PowerShellMafia/PowerSploit

Invoke-UserHunter does not work

Opened this issue · 2 comments

mortymorty commented

I have tested it on Windows Server 2016 with Windows 7 clients. It does not show anything.
I have also tested it on Windows Server 2012 with a single DC and one win7 client. also didn't work.

I used BloodHound and It successfully found connections to hosts whereas Invoke-UserHunter failed. I've also used -ShowAll flag but no difference.

BloodHound output (user_sessions.csv) :
"WIN7PC2.lab.local","ADMINISTRATOR@LAB.LOCAL","1"

Invoke-UserHunter result is empty.
Also all firewalls on DC and clients are turned off.

Please inform me if any other info is needed.

Thanks

DanMcInerney commented

I too am having this issue. I've tested Invoke-UserHunter in many different environments but I get blank output even with -ShowAll and -Verbose. All AV turned off, firewalls off, etc.

DanMcInerney commented

As an update, Invoke-UserHunter from Empire does work. PowerSploit version does not.