Archives: 2021/11

2021

11

16

前言目前实现LDAP信息收集的工具有很多，相关语法结构成熟资料也非常多，在不断的思考下回顾先前学习，总是觉得没从原理深入一遍就只是个会用工具的脚本小子，此处以编程语言封装实现LDAP相关查询功能理解相关连接、查询功能模块，内置部分过滤规则，

2021-11-16 Learning record

14

Boot Logon Autostart Execution Windows Privilege Promotion

Some of the wordsThrough the start folder to modify, so as to achieve the relevant user rights The Startup folder is a

2021-11-14 Learning record

Redteam Windows Privilege Promotion LPE

14

Logon Autostart Execution Windows Privilege Promotion

Some of the wordsThrough the login user's self-start file modification, so as to achieve permission promotion About

2021-11-14 Learning record

Redteam Windows Privilege Promotion LPE

13

个人CNVD证书&CVE编号获取之道

前言时间也过去了很久了，最近说起些如何获得的思路？仅以此文做个思路发散，希望能够帮助到每个梦想路上的人 1、如果你静不下心做一件事，那么你可以划走了，因为你必然挖不到洞 2、如果你觉得CNVD证书、CVE编号没用，那么你可以划走了，毕竟很

2021-11-13 Actual combat record

CNVD CVE

12

土豆提权原理分析

前言土豆系列的提权原理主要是诱导高权限访问低权限的系统对象，导致低权限的对象可以模拟高权限对象的访问令牌（Access Token），进而可以用访问令牌创建进程，达到代码执行。访问控制模型有两个主要的组成部分，访问令牌（Access

2021-11-12 Learning record

Redteam Windows Privilege Promotion NamedPipes Potato

07

Weak Service Registry Permission Windows Privilege Promotion

Some of the wordsBy hijacking the registry keys used by the service, an attacker can implement an application that execu

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

Weak Service Permission Windows Privilege Promotion

Some of the wordsThe official introduction https://docs.microsoft.com/en-us/dotnet/framework&#x

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

Unquoted Service Path Windows Privilege Promotion

Some of the wordsIf the target binary Path is not quoted and contains Spaces, the vulnerability name of the installed Se

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

Insecure GUI Application Windows Privilege Promotion

Some of the wordsElevated privileges in application to try here, part of the GUI application to current higher outside o

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

The Msf Creds Note

Some of the wordsWe all know that there is a PostSQL database under MSF for actual use, which stores host and vulnerabil

2021-11-07 Tips

Redteam MSF