https://4ym3nn.github.io/tags/commands/Recent content in Commands onHugoen-usTue, 09 Jun 2026 17:36:00 +0100https://4ym3nn.github.io/reviews/crtp-cheatsheet/Tue, 09 Jun 2026 17:36:00 +0100https://4ym3nn.github.io/reviews/crtp-cheatsheet/<p>Source: cleaned from <code>sheet.md</code> only. Commands were deduplicated where repeated verbatim. No techniques were added beyond the original notes.</p> <h2 id="bloodhound-collection">BloodHound Collection</h2> <pre tabindex="0"><code>./SharpHound.exe --collectionmethods All --excludedcs </code></pre><pre tabindex="0"><code>./sharp.xe --collectionmethods Group,GPOLocalGroup,Session,Trusts,ACL,Container,ObjectProps,SPNTargets,CertServices --excludedcs </code></pre><pre tabindex="0"><code>C:\AD\Tools\Loader.exe -Path C:\AD\Tools\SharpHound\SharpHound.exe - args --collectionmethods Group,GPOLocalGroup,Session,Trusts,ACL,Container,ObjectProps,SPNTarg ets,CertServices --excludedcs </code></pre><h2 id="execution--session-prep">Execution / Session Prep</h2> <p><strong>PowerShell</strong> Bypass PowerShell execution policy restrictions for the current shell.</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-powershell" data-lang="powershell"><span style="display:flex;"><span>powershell -ExecutionPolicy bypass </span></span></code></pre></div><p><strong>InviShell</strong> Launch InviShell without requiring admin.</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bat" data-lang="bat"><span style="display:flex;"><span>C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat </span></span></code></pre></div><h2 id="enumeration">Enumeration</h2> <p><strong>PowerView</strong> List domain user <code>samaccountname</code> values.</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-powershell" data-lang="powershell"><span style="display:flex;"><span>Get-DomainUser | select -ExpandProperty samaccountname </span></span></code></pre></div><p><strong>PowerView</strong> List domain computers by DNS hostname.</p>