Lsa
Commands for interacting with the LSA
Synopsis
Subcommands
| Command |
Description |
| addpriv |
Adds one or more privileges to an account |
| createaccount |
Creates an account |
| enumaccounts |
Enumerates accounts |
| enumprivaccounts |
Enumerates accounts that have a specific privilege or user right |
| getprivs |
Gets the privileges assigned to an account. |
| getrights |
Gets the user rights and privileges granted to an account |
| getsysaccess |
Gets the system access rights granted to an account |
| lookupname |
Gets the SID for one or more account names |
| lookupsid |
Translates one or more SIDs to their account names |
| rmpriv |
Removes one or more privileges from an account |
| setsysaccess |
Sets the system access rights granted to an account |
| whoami |
Gets the name and domain of the connected user |
For help on a subcommand, use Lsa <subcommand> -h
Lsa addpriv
Adds one or more privileges to an account
Synopsis
Lsa addpriv [options] <ServerName> <Privileges>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
| <Privileges> |
|
<String[]> |
Names or values of the privileges to add |
| |
|
|
Possible values: |
| |
|
|
SeCreateTokenPrivilege |
| |
|
|
SeAssignPrimaryTokenPrivilege |
| |
|
|
SeLockMemoryPrivilege |
| |
|
|
SeIncreaseQuotaPrivilege |
| |
|
|
SeMachineAccountPrivilege |
| |
|
|
SeTcbPrivilege |
| |
|
|
SeSecurityPrivilege |
| |
|
|
SeTakeOwnershipPrivilege |
| |
|
|
SeLoadDriverPrivilege |
| |
|
|
SeSystemProfilePrivilege |
| |
|
|
SeSystemtimePrivilege |
| |
|
|
SeProfileSingleProcessPrivilege |
| |
|
|
SeIncreaseBasePriorityPrivilege |
| |
|
|
SeCreatePagefilePrivilege |
| |
|
|
SeCreatePermanentPrivilege |
| |
|
|
SeBackupPrivilege |
| |
|
|
SeRestorePrivilege |
| |
|
|
SeShutdownPrivilege |
| |
|
|
SeDebugPrivilege |
| |
|
|
SeAuditPrivilege |
| |
|
|
SeSystemEnvironment |
| |
|
|
SeChangeNotifyPrivilege |
| |
|
|
SeRemoteShutdownPrivilege |
| |
|
|
SeUndockPrivilege |
| |
|
|
SeSyncAgentPrivilege |
| |
|
|
SeEnableDelegationPrivilege |
| |
|
|
SeManageVolumePrivilege |
| |
|
|
SeImpersonatePrivilege |
| |
|
|
SeCreateGlobalPrivilege |
| |
|
|
SeTrustedCredManAccessPrivilege |
| |
|
|
SeRelabelPrivilege |
| |
|
|
SeIncreaseWorkingSetPrivilege |
| |
|
|
SeTimeZonePrivilege |
| |
|
|
SeCreateSymbolicLinkPrivilege |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ByName |
|
<String> |
Account name |
| -BySid |
|
<SecurityIdentifier> |
SID of account |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
Each privilege may be the symbolic name or the value, expressed as a 64-bit
integer. If the name is not a predefined privilege, Lsa addpriv resolves the
name with the remote LSA.
This command cannot be used to grant a user right.
Note that the LSA tracks accounts separate from the SAM. Even for local
accounts, you make need to create the LSA account first.
