Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 7964823

Browse files
HarmJ0yHarmJ0y
committed
Added documentation for PowerUp
1 parent 5da1774 commit 7964823

37 files changed

+3067
-126
lines changed

‎Privesc/PowerUp.ps1

Lines changed: 96 additions & 94 deletions
Large diffs are not rendered by default.

‎Privesc/Privesc.psd1

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -23,37 +23,36 @@ PowerShellVersion = '2.0'
2323

2424
# Functions to export from this module
2525
FunctionsToExport = @(
26-
'Add-ServiceDacl',
27-
'Enable-Privilege',
28-
'Find-PathDLLHijack',
29-
'Find-ProcessDLLHijack',
30-
'Get-ApplicationHost',
31-
'Get-CachedGPPPassword',
3226
'Get-ModifiablePath',
33-
'Get-ModifiableRegistryAutoRun',
34-
'Get-ModifiableScheduledTaskFile',
35-
'Get-ModifiableService',
36-
'Get-ModifiableServiceFile',
3727
'Get-ProcessTokenGroup',
3828
'Get-ProcessTokenPrivilege',
29+
'Enable-Privilege',
30+
'Add-ServiceDacl',
31+
'Set-ServiceBinaryPath',
32+
'Test-ServiceDaclPermission',
33+
'Get-UnquotedService',
34+
'Get-ModifiableServiceFile',
35+
'Get-ModifiableService',
36+
'Get-ServiceDetail',
37+
'Invoke-ServiceAbuse',
38+
'Write-ServiceBinary',
39+
'Install-ServiceBinary',
40+
'Restore-ServiceBinary',
41+
'Find-ProcessDLLHijack',
42+
'Find-PathDLLHijack',
43+
'Write-HijackDll',
3944
'Get-RegistryAlwaysInstallElevated',
4045
'Get-RegistryAutoLogon',
41-
'Get-ServiceDetail',
42-
'Get-SiteListPassword',
43-
'Get-TokenInformation',
44-
'Get-UnquotedService',
46+
'Get-ModifiableRegistryAutoRun',
47+
'Get-ModifiableScheduledTaskFile',
4548
'Get-UnattendedInstallFile',
4649
'Get-WebConfig',
47-
'Install-ServiceBinary',
48-
'Invoke-ServiceAbuse',
50+
'Get-ApplicationHost',
51+
'Get-SiteListPassword',
52+
'Get-CachedGPPPassword',
53+
'Write-UserAddMSI',
4954
'Invoke-WScriptUACBypass',
5055
'Invoke-PrivescAudit',
51-
'Restore-ServiceBinary',
52-
'Set-ServiceBinaryPath',
53-
'Test-ServiceDaclPermission',
54-
'Write-UserAddMSI',
55-
'Write-HijackDll',
56-
'Write-ServiceBinary',
5756
'Get-System'
5857
)
5958

‎Privesc/README.md

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,18 @@ Required Dependencies: None
2727
Optional Dependencies: None
2828

2929

30-
### Service Enumeration:
31-
Get-ServiceUnquoted - returns services with unquoted paths that also have a space in the name
30+
### Token/Privilege Enumeration/Abuse:
31+
Get-ProcessTokenGroup - returns all SIDs that the current token context is a part of, whether they are disabled or not
32+
Get-ProcessTokenPrivilege - returns all privileges for the current (or specified) process ID
33+
Enable-Privilege - enables a specific privilege for the current process
34+
35+
### Service Enumeration/Abuse:
36+
Test-ServiceDaclPermission - tests one or more passed services or service names against a given permission set
37+
Get-UnquotedService - returns services with unquoted paths that also have a space in the name
3238
Get-ModifiableServiceFile - returns services where the current user can write to the service binary path or its config
3339
Get-ModifiableService - returns services the current user can modify
3440
Get-ServiceDetail - returns detailed information about a specified service
35-
36-
### Service Abuse:
41+
Set-ServiceBinaryPath - sets the binary path for a service to a specified value
3742
Invoke-ServiceAbuse - modifies a vulnerable service to create a local admin or execute a custom command
3843
Write-ServiceBinary - writes out a patched C# service binary that adds a local admin or executes a custom command
3944
Install-ServiceBinary - replaces a service binary with one that adds a local admin or executes a custom command
@@ -45,7 +50,7 @@ Optional Dependencies: None
4550
Write-HijackDll - writes out a hijackable DLL
4651

4752
### Registry Checks:
48-
Get-RegistryAlwaysInstallElevated - checks if the AlwaysInstallElevated registry key is set
53+
Get-RegistryAlwaysInstallElevated - checks if the AlwaysInstallElevated registry key is set
4954
Get-RegistryAutoLogon - checks for Autologon credentials in the registry
5055
Get-ModifiableRegistryAutoRun - checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns
5156

