hacktricks/windows-hardening/windows-local-privilege-esc.../powerup.md

4.7 KiB

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}


Invoke

powershell -ep bypass
. .\powerup.ps
Invoke-AllChecks

Checks

03/2019

  • Current privileges
  • Unquoted service paths
  • Service executable permissions
  • Service permissions
  • %PATH% for hijackable DLL locations
  • AlwaysInstallElevated registry key
  • Autologon credentials in registry
  • Modifidable registry autoruns and configs
  • Modifiable schtask files/configs
  • Unattended install files
  • Encrypted web.config strings
  • Encrypted application pool and virtual directory passwords
  • Plaintext passwords in McAfee SiteList.xml
  • Cached Group Policy Preferences .xml files

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