Examples
Example 1 - Add SeLoadDriverPrivilege and SeTcbPrivilege to Administrators
Lsa addpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators SeLoadDriver SeTcb
Example 2 - Add SeLoadDriverPrivilege and SeTcbPrivilege to S-1-5-21-1752138614-393460150-3098146133-1103
Lsa addpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-21-1752138614-393460150-3098146133-1103 SeLoadDriver SeTcb
Lsa createaccount
Creates an account
Synopsis
Lsa createaccount [options] <ServerName> <Sid>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
| <Sid> |
|
<SecurityIdentifier> |
SID of account to create |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Examples
Example 1 - Create a policy account
Lsa createaccount LUMON-FS1 -UserName milchick -Password Br3@kr00m! S-1-5-32-646
Example 2 - Create a policy account for a domain SID
Lsa createaccount LUMON-FS1 -UserName milchick -Password Br3@kr00m! S-1-5-21-1752138614-393460150-3098146133-1103
Lsa enumaccounts
Enumerates accounts
Synopsis
Lsa enumaccounts [options] <ServerName>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Sid |
| |
|
|
AccountName |
| |
|
|
DomainName |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
By default, the output only includes the SIDs of the accounts. Use
-OutputFields if you want additional information such as the account or domain
name. The additional fields require another RPC call to the server.
Examples
Example 1 - Get account SIDs
Lsa enumaccounts LUMON-FS1 -UserName milchick -Password Br3@kr00m!
Example 2 - Get account SIDs with account name and domain
Lsa enumaccounts LUMON-FS1 -UserName milchick -Password Br3@kr00m! -OutputFields Sid, AccountName, DomainName
Lsa enumprivaccounts
Enumerates accounts that have a specific privilege or user right
Synopsis
Lsa enumprivaccounts [options] -Privilege <String> <ServerName>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Sid |
| |
|
|
AccountName |
| |
|
|
DomainName |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -Privilege |
|
<String> |
Name of privilege or user right to check for |
| |
|
|
Possible values: |
| |
|
|
SeCreateTokenPrivilege |
| |
|
|
SeAssignPrimaryTokenPrivilege |
| |
|
|
SeLockMemoryPrivilege |
| |
|
|
SeIncreaseQuotaPrivilege |
| |
|
|
SeMachineAccountPrivilege |
| |
|
|
SeTcbPrivilege |
| |
|
|
SeSecurityPrivilege |
| |
|
|
SeTakeOwnershipPrivilege |
| |
|
|
SeLoadDriverPrivilege |
| |
|
|
SeSystemProfilePrivilege |
| |
|
|
SeSystemtimePrivilege |
| |
|
|
SeProfileSingleProcessPrivilege |
| |
|
|
SeIncreaseBasePriorityPrivilege |
| |
|
|
SeCreatePagefilePrivilege |
| |
|
|
SeCreatePermanentPrivilege |
| |
|
|
SeBackupPrivilege |
| |
|
|
SeRestorePrivilege |
| |
|
|
SeShutdownPrivilege |
| |
|
|
SeDebugPrivilege |
| |
|
|
SeAuditPrivilege |
| |
|
|
SeSystemEnvironment |
| |
|
|
SeChangeNotifyPrivilege |
| |
|
|
SeRemoteShutdownPrivilege |
| |
|
|
SeUndockPrivilege |
| |
|
|
SeSyncAgentPrivilege |
| |
|
|
SeEnableDelegationPrivilege |
| |
|
|
SeManageVolumePrivilege |
| |
|
|
SeImpersonatePrivilege |
| |
|
|
SeCreateGlobalPrivilege |
| |
|
|
SeTrustedCredManAccessPrivilege |
| |
|
|
SeRelabelPrivilege |
| |
|
|
SeIncreaseWorkingSetPrivilege |
| |
|
|
SeTimeZonePrivilege |
| |
|
|
SeCreateSymbolicLinkPrivilege |
| |
|
|
None |
| |
|
|
SeInteractiveLogonRight |
| |
|
|
SeNetworkLogonRight |
| |
|
|
SeBatchLogonRight |
| |
|
|
SeServiceLogonRight |
| |
|
|
SeDenyInteractiveLogonRight |
| |
|
|
SeDenyNetworkLogonRight |
| |
|
|
SeDenyBatchLogonRight |
| |
|
|
SeDenyServiceLogonRight |
| |
|
|
SeRemoteInteractiveLogonRight |
| |
|
|
SeDenyRemoteInteractiveLogonRight |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Examples
Example 1 - Enumerate accounts with SeInteractiveLogonRight
Lsa enumprivaccounts LUMON-FS1 -UserName milchick -Password Br3@kr00m! -Privilege SeInteractiveLogonRight
Lsa getprivs
Gets the privileges assigned to an account.
