and --use-channel-binding is only available if you install ldap3 library directly from this branch

powerview range.net/lowpriv:Password123@192.168.86.192 [--use-channel-binding | --use-sign-and-seal | --use-simple-auth]

• Init with schannel. --pfx flag accept pfx formatted certificate file.

  [!NOTE]
  powerview will try to load certificate without password on the first attempt. If it fails, it'll prompt for password. So, no password parameter needed

powerview 10.10.10.10 --pfx administrator.pfx

• Query for specific user

Get-DomainUser Administrator
Get-DomainUser -Identity Administrator

• Specify search attributes

Get-DomainUser -Properties samaccountname,description

• Filter results

Get-DomainUser -Where 'samaccountname [contains][in][eq] admins'

• Count results

Get-DomainUser -Count

• Output result to file

Get-DomainUser -OutFile ~/domain_user.txt

• Format output in a table.

Get-DomainUser -Properties samaccountname,memberof -TableView
Get-DomainUser -Properties samaccountname,memberof -TableView [csv,md,html,latex]

• Set module

Set-DomainObject -Identity "adminuser" -Set 'servicePrincipalname=http/web.ws.local'
Set-DomainObject -Identity "adminuser" -Append 'servicePrincipalname=http/web.ws.local'
Set-DomainObject -Identity "adminuser" -Clear 'servicePrincipalname'

# Reading from local file
Set-DomainObject -Identity "adminuser" -Set 'servicePrincipalname=@/path/to/local/file'
Set-DomainObject -Identity "adminuser" -Append 'servicePrincipalname=@/path/to/local/file'

• Relay mode

powerview 10.10.10.10 --relay [--relay-host] [--relay-port] [--use-ldap | --use-ldaps]

[!NOTE]
This demonstration shows coerced authentication was made using printerbug.py. You may use other methods that coerce HTTP authentication.

Obfuscation

PowerView can obfuscate LDAP queries and related parameters to vary observable patterns while preserving query intent.

• Enable via CLI

powerview range.net/lowpriv:Password123@192.168.86.192 --obfuscate

• Enable via Web

  [!TIP] Toggle Obfuscate in Settings. This applies to subsequent queries for the active session.

What gets obfuscated - Filter: transforms attribute names, operators and values before sending - DN: mutates the search base distinguishedName - Attributes: mutates the requested attribute list

Techniques used - OID attribute encoding with spacing/zero-variation (prefix omitted for compatibility) - Random casing of attributes/values - Numeric/SID zero-prepend on values - Hex-encoding of eligible values - Context-aware spacing in filters and DNs - Equality to approximation operator substitution - Wildcard expansion - ANR attribute randomization - DN hex escaping + random casing - Attribute list OID aliasing + random casing

[!NOTE] Results are functionally equivalent in most cases, but approximation/wildcard expansions can broaden matches. Performance may vary.

[!warning] Excessive obfuscation may be rejected by strict servers or intermediary tooling. Use only when needed.

• ldapx: Flexible LDAP proxy used for inspiration and reference on filter/DN/attribute transformations — https://github.com/Macmod/ldapx
• Research: MaLDAPtive: Obfuscation and De-Obfuscation (DEF CON 32 talk) — https://www.youtube.com/watch?v=mKRS5Iyy7Qo
• Authors: Sabajete Elezaj — https://x.com/sabi_elezi, Daniel Bohannon — https://x.com/danielhbohannon

Module available (so far?)

PV >
Add-ADComputer                 Get-ADObject                   Get-EventLogChannel            Login-As                       Set-ADObject
Add-ADUser                     Get-CA                         Get-EventLogPublisher          Logoff-Session                 Set-ADObjectDN
Add-CATemplate                 Get-CATemplate                 Get-ExchangeDatabase           Reboot-Computer                Set-CATemplate
Add-CATemplateAcl              Get-DMSA                       Get-ExchangeMailbox            Remove-ADComputer              Set-DomainCATemplate
Add-DMSA                       Get-Domain                     Get-ExchangeServer             Remove-ADObject                Set-DomainComputerPassword
Add-DomainCATemplate           Get-DomainCA                   Get-GMSA                       Remove-ADUser                  Set-DomainDNSRecord
Add-DomainCATemplateAcl        Get-DomainCATemplate           Get-GPOLocalGroup              Remove-CATemplate              Set-DomainObject
Add-DomainComputer             Get-DomainComputer             Get-GPOSettings                Remove-DMSA                    Set-DomainObjectDN
Add-DomainDMSA                 Get-DomainController           Get-LocalUser                  Remove-DomainCATemplate        Set-DomainObjectOwner
Add-DomainDNSRecord            Get-DomainDMSA                 Get-NamedPipes                 Remove-DomainComputer          Set-DomainRBCD
Add-DomainGMSA                 Get-DomainDNSRecord            Get-NetComputerInfo            Remove-DomainDMSA              Set-DomainUserPassword
Add-DomainGPO                  Get-DomainDNSZone              Get-NetLoggedOn                Remove-DomainDNSRecord         Set-NetService
Add-DomainGroup                Get-DomainForeignGroupMember   Get-NetProcess                 Remove-DomainGMSA              Set-ObjectOwner
Add-DomainGroupMember          Get-DomainForeignUser          Get-NetService                 Remove-DomainGroupMember       Set-RBCD
Add-DomainObjectAcl            Get-DomainGMSA                 Get-NetSession                 Remove-DomainObject            Set-ShadowCred
Add-DomainOU                   Get-DomainGPO                  Get-NetShare                   Remove-DomainObjectAcl         Set-ShadowCredential
Add-DomainUser                 Get-DomainGPOLocalGroup        Get-NetTerminalSession         Remove-DomainOU                Shutdown-Computer
Add-GMSA                       Get-DomainGPOSettings          Get-ObjectAcl                  Remove-DomainUser              Start-NetService
Add-GPLink                     Get-DomainGroup                Get-ObjectOwner                Remove-GMSA                    Stop-Computer
Add-GPO                        Get-DomainGroupMember          Get-RBCD                       Remove-GPLink                  Stop-NetProcess
Add-GroupMember                Get-DomainObject               Get-RegLoggedOn                Remove-GroupMember             Stop-NetService
Add-NetService                 Get-DomainObjectAcl            Get-SCCM                       Remove-NetService              Unlock-ADAccount
Add-ObjectAcl                  Get-DomainObjectOwner          Get-ShadowCred                 Remove-NetSession              clear
Add-OU                         Get-DomainOU                   Get-ShadowCredential           Remove-NetTerminalSession      exit
Clear-Cache                    Get-DomainRBCD                 Get-TrustKey                   Remove-ObjectAcl               get_pool_stats
ConvertFrom-SID                Get-DomainSCCM                 Get-WDS                        Remove-OU                      history
ConvertFrom-UACValue           Get-DomainTrust                Invoke-ASREPRoast              Remove-ShadowCred              taskkill
Disable-DomainDNSRecord        Get-DomainTrustKey             Invoke-DFSCoerce               Remove-ShadowCredential        tasklist
Find-ForeignGroup              Get-DomainUser                 Invoke-Kerberoast              Restart-Computer
Find-ForeignUser               Get-DomainWDS                  Invoke-MessageBox              Restore-ADObject
Find-LocalAdminAccess          Get-EventLog                   Invoke-PrinterBug              Restore-DomainObject

