VOYEUR's main purpose is to automate several tasks of an Active Directory build review or security assessment. Also, the tool is able to create a fast (and pretty) Active Directory report. The tool is developed entirely in PowerShell (a powerful scripting language) without dependencies like Microsoft Remote Administration tools. (Just .Net Framework 2.0 and Office Excel if you want a useful and pretty report). The generated report is a perfect starting point for well-established forensic, incident response team, security consultants or security researchers who want to quickly analyze threats in Active Directory Services.
- Return a huge number of attributes on computers, users, containers/OUs, groups, ACL, etc...
- Search for locked accounts, expired password, no password policy, etc...
- Return a list of all privileged account in domain. (The script search in SID value instead in a group name)
- Return a list of group’s modification (Users added/deleted for a specific group, etc...)
- Multi-Threading support
- Plugin Support
VOYEUR can be used in two ways scenarios:
- Able for using on local or remote computer
- Able for using on joined machine or workgroup machine
Support for exporting data driven to several formats like CSV, XML or JSON (Experimental).
The following screenshot shows an example report in JSON format
Support for exporting data driven to EXCEL format. The tool also support table style modification, chart creation, company logo or independent language support. At the moment only Office Excel 2010 and Office Excel 2013 are supported by the tool.
An example of report generated by Voyeur can be downloaded from Voyeur_Report_20160609.xlsx
Voyeur works out of the box with PowerShell version 2.x. You can check your Windows PowerShell version executing the command $PsVersionTable:
PS C:\Users\silverhack> $psversiontable
Name Value
---- -----
CLRVersion 2.0.50727.5420
BuildVersion 6.1.7601.17514
PSVersion 2.0
WSManStackVersion 2.0
PSCompatibleVersions {1.0, 2.0}
SerializationVersion 1.1.0.1
PSRemotingProtocolVersion 2.1
You can download the latest zip by clicking [https://github.com/silverhack/voyeur/archive/master.zip here].
Preferably, you can download voyeur by cloning the [https://github.com/silverhack/voyeur] repository:
git clone https://github.com/silverhack/voyeur
To get a list of basic options and switches use:
get-help .\voyeur.ps1
To get a list of examples use:
get-help .\voyeur.ps1 -Examples
To get a list of all options and examples with detailed info use:
get-help .\voyeur.ps1 -Detailed
This example retrieve information of an Active Directory for a specific domain. Also, retrieve Organizational Unit information and ACL values. Next, export all data driven to JSON format.
.\voyeur.ps1 -Domain "test.example.local" -ExportACL -ExportOU -ExportTo JSON
This example retrieve information of an Active Directory for a specific domain with explicit credentials and export results to CSV format.
.\voyeur.ps1 -Domain "test.example.local" -AlternateCredential -ExportTo CSV
This example retrieve information of an Active Directory for a specific domain and for specific Organizational Unit (OU). Also, retrieve Organizational Unit information and ACL values. Next, export all data driven to all supported formats
.\voyeur.ps1 -Domain "test.example.local" -SearchRoot "OU=Domain,DC=test,DC=example,DC=local" -ExportACL -ExportOU -ExportTo XML,JSON,CSV,EXCEL