Synopsis
Lsa getprivs [options] <ServerName>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ByName |
|
<String> |
Account name |
| -BySid |
|
<SecurityIdentifier> |
SID of account |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Privilege |
| |
|
|
Attributes |
| |
|
|
PrivilegeName |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
One of -BySid or -ByName is required to specify the account to get the
privileges for. The account may be a user or group.
By default, only the names of predefined privileges are resolved. Te get the
names of all privileges, use -OutputFields to specify PrivilegeName
Examples
Example 1 - Get privileges for account by SID
Lsa getprivs LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544
Example 2 - Get privileges for account by name
Lsa getprivs LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrator
Example 3 - Get privileges for account by name, look up privilege names
Lsa getprivs LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrator -OutputFields Privilege, PrivilegeName
Lsa getrights
Gets the user rights and privileges granted to an account
Synopsis
Lsa getrights [options] <ServerName>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ByName |
|
<String> |
Account name |
| -BySid |
|
<SecurityIdentifier> |
SID of account |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Name |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Examples
Example 1 - Get privileges and rights by SID
Lsa getrights LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544
Example 2 - Get privileges and rights by name
Lsa getrights LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators
Lsa getsysaccess
Gets the system access rights granted to an account
Synopsis
Lsa getsysaccess [options] <ServerName>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ByName |
|
<String> |
Account name |
| -BySid |
|
<SecurityIdentifier> |
SID of account |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Value |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Examples
Example 1 - Get system access rights by SID
Lsa getsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544
Example 2 - Get system access rights by account name
Lsa getsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators
Lsa lookupname
Gets the SID for one or more account names
Synopsis
Lsa lookupname [options] <ServerName> <AccountNames>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
| <AccountNames> |
|
<String[]> |
Names of accounts to look up |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
AccountName |
| |
|
|
NameType |
| |
|
|
DomainName |
| |
|
|
DomainSid |
| |
|
|
AccountRid |
| |
|
|
AccountSid |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
The command accepts multiple user names
Examples
Example 1 - Look up multiple names
Lsa lookupname LUMON-FS1 -UserName milchick -Password Br3@kr00m! marks milchick
Lsa lookupsid
Translates one or more SIDs to their account names
Synopsis
Lsa lookupsid [options] <ServerName> <Sids>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
| <Sids> |
|
<SecurityIdentifier[]> |
SIDs to look up |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
AccountName |
| |
|
|
NameType |
| |
|
|
DomainName |
| |
|
|
DomainSid |
| |
|
|
AccountRid |
| |
|
|
AccountSid |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
The command accepts multiple SIDs
Examples
Example 1 - Look up multiple names
Lsa lookupsid LUMON-FS1 -UserName milchick -Password Br3@kr00m! S-1-5-21-1752138614-393460150-3098146133-1103 S-1-5-21-1752138614-393460150-3098146133-1107
Titanis tries to connect via TCP but cannot find an enpoint, and falls back to
connecting over SMB.
Example 2 - Look up multiple names on a DC
Lsa lookupsid LUMON-DC1 -PreferSmb -UserName milchick -Password Br3@kr00m! S-1-5-21-1752138614-393460150-3098146133-1103 S-1-5-21-1752138614-393460150-3098146133-1107
By default, Titanis checks for a TCP endpoint and tries to connect over IP
first. Specifying -PreferSmb forces it to skip the check for the TCP endpoint
and uses named pipes instead.
