Attacker Script identified via HuntressLabs Analyst Jevon Ang, June 2026

Untitled1.ps1

# Attacker Script identified via HuntressLabs Analyst Jevon Ang, June 2026

###
<#
.SYNOPSIS
    100% Working AD Information Gathering Script - FULLY FIXED
#>

Clear-Host
Write-Host "=== AD Information Gathering Script v3.0 ===" -ForegroundColor Cyan
Write-Host ""

#===========================================================
# 1. GET DOMAIN
#===========================================================

$domain = (Get-WmiObject Win32_ComputerSystem).Domain
if (-not $domain) {
    Write-Host "ERROR: Computer not domain-joined!" -ForegroundColor Red
    exit 1
}

Write-Host "Domain: $domain" -ForegroundColor Green

#===========================================================
# 2. GET DOMAIN CONTROLLER AS STRING
#===========================================================

$dc = $null

# Method 1: Try to get DC from DNS
try {
    $dc = ([System.Net.Dns]::GetHostEntry($domain)).HostName
    Write-Host "Found DC via DNS: $dc" -ForegroundColor Green
}
catch { }

# Method 2: Use nltest
if (-not $dc) {
    try {
        $nltest = nltest /dclist:$domain 2>$null
        if ($nltest -match "([A-Za-z0-9\-\.]+\.$domain)") {
            $dc = $matches[1]
            Write-Host "Found DC via nltest: $dc" -ForegroundColor Green
        }
    }
    catch { }
}

# Method 3: Use Get-ADDomainController with proper conversion
if (-not $dc) {
    try {
        Import-Module ActiveDirectory -ErrorAction Stop
        $dcObject = Get-ADDomainController -Discover -ErrorAction Stop
        $dc = $dcObject.HostName[0].ToString()
        Write-Host "Found DC via AD: $dc" -ForegroundColor Green
    }
    catch { }
}

# Method 4: Use environment
if (-not $dc) {
    try {
        $dc = $env:LOGONSERVER.Trim('\')
        Write-Host "Found DC via LOGONSERVER: $dc" -ForegroundColor Green
    }
    catch { }
}

# Method 5: Manual fallback
if (-not $dc) {
    $dc = "Server1.HR.local"  # Your DC from output
    Write-Host "Using specified DC: $dc" -ForegroundColor Yellow
}

# Ensure $dc is a clean string
$dc = $dc.ToString().Trim()
Write-Host "Final DC: $dc" -ForegroundColor Green

#===========================================================
# 3. CHECK AD MODULE
#===========================================================

Write-Host "`nLoading AD Module..." -ForegroundColor Cyan

if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) {
    Write-Host "ERROR: ActiveDirectory module not installed!" -ForegroundColor Red
    Write-Host "Install RSAT tools first." -ForegroundColor Yellow
    exit 1
}

Import-Module ActiveDirectory -Force -ErrorAction Stop
Write-Host "AD Module loaded successfully" -ForegroundColor Green

#===========================================================
# 4. TEST CONNECTION
#===========================================================

Write-Host "`nTesting connection to $dc..." -ForegroundColor Cyan

try {
    Test-Connection $dc -Count 1 -ErrorAction Stop | Out-Null
    Write-Host "Server $dc is reachable" -ForegroundColor Green
}
catch {
    Write-Host "WARNING: Cannot ping $dc, but will try AD connection" -ForegroundColor Yellow
}

#===========================================================
# 5. CREATE OUTPUT DIRECTORY
#===========================================================

$reportPath = "C:\AD_Reports_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
New-Item -ItemType Directory -Path $reportPath -Force | Out-Null
Write-Host "`nReports saved to: $reportPath" -ForegroundColor Green

#===========================================================
# 6. COLLECTION FUNCTIONS - FIXED
#===========================================================

