-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathEvaluate-CrackedUser.ps1
36 lines (28 loc) · 967 Bytes
/
Evaluate-CrackedUser.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#requires -Modules PowerView
function Evaluate-CrackedUser {
<#
.Synopsis
Compares a user provided list of accounts that we have cracked the passwords for against the list of disabled users in the domain
#>
param(
[parameter(Mandatory=$true)]
[string]$filePath
)
try
{
test-path $filePath -ErrorAction Stop
}
catch
{
Write-Output "File $filePath does not exist"
break
}
[string[]]$cracked_accounts = Get-Content -Path $filePath
$disabled_users= Get-DomainUser -UACFilter AccountDisable
$cracked_accounts | foreach { if (($disabled_users).samaccountname -contains $_ )
{write-host "Username $_ is disabled and cracked" -ForegroundColor Yellow }
elseif ($cracked_Accounts -notcontains $_ )
{write-host "username $_ is disabled"}
else
{Write-host "Username $_ is cracked and enabled" -ForegroundColor RED -BackgroundColor WHITE}}
}