Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 428d906

Browse files
HarmJ0yHarmJ0y
authored
Merge pull request #238 from hackjammer/dev
Improve output of Invoke-PrivescAudit
2 parents e24d642 + a78474a commit 428d906

File tree

3 files changed

+114
-151
lines changed

3 files changed

+114
-151
lines changed

‎PowerSploit.psd1

+2-2
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,11 @@ FunctionsToExport = @(
9090
'Get-RegistryAutoLogon',
9191
'Get-SecurityPackages',
9292
'Get-ServiceDetail',
93-
'Get-ServiceUnquoted',
9493
'Get-SiteListPassword',
9594
'Get-System',
9695
'Get-TimedScreenshot',
9796
'Get-UnattendedInstallFile',
97+
'Get-UnquotedService',
9898
'Get-UserEvent',
9999
'Get-UserProperty',
100100
'Get-VaultCredential',
@@ -103,7 +103,6 @@ FunctionsToExport = @(
103103
'Install-ServiceBinary',
104104
'Install-SSP',
105105
'Invoke-ACLScanner',
106-
'Invoke-AllChecks',
107106
'Invoke-CheckLocalAdminAccess',
108107
'Invoke-CredentialInjection',
109108
'Invoke-DllInjection',
@@ -114,6 +113,7 @@ FunctionsToExport = @(
114113
'Invoke-Mimikatz',
115114
'Invoke-NinjaCopy',
116115
'Invoke-Portscan',
116+
'Invoke-PrivescAudit',
117117
'Invoke-ProcessHunter',
118118
'Invoke-ReflectivePEInjection',
119119
'Invoke-ReverseDnsLookup',

‎PowerSploit.psm1

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Get-ChildItem $PSScriptRoot | ? { $_.PSIsContainer -and ($_.Name -ne 'Tests') } | % { Import-Module $_.FullName -DisableNameChecking }
1+
Get-ChildItem $PSScriptRoot | ? { $_.PSIsContainer -and !('Tests','docs' -contains $_.Name) } | % { Import-Module $_.FullName -DisableNameChecking }

