> For the complete documentation index, see [llms.txt](https://xerosec.gitbook.io/untitled/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://xerosec.gitbook.io/untitled/apuntes-y-recursos-oscp/windows/enumeracion-post-explotacion.md).

# Enumeración Post-Explotación

### PowerView

```bash
#Desactivar Execution Policy
powershell -ep bypass
./PowerView.ps1
```

<https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993>

### Bloodhound

```bash
#Iniciar la base de datos
sudo neo4j console
#Iniciar Bloodhound
bloodhound
```

#### Extracción de datos del dominio

```bash
#Con bloodhound-python
bloodhound-python -u <USER> -p <PASSWORD> -d <DOMINIO>.LOCAL -ns <IP> -c All
#Con SharpHound (desde PowerShell)
#Desactivar Execution Policy
powershell -ep bypass
#Cargar el script
. .\SharpHound.ps1
#Ejecutar la función
Invoke-BloodHound -CollectionMethod All -Domain <DOMINIO>.LOCAL -ZipFileName file.zip
```