# USERS
Write-Host "`n=== Starting Data Collection ===" -ForegroundColor Cyan

try {
    Write-Host "  Exporting Users..." -ForegroundColor Gray
    $users = Get-ADUser -Server $dc -Filter * -Properties * -ErrorAction Stop
    $users | Select-Object Enabled, CanonicalName, CN, Name, SamAccountName, 
        @{N='MemberOf';E={($_.MemberOf -join '; ')}},
        Company, Title, Description, Created, Modified, PasswordLastSet,
        LastLogonDate, logonCount, Department, telephoneNumber, MobilePhone,
        OfficePhone, EmailAddress, mail, HomeDirectory, homeMDB, UserPrincipalName |
        Export-Csv -Path "$reportPath\AD_Users.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($users.Count) users exported" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# COMPUTERS
try {
    Write-Host "  Exporting Computers..." -ForegroundColor Gray
    $computers = Get-ADComputer -Server $dc -Filter * -Properties * -ErrorAction Stop
    $computers | Select-Object Enabled, Name, DNSHostName, IPv4Address,
        OperatingSystem, Description, CanonicalName,
        @{N='servicePrincipalName';E={($_.servicePrincipalName -join '; ')}},
        LastLogonDate, whenChanged, whenCreated |
        Export-Csv -Path "$reportPath\AD_Computers.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($computers.Count) computers exported" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# GROUPS
try {
    Write-Host "  Exporting Groups..." -ForegroundColor Gray
    $groups = Get-ADGroup -Server $dc -Filter * -Properties * -ErrorAction Stop
    $groups | Select-Object Name, SamAccountName, GroupCategory, GroupScope,
        Description, DistinguishedName,
        @{N='Members';E={($_.Member -join '; ')}},
        @{N='MemberOf';E={($_.MemberOf -join '; ')}} |
        Export-Csv -Path "$reportPath\AD_Groups.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($groups.Count) groups exported" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# OUs
try {
    Write-Host "  Exporting OUs..." -ForegroundColor Gray
    $ous = Get-ADOrganizationalUnit -Server $dc -Filter * -Properties * -ErrorAction Stop
    $ous | Select-Object CanonicalName, City, CN, Country, Description, DistinguishedName, Name |
        Export-Csv -Path "$reportPath\AD_OUs.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($ous.Count) OUs exported" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# SUBNETS
try {
    Write-Host "  Exporting Subnets..." -ForegroundColor Gray
    $subnets = Get-ADReplicationSubnet -Server $dc -Filter * -Properties * -ErrorAction Stop
    $subnets | Export-Csv -Path "$reportPath\AD_Subnets.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($subnets.Count) subnets exported" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# TRUSTS
try {
    Write-Host "  Exporting Trusts..." -ForegroundColor Gray
    $trusts = Get-ADTrust -Server $dc -Filter * -ErrorAction Stop
    $trusts | Export-Csv -Path "$reportPath\AD_Trusts.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($trusts.Count) trusts exported" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# USERS WITH EMAIL
try {
    Write-Host "  Exporting Users with Email..." -ForegroundColor Gray
    $usersWithEmail = Get-ADUser -Server $dc -Filter * -Properties EmailAddress -ErrorAction Stop | 
        Where-Object { $_.EmailAddress }
    $usersWithEmail | Select-Object Name, EmailAddress |
        Export-Csv -Path "$reportPath\AD_Users_With_Email.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK: $($usersWithEmail.Count) users with email" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# DOMAIN INFO
try {
    Write-Host "  Exporting Domain Info..." -ForegroundColor Gray
    $domainInfo = [PSCustomObject]@{
        DomainName = $domain
        DomainController = $dc
        ComputerName = $env:COMPUTERNAME
        UserName = $env:USERNAME
        DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        ScriptVersion = "3.0"
    }
    $domainInfo | Export-Csv -Path "$reportPath\Domain_Info.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

# DNS SUBNETS
try {
    Write-Host "  Exporting DNS Subnets..." -ForegroundColor Gray
    $zone = $domain
    $dnsServer = $dc
    
    $records = Get-DnsServerResourceRecord -ComputerName $dnsServer -ZoneName $zone -RRType "A" -ErrorAction SilentlyContinue
    
    if ($records) {
        $dnsSubnets = $records |
            ForEach-Object {
                $ip = $_.RecordData.IPv4Address.IPAddressToString
                if ($ip) {
                    $octets = $ip.Split('.')
                    "{0}.{1}.{2}.0/24" -f $octets[0], $octets[1], $octets[2]
                }
            } | Sort-Object -Unique
        