‎Privesc/PowerUp.ps1

+111-148
Original file line numberDiff line numberDiff line change
@@ -1390,6 +1390,7 @@ Outputs a custom object containing the token privilege (name/attributes) for the
13901390
if ($PSBoundParameters['Special']) {
13911391
if ($SpecialPrivileges -Contains $_.Privilege) {
13921392
$_ | Add-Member Noteproperty 'ProcessId' $ProcessID
1393+
$_ | Add-Member Aliasproperty Name ProcessId
13931394
$_
13941395
}
13951396
}
@@ -2086,6 +2087,7 @@ https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/wind
20862087
$Out | Add-Member Noteproperty 'StartName' $Service.startname
20872088
$Out | Add-Member Noteproperty 'AbuseFunction' "Write-ServiceBinary -Name '$($Service.name)' -Path <HijackPath>"
20882089
$Out | Add-Member Noteproperty 'CanRestart' ([Bool]$CanRestart)
2090+
$Out | Add-Member Aliasproperty Name ServiceName
20892091
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.UnquotedService')
20902092
$Out
20912093
}
@@ -2145,6 +2147,7 @@ PowerUp.ModifiablePath
21452147
$Out | Add-Member Noteproperty 'StartName' $ServiceStartName
21462148
$Out | Add-Member Noteproperty 'AbuseFunction' "Install-ServiceBinary -Name '$ServiceName'"
21472149
$Out | Add-Member Noteproperty 'CanRestart' ([Bool]$CanRestart)
2150+
$Out | Add-Member Aliasproperty Name ServiceName
21482151
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.ModifiableServiceFile')
21492152
$Out
21502153
}
@@ -2192,6 +2195,7 @@ PowerUp.ModifiablePath
21922195
$Out | Add-Member Noteproperty 'StartName' $ServiceDetails.startname
21932196
$Out | Add-Member Noteproperty 'AbuseFunction' "Invoke-ServiceAbuse -Name '$($ServiceDetails.name)'"
21942197
$Out | Add-Member Noteproperty 'CanRestart' ([Bool]$CanRestart)
2198+
$Out | Add-Member Aliasproperty Name ServiceName
21952199
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.ModifiableService')
21962200
$Out
21972201
}
@@ -3157,6 +3161,7 @@ http://www.greyhathacker.net/?p=738
31573161
ForEach ($ModifidablePath in $ModifidablePaths) {
31583162
if ($Null -ne $ModifidablePath.ModifiablePath) {
31593163
$ModifidablePath | Add-Member Noteproperty '%PATH%' $_
3164+
$ModifidablePath | Add-Member Aliasproperty Name '%PATH%'
31603165
$ModifidablePath.PSObject.TypeNames.Insert(0, 'PowerUp.HijackableDLL.Path')
31613166
$ModifidablePath
31623167
}
@@ -3587,6 +3592,7 @@ Custom PSObject containing results.
35873592
$Out | Add-Member Noteproperty 'Key' "$ParentPath\$Name"
35883593
$Out | Add-Member Noteproperty 'Path' $Path
35893594
$Out | Add-Member Noteproperty 'ModifiableFile' $_
3595+
$Out | Add-Member Aliasproperty Name Key
35903596
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.ModifiableRegistryAutoRun')
35913597
$Out
35923598
}
@@ -3659,6 +3665,7 @@ Custom PSObject containing results.
36593665
$Out | Add-Member Noteproperty 'TaskName' $TaskName
36603666
$Out | Add-Member Noteproperty 'TaskFilePath' $_
36613667
$Out | Add-Member Noteproperty 'TaskTrigger' $TaskTrigger
3668+
$Out | Add-Member Aliasproperty Name TaskName
36623669
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.ModifiableScheduledTaskFile')
36633670
$Out
36643671
}
@@ -3669,6 +3676,7 @@ Custom PSObject containing results.
36693676
$Out | Add-Member Noteproperty 'TaskName' $TaskName
36703677
$Out | Add-Member Noteproperty 'TaskFilePath' $_
36713678
$Out | Add-Member Noteproperty 'TaskTrigger' $TaskTrigger
3679+
$Out | Add-Member Aliasproperty Name TaskName
36723680
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.ModifiableScheduledTaskFile')
36733681
$Out
36743682
}
@@ -3733,6 +3741,7 @@ Custom PSObject containing results.
37333741
$SearchLocations | Where-Object { Test-Path $_ } | ForEach-Object {
37343742
$Out = New-Object PSObject
37353743
$Out | Add-Member Noteproperty 'UnattendPath' $_
3744+
$Out | Add-Member Aliasproperty Name UnattendPath
37363745
$Out.PSObject.TypeNames.Insert(0, 'PowerUp.UnattendedInstallFile')
37373746
$Out
37383747
}
@@ -4681,9 +4690,14 @@ Required Dependencies: None
46814690

46824691
Executes all functions that check for various Windows privilege escalation opportunities.
46834692

4693+
.PARAMETER Format
4694+
4695+
String. Format to decide on what is returned from the command, an Object Array, List, or HTML Report.
4696+
46844697
.PARAMETER HTMLReport
46854698

4686-
Switch. Write a HTML version of the report to SYSTEM.username.html.
4699+
DEPRECATED - Switch. Write a HTML version of the report to SYSTEM.username.html.
4700+
Superseded by the Format parameter.
46874701

46884702
.EXAMPLE
46894703

@@ -4693,25 +4707,26 @@ Runs all escalation checks and outputs a status report for discovered issues.
46934707

46944708
.EXAMPLE
46954709

4696-
Invoke-PrivescAudit -HTMLReport
4710+
Invoke-PrivescAudit -Format HTML
46974711

46984712
Runs all escalation checks and outputs a status report to SYSTEM.username.html
46994713
detailing any discovered issues.
47004714