Lsa rmpriv
Removes one or more privileges from an account
Synopsis
Lsa rmpriv [options] <ServerName> <Privileges>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
| <Privileges> |
|
<String[]> |
Names or values of the privileges to add |
| |
|
|
Possible values: |
| |
|
|
SeCreateTokenPrivilege |
| |
|
|
SeAssignPrimaryTokenPrivilege |
| |
|
|
SeLockMemoryPrivilege |
| |
|
|
SeIncreaseQuotaPrivilege |
| |
|
|
SeMachineAccountPrivilege |
| |
|
|
SeTcbPrivilege |
| |
|
|
SeSecurityPrivilege |
| |
|
|
SeTakeOwnershipPrivilege |
| |
|
|
SeLoadDriverPrivilege |
| |
|
|
SeSystemProfilePrivilege |
| |
|
|
SeSystemtimePrivilege |
| |
|
|
SeProfileSingleProcessPrivilege |
| |
|
|
SeIncreaseBasePriorityPrivilege |
| |
|
|
SeCreatePagefilePrivilege |
| |
|
|
SeCreatePermanentPrivilege |
| |
|
|
SeBackupPrivilege |
| |
|
|
SeRestorePrivilege |
| |
|
|
SeShutdownPrivilege |
| |
|
|
SeDebugPrivilege |
| |
|
|
SeAuditPrivilege |
| |
|
|
SeSystemEnvironment |
| |
|
|
SeChangeNotifyPrivilege |
| |
|
|
SeRemoteShutdownPrivilege |
| |
|
|
SeUndockPrivilege |
| |
|
|
SeSyncAgentPrivilege |
| |
|
|
SeEnableDelegationPrivilege |
| |
|
|
SeManageVolumePrivilege |
| |
|
|
SeImpersonatePrivilege |
| |
|
|
SeCreateGlobalPrivilege |
| |
|
|
SeTrustedCredManAccessPrivilege |
| |
|
|
SeRelabelPrivilege |
| |
|
|
SeIncreaseWorkingSetPrivilege |
| |
|
|
SeTimeZonePrivilege |
| |
|
|
SeCreateSymbolicLinkPrivilege |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ByName |
|
<String> |
Account name |
| -BySid |
|
<SecurityIdentifier> |
SID of account |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
Each privilege may be the symbolic name or the value, expressed as a 64-bit
integer. If the name is not a predefined privilege, Lsa rmpriv resolves the
name with the remote LSA. For predefined privilege names (those in the help
text), you are not required to append Privilege to the name.
To remove all privileges, use *. Note that you may have to escape this
depending on which shell you are using.
This command cannot be used to remove a user right.
Note that the LSA tracks accounts separate from the SAM. Even for local
accounts, you make need to create the LSA account first.
Examples
Example 1 - Remove SeTcbPrivilege from Administrators
Lsa rmpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators SeTcb
Example 2 - Remove SeTcbPrivilege from S-1-5-32-646
Lsa rmpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-646 SeTcb
Example 3 - Remove all privileges from S-1-5-32-646
Lsa rmpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-646 *
Lsa setsysaccess
Sets the system access rights granted to an account
Synopsis
Lsa setsysaccess [options] <ServerName> <Rights>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
| <Rights> |
|
<SystemAccessRights[]> |
Access rights to grant |
| |
|
|
Possible values: |
| |
|
|
None |
| |
|
|
SeInteractiveLogonRight |
| |
|
|
SeNetworkLogonRight |
| |
|
|
SeBatchLogonRight |
| |
|
|
SeServiceLogonRight |
| |
|
|
SeDenyInteractiveLogonRight |
| |
|
|
SeDenyNetworkLogonRight |
| |
|
|
SeDenyBatchLogonRight |
| |
|
|
SeDenyServiceLogonRight |
| |
|
|
SeRemoteInteractiveLogonRight |
| |
|
|
SeDenyRemoteInteractiveLogonRight |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ByName |
|
<String> |
Account name |
| -BySid |
|
<SecurityIdentifier> |
SID of account |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Value |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -Reset |
|
<SwitchParam> |