        $dnsSubnets | Out-File -FilePath "$reportPath\DNS_Subnets.txt" -Encoding UTF8
        Write-Host "    OK: $($dnsSubnets.Count) unique subnets" -ForegroundColor Green
    } else {
        Write-Host "    WARNING: No DNS records found" -ForegroundColor Yellow
    }
}
catch {
    Write-Host "    WARNING: DNS export: $_" -ForegroundColor Yellow
}

# USERS LIST (SIMPLE)
try {
    Write-Host "  Exporting Simple User List..." -ForegroundColor Gray
    Get-ADUser -Server $dc -Filter * -Properties EmailAddress | 
        Where-Object { $_.EmailAddress } | 
        Select-Object Name, EmailAddress |
        Export-Csv -Path "$reportPath\AD_Simple_Users.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "    OK" -ForegroundColor Green
}
catch {
    Write-Host "    FAILED: $_" -ForegroundColor Red
}

#===========================================================
# 7. CREATE HTML REPORT
#===========================================================

Write-Host "`nCreating HTML Report..." -ForegroundColor Cyan

$htmlReport = @"
<!DOCTYPE html>
<html>
<head>
    <title>AD Inventory Report - $(Get-Date -Format 'yyyy-MM-dd HH:mm')</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; background-color: #f0f0f0; }
        h1 { color: #2c3e50; border-bottom: 3px solid #3498db; padding-bottom: 10px; }
        h2 { color: #34495e; margin-top: 30px; }
        .summary { background-color: #ecf0f1; padding: 15px; border-radius: 5px; margin: 20px 0; }
        .footer { margin-top: 30px; font-size: 12px; color: #7f8c8d; text-align: center; }
    </style>
</head>
<body>
    <h1>Active Directory Inventory Report</h1>
    <div class="summary">
        <p><strong>Domain:</strong> $domain</p>
        <p><strong>Domain Controller:</strong> $dc</p>
        <p><strong>Generated:</strong> $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')</p>
        <p><strong>Computer:</strong> $env:COMPUTERNAME</p>
        <p><strong>User:</strong> $env:USERNAME</p>
    </div>
    
    <h2>Export Summary</h2>
    <div class="summary">
"@

Get-ChildItem $reportPath -Filter "*.csv" | ForEach-Object {
    $fileSize = "{0:N2}" -f ($_.Length / 1KB)
    $htmlReport += "<p>[$($_.Name)] - $fileSize KB</p>`n"
}

$htmlReport += @"
    </div>
    <div class="footer">
        <p>Generated by AD Inventory Script v3.0</p>
        <p>Total files: $(@(Get-ChildItem $reportPath).Count)</p>
    </div>
</body>
</html>
"@

$htmlReport | Out-File -FilePath "$reportPath\AD_Report.html" -Encoding UTF8
Write-Host "HTML Report created" -ForegroundColor Green

#===========================================================
# 8. CREATE ZIP ARCHIVE
#===========================================================

Write-Host "`nCreating ZIP archive..." -ForegroundColor Cyan

$zipFile = "$reportPath.zip"
Compress-Archive -Path "$reportPath\*" -DestinationPath $zipFile -Force
Write-Host "Archive created: $zipFile" -ForegroundColor Green

#===========================================================
# 9. FINAL SUMMARY
#===========================================================

Write-Host "`n" + ("=" * 60) -ForegroundColor Cyan
Write-Host "=== COLLECTION COMPLETED ===" -ForegroundColor Green
Write-Host ("=" * 60) -ForegroundColor Cyan
Write-Host ""
Write-Host "Reports saved to:" -ForegroundColor Yellow
Write-Host "  FOLDER: $reportPath" -ForegroundColor White
Write-Host "  ARCHIVE: $zipFile" -ForegroundColor White
Write-Host "  HTML: $reportPath\AD_Report.html" -ForegroundColor White
Write-Host ""
Write-Host "Total files: $(@(Get-ChildItem $reportPath).Count)" -ForegroundColor Green
Write-Host ""

Invoke-Item $reportPath

Write-Host "Script completed successfully!" -ForegroundColor Green