Archives | Yangsir

2021

11

14

Logon Autostart Execution Windows Privilege Promotion

Some of the wordsThrough the login user's self-start file modification, so as to achieve permission promotion About

2021-11-14 Learning record

13

个人CNVD证书&CVE编号获取之道

前言时间也过去了很久了，最近说起些如何获得的思路？仅以此文做个思路发散，希望能够帮助到每个梦想路上的人 1、如果你静不下心做一件事，那么你可以划走了，因为你必然挖不到洞 2、如果你觉得CNVD证书、CVE编号没用，那么你可以划走了，毕竟很

2021-11-13 Actual combat record

CNVD CVE

12

土豆提权原理分析

前言土豆系列的提权原理主要是诱导高权限访问低权限的系统对象，导致低权限的对象可以模拟高权限对象的访问令牌（Access Token），进而可以用访问令牌创建进程，达到代码执行。访问控制模型有两个主要的组成部分，访问令牌（Access

2021-11-12 Learning record

Redteam Windows Privilege Promotion NamedPipes Potato

07

Weak Service Registry Permission Windows Privilege Promotion

Some of the wordsBy hijacking the registry keys used by the service, an attacker can implement an application that execu

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

Weak Service Permission Windows Privilege Promotion

Some of the wordsThe official introduction https://docs.microsoft.com/en-us/dotnet/framework&#x

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

Unquoted Service Path Windows Privilege Promotion

Some of the wordsIf the target binary Path is not quoted and contains Spaces, the vulnerability name of the installed Se

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

Insecure GUI Application Windows Privilege Promotion

Some of the wordsElevated privileges in application to try here, part of the GUI application to current higher outside o

2021-11-07 Learning record

Redteam Windows Privilege Promotion LPE

07

The Msf Creds Note

Some of the wordsWe all know that there is a PostSQL database under MSF for actual use, which stores host and vulnerabil

2021-11-07 Tips

Redteam MSF

06

Powershell Constrained Language Mode Bypass

Some of the wordsUnlike executing scripts.\1.ps1, this Constrained Language mode limits powershell's function advant

2021-11-06 Tips

Redteam Bypass Powershell

06

Powershell Without Powershell.exe Bypass

Some of the wordsPowershell cannot be used during Intranet penetration of red team personnel. The tool or script you wan

2021-11-06 Tips

Redteam Bypass Powershell