Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 5228976

Browse files
hackjammerhackjammer
committed
Default Invoke-PrivEscAudit to return objects for parsing
1 parent f9b95c5 commit 5228976

File tree

1 file changed

+102
-149
lines changed

1 file changed

+102
-149
lines changed

‎Privesc/PowerUp.ps1

Lines changed: 102 additions & 149 deletions
Original file line numberDiff line numberDiff line change
@@ -4670,9 +4670,14 @@ Required Dependencies: None
46704670

46714671
Executes all functions that check for various Windows privilege escalation opportunities.
46724672

4673+
.PARAMETER Format
4674+
4675+
String. Format to decide on what is returned from the command, an Object Array, List, or HTML Report.
4676+
46734677
.PARAMETER HTMLReport
46744678

4675-
Switch. Write a HTML version of the report to SYSTEM.username.html.
4679+
DEPRECATED - Switch. Write a HTML version of the report to SYSTEM.username.html.
4680+
Superseded by the Format parameter.
46764681

46774682
.EXAMPLE
46784683

@@ -4682,25 +4687,26 @@ Runs all escalation checks and outputs a status report for discovered issues.
46824687

46834688
.EXAMPLE
46844689

4685-
Invoke-PrivescAudit -HTMLReport
4690+
Invoke-PrivescAudit -Format HTML
46864691

46874692
Runs all escalation checks and outputs a status report to SYSTEM.username.html
46884693
detailing any discovered issues.
46894694

4690-
.OUTPUTS
4691-
4692-
System.String
46934695
#>
46944696

46954697
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
4696-
[OutputType('System.String')]
46974698
[CmdletBinding()]
46984699
Param(
4700+
[ValidateSet('Object','List','HTML')]
4701+
[String]
4702+
$Format = 'Object',
46994703
[Switch]
47004704
$HTMLReport
47014705
)
47024706

4703-
if ($HTMLReport) {
4707+
if($HTMLReport){ $Format = 'HTML' }
4708+
4709+
if ($Format -eq 'HTML') {
47044710
$HtmlReportFile = "$($Env:ComputerName).$($Env:UserName).html"
47054711
$Header = "<style>"
47064712
$Header = $Header + "BODY{background-color:peachpuff;}"
@@ -4711,153 +4717,101 @@ System.String
47114717
ConvertTo-HTML -Head $Header -Body "<H1>PowerUp report for '$($Env:ComputerName).$($Env:UserName)'</H1>" | Out-File $HtmlReportFile
47124718
}
47134719