@@ -59,9 +64,6 @@ Optional Dependencies: None
5964

6065
### Other Helpers/Meta-Functions:
6166
Get-ModifiablePath - tokenizes an input string and returns the files in it the current user can modify
62-
Get-CurrentUserTokenGroupSid - returns all SIDs that the current user is a part of, whether they are disabled or not
63-
Add-ServiceDacl - adds a Dacl field to a service object returned by Get-Service
64-
Set-ServiceBinPath - sets the binary path for a service to a specified value through Win32 API methods
65-
Test-ServiceDaclPermission - tests one or more passed services or service names against a given permission set
6667
Write-UserAddMSI - write out a MSI installer that prompts for a user to be added
67-
Invoke-AllChecks - runs all current escalation checks and returns a report
68+
Invoke-WScriptUACBypass - performs the bypass UAC attack by abusing the lack of an embedded manifest in wscript.exe
69+
Invoke-PrivescAudit - runs all current escalation checks and returns a report (formerly Invoke-AllChecks)

‎docs/Privesc/Add-ServiceDacl.md

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Add-ServiceDacl
2+
3+
## SYNOPSIS
4+
Adds a Dacl field to a service object returned by Get-Service.
5+
6+
Author: Matthew Graeber (@mattifestation)
7+
License: BSD 3-Clause
8+
Required Dependencies: PSReflect
9+
10+
## SYNTAX
11+
12+
```
13+
Add-ServiceDacl [-Name] <String[]>
14+
```
15+
16+
## DESCRIPTION
17+
Takes one or more ServiceProcess.ServiceController objects on the pipeline and adds a
18+
Dacl field to each object.
19+
It does this by opening a handle with ReadControl for the
20+
service with using the GetServiceHandle Win32 API call and then uses
21+
QueryServiceObjectSecurity to retrieve a copy of the security descriptor for the service.
22+
23+
## EXAMPLES
24+
25+
### -------------------------- EXAMPLE 1 --------------------------
26+
```
27+
Get-Service | Add-ServiceDacl
28+
```
29+
30+
Add Dacls for every service the current user can read.
31+
32+
### -------------------------- EXAMPLE 2 --------------------------
33+
```
34+
Get-Service -Name VMTools | Add-ServiceDacl
35+
```
36+
37+
Add the Dacl to the VMTools service object.
38+
39+
## PARAMETERS
40+
41+
### -Name
42+
An array of one or more service names to add a service Dacl for.
43+
Passable on the pipeline.
44+
45+
```yaml
46+
Type: String[]
47+
Parameter Sets: (All)
48+
Aliases: ServiceName
49+
50+
Required: True
51+
Position: 1
52+
Default value: None
53+
Accept pipeline input: True (ByPropertyName, ByValue)
54+
Accept wildcard characters: False
55+
```
56+
57+
## INPUTS
58+
59+
## OUTPUTS
60+
61+
### ServiceProcess.ServiceController
62+
63+
## NOTES
64+
65+
## RELATED LINKS
66+
67+
[https://rohnspowershellblog.wordpress.com/2013/03/19/viewing-service-acls/](https://rohnspowershellblog.wordpress.com/2013/03/19/viewing-service-acls/)
68+