4701-
.OUTPUTS
4702-
4703-
System.String
47044715
#>
47054716

47064717
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
4707-
[OutputType('System.String')]
47084718
[CmdletBinding()]
47094719
Param(
4720+
[ValidateSet('Object','List','HTML')]
4721+
[String]
4722+
$Format = 'Object',
47104723
[Switch]
47114724
$HTMLReport
47124725
)
47134726

4714-
if ($HTMLReport) {
4727+
if($HTMLReport){ $Format = 'HTML' }
4728+
4729+
if ($Format -eq 'HTML') {
47154730
$HtmlReportFile = "$($Env:ComputerName).$($Env:UserName).html"
47164731
$Header = "<style>"
47174732
$Header = $Header + "BODY{background-color:peachpuff;}"
@@ -4722,153 +4737,101 @@ System.String
47224737
ConvertTo-HTML -Head $Header -Body "<H1>PowerUp report for '$($Env:ComputerName).$($Env:UserName)'</H1>" | Out-File $HtmlReportFile
47234738
}
47244739

4725-
# initial admin checks
4726-
4727-
"`n[*] Running Invoke-AllChecks"
4728-
4729-
$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
4730-
4731-
if ($IsAdmin){
4732-
"[+] Current user already has local administrative privileges!"
4733-
4734-
if ($HTMLReport) {
4735-
ConvertTo-HTML -Head $Header -Body "<H2>User Has Local Admin Privileges!</H2>" | Out-File -Append $HtmlReportFile
4740+
Write-Verbose "Running Invoke-PrivescAudit"
4741+
4742+
$Checks = @(
4743+
# Initial admin checks
4744+
@{
4745+
Type = 'User Has Local Admin Privileges'
4746+
Command = { if (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")){ New-Object PSObject } }
4747+
},
4748+
@{
4749+
Type = 'User In Local Group with Admin Privileges'
4750+
Command = { if ((Get-ProcessTokenGroup | Select-Object -ExpandProperty SID) -contains 'S-1-5-32-544'){ New-Object PSObject } }
4751+
AbuseScript = { 'Invoke-WScriptUACBypass -Command "..."' }
4752+
},
4753+
@{
4754+
Type = 'Process Token Privileges'
4755+
Command = { Get-ProcessTokenPrivilege -Special | Where-Object {$_} }
4756+
},
4757+
# Service checks
4758+
@{
4759+
Type = 'Unquoted Service Paths'
4760+
Command = { Get-UnquotedService }
4761+
},
4762+
@{
4763+
Type = 'Modifiable Service Files'
4764+
Command = { Get-ModifiableServiceFile }
4765+
},
4766+
@{
4767+
Type = 'Modifiable Services'
4768+
Command = { Get-ModifiableService }
4769+
},
4770+
# DLL hijacking
4771+
@{
4772+
Type = '%PATH% .dll Hijacks'
4773+
Command = { Find-PathDLLHijack }
4774+
AbuseScript = { "Write-HijackDll -DllPath '$($_.ModifiablePath)\wlbsctrl.dll'" }
4775+
},
4776+
# Registry checks
4777+
@{
4778+
Type = 'AlwaysInstallElevated Registry Key'
4779+
Command = { if (Get-RegistryAlwaysInstallElevated){ New-Object PSObject } }
4780+
AbuseScript = { 'Write-UserAddMSI' }
4781+
},
4782+
@{
4783+
Type = 'Registry Autologons'
4784+
Command = { Get-RegistryAutoLogon }
4785+
},
4786+
@{
4787+
Type = 'Modifiable Registry Autorun'
4788+
Command = { Get-ModifiableRegistryAutoRun }
4789+
},
4790+
# Other checks
4791+
@{
4792+
Type = 'Modifiable Scheduled Task Files'
4793+
Command = { Get-ModifiableScheduledTaskFile }
4794+
},
4795+
@{
4796+
Type = 'Unattended Install Files'
4797+
Command = { Get-UnattendedInstallFile }
4798+
},
4799+
@{
4800+
Type = 'Encrypted web.config Strings'
4801+
Command = { Get-WebConfig | Where-Object {$_} }
4802+
},
4803+
@{
4804+
Type = 'Encrypted Application Pool Passwords'