4714-
# initial admin checks
4715-
4716-
"`n[*] Running Invoke-AllChecks"
4717-
4718-
$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
4719-
4720-
if ($IsAdmin){
4721-
"[+] Current user already has local administrative privileges!"
4722-
4723-
if ($HTMLReport) {
4724-
ConvertTo-HTML -Head $Header -Body "<H2>User Has Local Admin Privileges!</H2>" | Out-File -Append $HtmlReportFile
4720+
Write-Verbose "Running Invoke-PrivescAudit"
4721+
4722+
$Checks = @(
4723+
# Initial admin checks
4724+
@{
4725+
Type = 'User Has Local Admin Privileges'
4726+
Command = { if (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")){ New-Object PSObject } }
4727+
},
4728+
@{
4729+
Type = 'User In Local Group with Admin Privileges'
4730+
Command = { if ((Get-ProcessTokenGroup | Select-Object -ExpandProperty SID) -contains 'S-1-5-32-544'){ New-Object PSObject } }
4731+
AbuseScript = { 'Invoke-WScriptUACBypass -Command "..."' }
4732+
},
4733+
@{
4734+
Type = 'Process Token Privileges'
4735+
Command = { Get-ProcessTokenPrivilege -Special | Where-Object {$_} }
4736+
},
4737+
# Service checks
4738+
@{
4739+
Type = 'Unquoted Service Paths'
4740+
Command = { Get-UnquotedService }
4741+
},
4742+
@{
4743+
Type = 'Modifiable Service Files'
4744+
Command = { Get-ModifiableServiceFile }
4745+
},
4746+
@{
4747+
Type = 'Modifiable Services'
4748+
Command = { Get-ModifiableService }
4749+
},
4750+
# DLL hijacking
4751+
@{
4752+
Type = '%PATH% .dll Hijacks'
4753+
Command = { Find-PathDLLHijack }
4754+
AbuseScript = { "Write-HijackDll -DllPath '$($_.ModifiablePath)\wlbsctrl.dll'" }
4755+
},
4756+
# Registry checks
4757+
@{
4758+
Type = 'AlwaysInstallElevated Registry Key'
4759+
Command = { if (Get-RegistryAlwaysInstallElevated){ New-Object PSObject } }
4760+
AbuseScript = { 'Write-UserAddMSI' }
4761+
},
4762+
@{
4763+
Type = 'Registry Autologons'
4764+
Command = { Get-RegistryAutoLogon }
4765+
},
4766+
@{
4767+
Type = 'Modifiable Registry Autorun'
4768+
Command = { Get-ModifiableRegistryAutoRun }
4769+
},
4770+
# Other checks
4771+
@{
4772+
Type = 'Modifiable Scheduled Task Files'
4773+
Command = { Get-ModifiableScheduledTaskFile }
4774+
},
4775+
@{
4776+
Type = 'Unattended Install Files'
4777+
Command = { Get-UnattendedInstallFile }
4778+
},
4779+
@{
4780+
Type = 'Encrypted web.config Strings'
4781+
Command = { Get-WebConfig | Where-Object {$_} }
4782+
},
4783+
@{
4784+
Type = 'Encrypted Application Pool Passwords'
4785+
Command = { Get-ApplicationHost | Where-Object {$_} }
4786+
},
4787+
@{
4788+
Type = 'McAfee SiteList.xml files'
4789+
Command = { Get-SiteListPassword | Where-Object {$_} }
4790+
},
4791+
@{
4792+
Type = 'Cached GPP Files'
4793+
Command = { Get-CachedGPPPassword | Where-Object {$_} }
47254794
}
4726-
}
4727-
else{
4728-
"`n`n[*] Checking if user is in a local group with administrative privileges..."
4729-
4730-
$CurrentUserSids = Get-ProcessTokenGroup | Select-Object -ExpandProperty SID
4731-
if ($CurrentUserSids -Contains 'S-1-5-32-544') {
4732-
"[+] User is in a local group that grants administrative privileges!"
4733-
"[+] Run 'Invoke-WScriptUACBypass -Command `"...`"' to elevate privileges to admin."
4734-
if ($HTMLReport) {
4735-
ConvertTo-HTML -Head $Header -Body "<H2> User In Local Group With Administrative Privileges</H2>" | Out-File -Append $HtmlReportFile
4795+
)
4796+
4797+
ForEach($Check in $Checks){
4798+
Write-Verbose "Checking for $($Check.Type)..."
4799+
$Results = . $Check.Command
4800+
$Results | Where-Object {$_} | ForEach-Object {
4801+
$_ | Add-Member Noteproperty 'Check' $Check.Type
4802+
if ($Check.AbuseScript){
4803+
$_ | Add-Member Noteproperty 'AbuseFunction' (. $Check.AbuseScript)
47364804
}
47374805
}
4738-
}
4739-
4740-
"`n`n[*] Checking current process token permissions..."
4741-
$Results = Get-ProcessTokenPrivilege -Special | Where-Object {$_}
4742-
$Results | Format-List
4743-
if ($HTMLReport) {
4744-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Cached GPP Files</H2>" | Out-File -Append $HtmlReportFile
4745-
}
4746-
4747-
# Service checks
4748-
4749-
"`n`n[*] Checking for unquoted service paths..."
4750-
$Results = Get-UnquotedService
4751-
$Results | Format-List
4752-
if ($HTMLReport) {
4753-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Unquoted Service Paths</H2>" | Out-File -Append $HtmlReportFile
4754-
}
4755-
4756-
"`n`n[*] Checking service executable and argument permissions..."
4757-
$Results = Get-ModifiableServiceFile
4758-
$Results | Format-List
4759-
if ($HTMLReport) {
4760-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Service File Permissions</H2>" | Out-File -Append $HtmlReportFile
4761-
}
4762-
4763-
"`n`n[*] Checking service permissions..."
4764-
$Results = Get-ModifiableService
4765-
$Results | Format-List
4766-
if ($HTMLReport) {
4767-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Modifiable Services</H2>" | Out-File -Append $HtmlReportFile
4768-
}
4769-
4770-
4771-
# DLL hijacking
4772-
4773-
"`n`n[*] Checking %PATH% for potentially hijackable DLL locations..."
4774-
$Results = Find-PathDLLHijack
4775-
$Results | Where-Object {$_} | Foreach-Object {
4776-
$AbuseString = "Write-HijackDll -DllPath '$($_.ModifiablePath)\wlbsctrl.dll'"
4777-
$_ | Add-Member Noteproperty 'AbuseFunction' $AbuseString
4778-
$_
4779-
} | Format-List
4780-
if ($HTMLReport) {
4781-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>%PATH% .dll Hijacks</H2>" | Out-File -Append $HtmlReportFile
4782-
}
4783-
4784-
4785-
# registry checks
4786-
4787-
"`n`n[*] Checking for AlwaysInstallElevated registry key..."
4788-
if (Get-RegistryAlwaysInstallElevated) {
4789-
$Out = New-Object PSObject
4790-
$Out | Add-Member Noteproperty 'AbuseFunction' "Write-UserAddMSI"
4791-
$Results = $Out
4792-
4793-
$Results | Format-List
4794-
if ($HTMLReport) {
4795-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>AlwaysInstallElevated</H2>" | Out-File -Append $HtmlReportFile
4806+
switch($Format){
4807+
Object { $Results }
4808+
List { "`n`n[*] Checking for $($Check.Type)..."; $Results | Format-List }
4809+
HTML { $Results | ConvertTo-HTML -Head $Header -Body "<H2>$($Check.Type)</H2>" | Out-File -Append $HtmlReportFile }
47964810
}
47974811
}
47984812