‎docs/Privesc/Enable-Privilege.md

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# Enable-Privilege
2+
3+
## SYNOPSIS
4+
Enables a specific privilege for the current process.
5+
6+
Author: Will Schroeder (@harmj0y)
7+
License: BSD 3-Clause
8+
Required Dependencies: PSReflect
9+
10+
## SYNTAX
11+
12+
```
13+
Enable-Privilege [-Privilege] <String[]>
14+
```
15+
16+
## DESCRIPTION
17+
Uses RtlAdjustPrivilege to enable a specific privilege for the current process.
18+
Privileges can be passed by string, or the output from Get-ProcessTokenPrivilege
19+
can be passed on the pipeline.
20+
21+
## EXAMPLES
22+
23+
### -------------------------- EXAMPLE 1 --------------------------
24+
```
25+
Get-ProcessTokenPrivilege
26+
```
27+
28+
Privilege Attributes ProcessId
29+
--------- ---------- ---------
30+
SeShutdownPrivilege DISABLED 3620
31+
SeChangeNotifyPrivilege ...AULT, SE_PRIVILEGE_ENABLED 3620
32+
SeUndockPrivilege DISABLED 3620
33+
SeIncreaseWorkingSetPrivilege DISABLED 3620
34+
SeTimeZonePrivilege DISABLED 3620
35+
36+
Enable-Privilege SeShutdownPrivilege
37+
38+
Get-ProcessTokenPrivilege
39+
40+
Privilege Attributes ProcessId
41+
--------- ---------- ---------
42+
SeShutdownPrivilege SE_PRIVILEGE_ENABLED 3620
43+
SeChangeNotifyPrivilege ...AULT, SE_PRIVILEGE_ENABLED 3620
44+
SeUndockPrivilege DISABLED 3620
45+
SeIncreaseWorkingSetPrivilege DISABLED 3620
46+
SeTimeZonePrivilege DISABLED 3620
47+
48+
### -------------------------- EXAMPLE 2 --------------------------
49+
```
50+
Get-ProcessTokenPrivilege
51+
```
52+
53+
Privilege Attributes ProcessId
54+
--------- ---------- ---------
55+
SeShutdownPrivilege DISABLED 2828
56+
SeChangeNotifyPrivilege ...AULT, SE_PRIVILEGE_ENABLED 2828
57+
SeUndockPrivilege DISABLED 2828
58+
SeIncreaseWorkingSetPrivilege DISABLED 2828
59+
SeTimeZonePrivilege DISABLED 2828
60+
61+
62+
Get-ProcessTokenPrivilege | Enable-Privilege -Verbose
63+
VERBOSE: Attempting to enable SeShutdownPrivilege
64+
VERBOSE: Attempting to enable SeChangeNotifyPrivilege
65+
VERBOSE: Attempting to enable SeUndockPrivilege
66+
VERBOSE: Attempting to enable SeIncreaseWorkingSetPrivilege
67+
VERBOSE: Attempting to enable SeTimeZonePrivilege
68+
69+
Get-ProcessTokenPrivilege
70+
71+
Privilege Attributes ProcessId
72+
--------- ---------- ---------
73+
SeShutdownPrivilege SE_PRIVILEGE_ENABLED 2828
74+
SeChangeNotifyPrivilege ...AULT, SE_PRIVILEGE_ENABLED 2828
75+
SeUndockPrivilege SE_PRIVILEGE_ENABLED 2828
76+
SeIncreaseWorkingSetPrivilege SE_PRIVILEGE_ENABLED 2828
77+
SeTimeZonePrivilege SE_PRIVILEGE_ENABLED 2828
78+
79+
## PARAMETERS
80+
81+
### -Privilege
82+
{{Fill Privilege Description}}
83+
84+
```yaml
85+
Type: String[]
86+
Parameter Sets: (All)
87+
Aliases: Privileges
88+
89+
Required: True
90+
Position: 1
91+
Default value: None
92+
Accept pipeline input: True (ByPropertyName, ByValue)
93+
Accept wildcard characters: False
94+
```
95+
96+
## INPUTS
97+
98+
## OUTPUTS
99+
100+
## NOTES
101+
102+
## RELATED LINKS
103+
104+
[http://forum.sysinternals.com/tip-easy-way-to-enable-privileges_topic15745.html](http://forum.sysinternals.com/tip-easy-way-to-enable-privileges_topic15745.html)
105+

‎docs/Privesc/Find-PathDLLHijack.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Find-PathDLLHijack
2+
3+
## SYNOPSIS
4+
Finds all directories in the system %PATH% that are modifiable by the current user.
5+
6+
Author: Will Schroeder (@harmj0y)
7+
License: BSD 3-Clause
8+
Required Dependencies: Get-ModifiablePath
9+
10+
## SYNTAX
11+
12+
```
13+
Find-PathDLLHijack
14+
```
15+
16+
## DESCRIPTION
17+
Enumerates the paths stored in Env:Path (%PATH) and filters each through Get-ModifiablePath
18+
to return the folder paths the current user can write to.
19+
On Windows 7, if wlbsctrl.dll is
20+
written to one of these paths, execution for the IKEEXT can be hijacked due to DLL search
21+
order loading.
22+
23+
## EXAMPLES
24+
25+
### -------------------------- EXAMPLE 1 --------------------------
26+
```
27+
Find-PathDLLHijack
28+
```
29+
30+
Finds all %PATH% .DLL hijacking opportunities.
31+
32+
## PARAMETERS
33+
34+
## INPUTS
35+
36+
## OUTPUTS
37+
38+
### PowerUp.HijackableDLL.Path
39+
40+
## NOTES
41+
42+
## RELATED LINKS
43+
44+
[http://www.greyhathacker.net/?p=738](http://www.greyhathacker.net/?p=738)
45+

0 commit comments

Comments
 (0)