Thanks to the teachers on the road of growth
Weak Service Permission Windows Privilege Promotion Weak Service Permission Windows Privilege Promotion
Some of the wordsThe official introduction https://docs.microsoft.com/en-us/dotnet/framework&#x
2021-11-07 Learning record
Redteam Windows Privilege Promotion LPE
Unquoted Service Path Windows Privilege Promotion Unquoted Service Path Windows Privilege Promotion
Some of the wordsIf the target binary Path is not quoted and contains Spaces, the vulnerability name of the installed Se
2021-11-07 Learning record
Redteam Windows Privilege Promotion LPE
Insecure GUI Application Windows Privilege Promotion Insecure GUI Application Windows Privilege Promotion
Some of the wordsElevated privileges in application to try here, part of the GUI application to current higher outside o
2021-11-07 Learning record
Redteam Windows Privilege Promotion LPE
The Msf Creds Note The Msf Creds Note
Some of the wordsWe all know that there is a PostSQL database under MSF for actual use, which stores host and vulnerabil
2021-11-07 Tips
Redteam MSF
Powershell Constrained Language Mode Bypass Powershell Constrained Language Mode Bypass
Some of the wordsUnlike executing scripts.\1.ps1, this Constrained Language mode limits powershell's function advant
2021-11-06 Tips
Redteam Bypass Powershell
Powershell Without Powershell.exe Bypass Powershell Without Powershell.exe Bypass
Some of the wordsPowershell cannot be used during Intranet penetration of red team personnel. The tool or script you wan
2021-11-06 Tips
Redteam Bypass Powershell
Windows Service Auto Start(BypassAV) Windows Service Auto Start(BypassAV)
前言先前写了下代码层面实现psexec功能点，其中包含建立服务、启动服务功能模块，发现也是个拿来做命令执行或者后门的好方法，此处单独利用windows服务实现开机自启动，增加权限维持杀软对抗思路 先看实现效果，添加服务免杀效果如下 添
2021-11-05 Learning record
Redteam Bypass Windows Service
cmdl32代替certutil从而绕过杀软 cmdl32代替certutil从而绕过杀软
简介cmdl32.exe，CMAK（连接管理器管理工具包）使用它来设置连接管理器服务配置文件。配置文件通常打包成一个.exe，可以部署到用户系统，该软件包安装可用于启动拨号/VPN连接的配置文件 此处可以使用他来做一个下载器进行
2021-11-05 Tips
Redteam Bypass cmdl32
实现&利用命名管道补充&令牌模拟 实现&利用命名管道补充&令牌模拟
前言上一篇已知命名管道从代码层的基本原理实现，及其实际作战中遭遇反弹shell受阻时的使用方式，此处进步针对实际管道应用中进行展开，补充先前所不足 访问控制命名管道支持跨网络的访问连接，但是会受到访问控制列表或者本地策略的管控 在03及
2021-11-04 Learning record
Redteam Bypass NamedPipes
实现&利用命名管道 实现&利用命名管道
简介命名管道是一个具有名称，可以单向或双面在一个服务器和一个或多个客户端之间进行通讯的管道。命名管道的所有实例拥有相同的名称，但是每个实例都有其自己的缓冲区和句柄，用来为不同客户端通许提供独立的管道。使用实例可使多个管道客户端同时使用相同的
2021-11-02 Learning record
Redteam Bypass NamedPipes
实现一个仿造的Psexec 实现一个仿造的Psexec
前言初衷改变些许的流量特征，增强隐蔽性，此处以进行cs上线为案例，同样能够执行其他exe应用程序，未来或许将增加交互功能 常规痕迹此处查看psexec常规日志&流量中的痕迹，安全日志内登录情况如下，触发多个4624包含相关计算机名
2021-11-01 Learning record
Redteam Bypass Psexec
Linux Reverse Shell Hidden Real IP Linux Reverse Shell Hidden Real IP
Some of the wordsIn red team, nc reverse shell is usually used with personal real IP, which is extremely easy to be trac
2021-10-21 Tips
Bypass Reverse Shell
3 / 7