Skip to content

Instantly share code, notes, and snippets.

@Evilcry

Evilcry/findautoelevate.ps1

Created July 8, 2018 07:40
Show Gist options
  • Star 20 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save Evilcry/71e03a969689b8fd1297a1803aa4d7cf to your computer and use it in GitHub Desktop.
Save Evilcry/71e03a969689b8fd1297a1803aa4d7cf to your computer and use it in GitHub Desktop.
Download ZIP
Enumerate executables with auto-elevation enabled
Raw
findautoelevate.ps1
# Find Autoelevate executables
Write-Host "System32 Autoelevate Executables" -ForegroundColor Green -BackgroundColor Black
Select-String -Path C:\Windows\System32\*.exe -pattern "<AutoElevate>true"
Write-Host "`nSysWOW64 Autoelevate Executables" -ForegroundColor Green -BackgroundColor Black
Select-String -Path C:\Windows\SysWOW64\*.exe -pattern "<AutoElevate>true"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment