# Invoke-SessionHunter | Retrieve And Display Information About Active User Sessions On Remote Computers **URL:** \ **Category:** Tools & Scripts\ **Tags:** learning, tools, hacking\ **Created:** [May 17, 2024, 7:34pm UTC](https://onehack.st/t/invoke-sessionhunter-retrieve-and-display-information-about-active-user-sessions-on-remote-computers/282963 "2024-05-17T19:34:03Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [May 17, 2024, 7:34pm UTC](https://onehack.st/t/invoke-sessionhunter-retrieve-and-display-information-about-active-user-sessions-on-remote-computers/282963/1 "2024-05-17T19:34:03Z")
![image](https://onehack.st/uploads/default/original/3X/2/2/22a7515f7b29e1cea4b25bca12e5af43cc4134d3.jpeg) # Invoke-SessionHunter Retrieve and display information about active user sessions on remote computers. No admin privileges required. The tool leverages the remote registry service to query the HKEY\_USERS registry hive on the remote computers. It identifies and extracts Security Identifiers (SIDs) associated with active user sessions, and translates these into corresponding usernames, offering insights into who is currently logged in. If the `-CheckAdminAccess` switch is provided, it will gather sessions by authenticating to targets where you have local admin access using [Invoke-WMIRemoting](https://github.com/Leo4j/Invoke-WMIRemoting) (which most likely will retrieve more results) It’s important to note that the remote registry service needs to be running on the remote computer for the tool to work effectively. In my tests, if the service is stopped but its Startup type is configured to “Automatic” or “Manual”, the service will start automatically on the target computer once queried (this is native behavior), and sessions information will be retrieved. If set to “Disabled” no session information can be retrieved from the target. ### Usage: ```auto iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/Leo4j/Invoke-SessionHunter/main/Invoke-SessionHunter.ps1') ``` If run without parameters or switches it will retrieve active sessions for all computers in the current domain by querying the registry ```auto Invoke-SessionHunter ``` Gather sessions by authenticating to targets where you have local admin access ```auto Invoke-SessionHunter -CheckAsAdmin ``` You can optionally provide credentials in the following format ```auto Invoke-SessionHunter -CheckAsAdmin -UserName "ferrari\Administrator" -Password "P@ssw0rd!" ``` You can also use the -FailSafe switch, which will direct the tool to proceed if the target remote registry becomes unresponsive. This works in cobination with -Timeout | Default = 2, increase for slower networks. ```auto Invoke-SessionHunter -FailSafe ``` ```auto Invoke-SessionHunter -FailSafe -Timeout 5 ``` Use the -Match switch to show only targets where you have admin access and a privileged user is logged in ```auto Invoke-SessionHunter -Match ``` All switches can be combined ```auto Invoke-SessionHunter -CheckAsAdmin -UserName "ferrari\Administrator" -Password "P@ssw0rd!" -FailSafe -Timeout 5 -Match ``` [![image](https://private-user-images.githubusercontent.com/61951374/273204333-0505d8d7-231a-4e3e-b157-58900e7bba85.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTU5NzM3OTIsIm5iZiI6MTcxNTk3MzQ5MiwicGF0aCI6Ii82MTk1MTM3NC8yNzMyMDQzMzMtMDUwNWQ4ZDctMjMxYS00ZTNlLWIxNTctNTg5MDBlN2JiYTg1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA1MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNTE3VDE5MTgxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE5MTMwMTAyMGEzYTllMjE2ZGYxOGE4NThjYWYwNzgzMThjNzUxZmUyYzc3MmYzMjQ3ODc2NTlkZjMwZGYxZGImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.HwgQIoRSu3Ye6jQVXiX6Sgw4cvn8lTdDPhjRUTBauzs)](https://private-user-images.githubusercontent.com/61951374/273204333-0505d8d7-231a-4e3e-b157-58900e7bba85.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTU5NzM3OTIsIm5iZiI6MTcxNTk3MzQ5MiwicGF0aCI6Ii82MTk1MTM3NC8yNzMyMDQzMzMtMDUwNWQ4ZDctMjMxYS00ZTNlLWIxNTctNTg5MDBlN2JiYTg1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA1MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNTE3VDE5MTgxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE5MTMwMTAyMGEzYTllMjE2ZGYxOGE4NThjYWYwNzgzMThjNzUxZmUyYzc3MmYzMjQ3ODc2NTlkZjMwZGYxZGImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.HwgQIoRSu3Ye6jQVXiX6Sgw4cvn8lTdDPhjRUTBauzs) ### Specify the target domain ```auto Invoke-SessionHunter -Domain contoso.local ``` ### Specify a comma-separated list of targets or the full path to a file containing a list of targets - one per line ```auto Invoke-SessionHunter -Targets "DC01,Workstation01.contoso.local" ``` ```auto Invoke-SessionHunter -Targets c:\Users\Public\Documents\targets.txt ``` ### Retrieve and display information about active user sessions on servers only ```auto Invoke-SessionHunter -Servers ``` ### Retrieve and display information about active user sessions on workstations only ```auto Invoke-SessionHunter -Workstations ``` ### Show active session for the specified user only ```auto Invoke-SessionHunter -Hunt "Administrator" ``` ### Exclude localhost from the sessions retrieval ```auto Invoke-SessionHunter -IncludeLocalHost ``` ### Return custom PSObjects instead of table-formatted results ```auto Invoke-SessionHunter -RawResults ``` ### Do not run a port scan to enumerate for alive hosts before trying to retrieve sessions Note: if a host is not reachable it will hang for a while ```auto Invoke-SessionHunter -NoPortScan ``` ## GitHub: > **[GitHub - Leo4j/Invoke-SessionHunter: Retrieve and display information about active user...](https://github.com/Leo4j/Invoke-SessionHunter)** > > Retrieve and display information about active user sessions on remote computers. No admin privileges required.