4799-
"`n`n[*] Checking for Autologon credentials in registry..."
4800-
$Results = Get-RegistryAutoLogon
4801-
$Results | Format-List
4802-
if ($HTMLReport) {
4803-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Registry Autologons</H2>" | Out-File -Append $HtmlReportFile
4804-
}
4805-
4806-
4807-
"`n`n[*] Checking for modifidable registry autoruns and configs..."
4808-
$Results = Get-ModifiableRegistryAutoRun
4809-
$Results | Format-List
4810-
if ($HTMLReport) {
4811-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Registry Autoruns</H2>" | Out-File -Append $HtmlReportFile
4812-
}
4813-
4814-
# other checks
4815-
4816-
"`n`n[*] Checking for modifiable schtask files/configs..."
4817-
$Results = Get-ModifiableScheduledTaskFile
4818-
$Results | Format-List
4819-
if ($HTMLReport) {
4820-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Modifidable Schask Files</H2>" | Out-File -Append $HtmlReportFile
4821-
}
4822-
4823-
"`n`n[*] Checking for unattended install files..."
4824-
$Results = Get-UnattendedInstallFile
4825-
$Results | Format-List
4826-
if ($HTMLReport) {
4827-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Unattended Install Files</H2>" | Out-File -Append $HtmlReportFile
4828-
}
4829-
4830-
"`n`n[*] Checking for encrypted web.config strings..."
4831-
$Results = Get-Webconfig | Where-Object {$_}
4832-
$Results | Format-List
4833-
if ($HTMLReport) {
4834-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Encrypted 'web.config' String</H2>" | Out-File -Append $HtmlReportFile
4835-
}
4836-
4837-
"`n`n[*] Checking for encrypted application pool and virtual directory passwords..."
4838-
$Results = Get-ApplicationHost | Where-Object {$_}
4839-
$Results | Format-List
4840-
if ($HTMLReport) {
4841-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Encrypted Application Pool Passwords</H2>" | Out-File -Append $HtmlReportFile
4842-
}
4843-
4844-
"`n`n[*] Checking for plaintext passwords in McAfee SiteList.xml files..."
4845-
$Results = Get-SiteListPassword | Where-Object {$_}
4846-
$Results | Format-List
4847-
if ($HTMLReport) {
4848-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>McAfee's SiteList.xml's</H2>" | Out-File -Append $HtmlReportFile
4849-
}
4850-
4851-
"`n`n[*] Checking for cached Group Policy Preferences .xml files..."
4852-
$Results = Get-CachedGPPPassword | Where-Object {$_}
4853-
$Results | Format-List
4854-
if ($HTMLReport) {
4855-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Cached GPP Files</H2>" | Out-File -Append $HtmlReportFile
4856-
}
4857-
"`n"
4858-
4859-
if ($HTMLReport) {
4860-
"[*] Report written to '$HtmlReportFile' `n"
4813+
if ($Format -eq 'HTML') {
4814+
Write-Verbose "[*] Report written to '$HtmlReportFile' `n"
48614815
}
48624816
}
48634817

@@ -5012,5 +4966,4 @@ $Kernel32 = $Types['kernel32']
50124966
$NTDll = $Types['ntdll']
50134967

50144968
Set-Alias Get-CurrentUserTokenGroupSid Get-ProcessTokenGroup
5015-
Set-Alias Get-UnquotedService Get-UnquotedService
50164969
Set-Alias Invoke-AllChecks Invoke-PrivescAudit

0 commit comments

Comments
 (0)