Clears any rights already set on the account |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
By default, the specified access rights are added to the rights already granted
to the account. Use -Reset to clear existing access rights and only grant the
rights specified. To reset all access rights currently granted, use -Reset and
specify a single right of 0
Examples
Example 1 - Set system access rights by SID
Lsa setsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544 SeBatchLogonRight
Example 2 - Set system access rights by account name
Lsa setsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators SeBatchLogonRight
Lsa whoami
Gets the name and domain of the connected user
Synopsis
Lsa whoami [options] <ServerName>
Parameters
| Name |
Aliases |
Value |
Description |
| <ServerName> |
|
<String> |
RPC server to interact with |
Options
| Name |
Aliases |
Value |
Description |
| -AuthEpm |
|
<SwitchParam> |
Authenticates EP mapper requests |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -EncryptEpm |
|
<SwitchParam> |
Encrypts EP mappend requests |
| -EncryptRpc |
|
<SwitchParam> |
Encrypts RPC messages |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
WireName |
| |
|
|
UserName |
| |
|
|
Realm |
| |
|
|
OriginalText |
| |
|
|
NameType |
| |
|
|
NamePartCount |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PreferSmb |
|
<SwitchParam> |
If the interface supports named pipes, attempt to connect over the named pipe instead of TCP |
| -RpcCallTimeout |
|
<Duration> |
Time to wait for RPC calls |
| -RpcConnectTimeout |
|
<Duration> |
Time to wait for RPC connections |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Spnego |
|
<SwitchParam> |
Uses SP-NEGO for authentication |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Client Behavior
| Name |
Aliases |
Value |
Description |
| -DfsReferralBufferSize |
|
<Int32> |
Specifies the size for the DFS referral buffer (default=4096) |
| -F, -FollowDfs |
|
<SwitchParam> |
Checks for and follows DFS referrals (default=true) |
Connection
| Name |
Aliases |
Value |
Description |
| -Dialects |
|
<Smb2Dialect[]> |
List of SMB2 dialects to negotiate |
| |
|
|
Possible values: |
| |
|
|
Smb2_0_2 |
| |
|
|
Smb2_1 |
| |
|
|
Smb3_0 |
| |
|
|
Smb3_0_2 |
| |
|
|
Smb3_1_1 |
| -EncryptSmb |
|
<SwitchParam> |
Requires an encrypted connection |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -RequireSecureNegotiate |
|
<SwitchParam> |
Requires the client to authenticate the negotiation |
| -RequireSigning |
-signreq |
<SwitchParam> |
Requires packets to be signed |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Examples
Example 1 - Get connected user name (NTLM)
Lsa whoami LUMON-FS1 -UserName milchick -Password Br3@kr00m!
Example 2 - Get connected user name (Kerberos)
Lsa whoami LUMON-FS1 -UserName milchick@LUMON -Password Br3@kr00m! -Kdc LUMON-DC1
Example 3 - Get connected user name (Kerberos S4U2proxy)
Lsa whoami LUMON-FS1 -UserName allentown$@LUMON -Password password -S4UserName ColdHarbor -S4ProxyService host/allentown -Kdc LUMON-DC1
Example 4 - Get connected user name (Kerberos S4U2proxy with NTLM hash)
Lsa whoami LUMON-FS1 -UserName allentown$@LUMON -NtlmHash 8846F7EAEE8FB117AD06BDD830B7586C -S4UserName ColdHarbor -S4ProxyService host/allentown -Kdc LUMON-DC1
Example 5 - Get connected user name (Interrealm referral)
Lsa whoami B5X-DC1.branch5x.lumon.ind -UserName milchick@LUMON -Password Br3@kr00m! -Kdc LUMON-DC1 -PreferSmb -EncryptRpc