Domain/LDAP Functions

Module	Alias	Description
Get-DomainUser		Query for all users or specific user objects in AD
Get-DomainComputer		Query for all computers or specific computer objects in AD
Get-DomainGroup		Query for all groups or specific group objects in AD
Get-DomainGroupMember		Query the members for specific domain group
Get-DomainOU		Query for all OUs or specific OU objects in AD
Get-Domain		Query for domain information
Get-DomainController		Query for available domain controllers
Get-DomainDNSRecord		Query for available records. It will recurse all DNS zones if doesn't specify -ZoneName
Get-DomainDNSZone		Query for available DNS zones in the domain
Get-DomainObject	Get-ADObject	Query for all or specified domain objects in AD
Get-DomainObjectAcl	Get-ObjectAcl	Query ACLs for specified AD object
Get-DomainSCCM	Get-SCCM	Query for SCCM
Get-DomainRBCD	Get-RBCD	Finds accounts that are configured for resource-based constrained delegation
Get-DomainObjectOwner	Get-ObjectOwner	Query owner of the AD object
Get-DomainGMSA	Get-GMSA	Query for Group Managed Service Accounts (gMSA) and retrieve their password blobs
Get-DomainDMSA	Get-GDSA	Query for Delegated Managed Service Accounts (dMSA)
Remove-DomainGMSA	Remove-GMSA	Delete an existing Group Managed Service Account (GMSA) from the domain
Remove-DomainDMSA	Remove-DMSA	Delete an existing Delegated Managed Service Account (dMSA) from the domain
Remove-DomainDNSRecord		Remove Domain DNS Record
Remove-DomainComputer	Remove-ADComputer	Remove Domain Computer
Remove-DomainGroupMember	Remove-GroupMember	Remove member of a specific Domain Group
Remove-DomainOU	Remove-OU	Remove OUs or specific OU objects in AD
Remove-DomainObjectAcl	Remove-ObjectAcl	Remove ACLs for specified AD object
Remove-DomainObject	Remove-ADObject	Remove specified Domain Object
Remove-DomainUser	Remove-ADUser	Remove specified Domain User in AD
Set-DomainDNSRecord		Set Domain DNS Record
Set-DomainUserPassword		Set password for specified Domain User
Set-DomainComputerPassword		Set password for specified Domain Computer
Set-DomainObject	Set-ADObject	Set for specified domain objects in AD
Set-DomainObjectDN	Set-ADObjectDN	Modify object's distinguishedName attribute as well as changing OU
Set-DomainObjectOwner	Set-ObjectOwner	Set owner of the AD object
Set-ShadowCredential	Set-ShadowCred	Manage msDS-KeyCredentialLink (Shadow Credentials) for a domain object
Get-ShadowCredential	Get-ShadowCred	List shadow credentials (msDS-KeyCredentialLink) for a domain object or all objects
Remove-ShadowCredential	Remove-ShadowCred	Remove shadow credentials by DeviceId or clear all from a domain object
Add-DomainDNSRecord		Add Domain DNS Record
Disable-DomainDNSRecord		Disabling DNS Record by pointing to invalid address
Add-DomainGMSA	Add-GMSA	Create a new Group Managed Service Account (gMSA) in the domain
Add-DomainDMSA	Add-GMSA	Create a new Delegated Managed Service Account (dMSA) in the domain
Add-DomainUser	Add-ADUser	Add new Domain User in AD
Add-DomainComputer	Add-ADComputer	Add new Domain Computer in AD
Add-DomainGroupMember	Add-GroupMember	Add new member in specified Domain Group in AD
Add-DomainOU	Add-OU	Add new OU object in AD
Add-DomainGPO	Add-GPO	Add new GPO object in AD
Add-DomainObjectAcl	Add-ObjectAcl	Supported rights so far are All, DCsync, RBCD, ShadowCred, WriteMembers
Clear-Cache		Clear cache

GPO Functions

Module	Alias	Description
Get-DomainGPO		Query for domain group policy objects
Get-DomainGPOLocalGroup	Get-GPOLocalGroup	Query all GPOs in a domain that modify local group memberships through Restricted Groups or `Gr