hacktricks/windows-hardening/windows-local-privilege-escalation/powerup.md
carlospolop 9e5102b4c0 social
2023-03-06 00:15:43 +01:00

3.6 KiB

HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥

Invoke

powershell -ep bypass
. .\powerup.ps
Invoke-AllChecks

Checks

03/2019

  • Current privileges
  • Unquoted service paths
  • Service executable permissions
  • Service permissions
  • %PATH% for hijackable DLL locations
  • AlwaysInstallElevated registry key
  • Autologon credentials in registry
  • Modifidable registry autoruns and configs
  • Modifiable schtask files/configs
  • Unattended install files
  • Encrypted web.config strings
  • Encrypted application pool and virtual directory passwords
  • Plaintext passwords in McAfee SiteList.xml
  • Cached Group Policy Preferences .xml files
HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