4805+
Command = { Get-ApplicationHost | Where-Object {$_} }
4806+
},
4807+
@{
4808+
Type = 'McAfee SiteList.xml files'
4809+
Command = { Get-SiteListPassword | Where-Object {$_} }
4810+
},
4811+
@{
4812+
Type = 'Cached GPP Files'
4813+
Command = { Get-CachedGPPPassword | Where-Object {$_} }
47364814
}
4737-
}
4738-
else{
4739-
"`n`n[*] Checking if user is in a local group with administrative privileges..."
4740-
4741-
$CurrentUserSids = Get-ProcessTokenGroup | Select-Object -ExpandProperty SID
4742-
if ($CurrentUserSids -Contains 'S-1-5-32-544') {
4743-
"[+] User is in a local group that grants administrative privileges!"
4744-
"[+] Run 'Invoke-WScriptUACBypass -Command `"...`"' to elevate privileges to admin."
4745-
if ($HTMLReport) {
4746-
ConvertTo-HTML -Head $Header -Body "<H2> User In Local Group With Administrative Privileges</H2>" | Out-File -Append $HtmlReportFile
4815+
)
4816+
4817+
ForEach($Check in $Checks){
4818+
Write-Verbose "Checking for $($Check.Type)..."
4819+
$Results = . $Check.Command
4820+
$Results | Where-Object {$_} | ForEach-Object {
4821+
$_ | Add-Member Noteproperty 'Check' $Check.Type
4822+
if ($Check.AbuseScript){
4823+
$_ | Add-Member Noteproperty 'AbuseFunction' (. $Check.AbuseScript)
47474824
}
47484825
}
4749-
}
4750-
4751-
"`n`n[*] Checking current process token permissions..."
4752-
$Results = Get-ProcessTokenPrivilege -Special | Where-Object {$_}
4753-
$Results | Format-List
4754-
if ($HTMLReport) {
4755-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Cached GPP Files</H2>" | Out-File -Append $HtmlReportFile
4756-
}
4757-
4758-
# Service checks
4759-
4760-
"`n`n[*] Checking for unquoted service paths..."
4761-
$Results = Get-UnquotedService
4762-
$Results | Format-List
4763-
if ($HTMLReport) {
4764-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Unquoted Service Paths</H2>" | Out-File -Append $HtmlReportFile
4765-
}
4766-
4767-
"`n`n[*] Checking service executable and argument permissions..."
4768-
$Results = Get-ModifiableServiceFile
4769-
$Results | Format-List
4770-
if ($HTMLReport) {
4771-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Service File Permissions</H2>" | Out-File -Append $HtmlReportFile
4772-
}
4773-
4774-
"`n`n[*] Checking service permissions..."
4775-
$Results = Get-ModifiableService
4776-
$Results | Format-List
4777-
if ($HTMLReport) {
4778-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Modifiable Services</H2>" | Out-File -Append $HtmlReportFile
4779-
}
4780-
4781-
4782-
# DLL hijacking
4783-
4784-
"`n`n[*] Checking %PATH% for potentially hijackable DLL locations..."
4785-
$Results = Find-PathDLLHijack
4786-
$Results | Where-Object {$_} | Foreach-Object {
4787-
$AbuseString = "Write-HijackDll -DllPath '$($_.ModifiablePath)\wlbsctrl.dll'"
4788-
$_ | Add-Member Noteproperty 'AbuseFunction' $AbuseString
4789-
$_
4790-
} | Format-List
4791-
if ($HTMLReport) {
4792-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>%PATH% .dll Hijacks</H2>" | Out-File -Append $HtmlReportFile
4793-
}
4794-
4795-
4796-
# registry checks
4797-
4798-
"`n`n[*] Checking for AlwaysInstallElevated registry key..."
4799-
if (Get-RegistryAlwaysInstallElevated) {
4800-
$Out = New-Object PSObject
4801-
$Out | Add-Member Noteproperty 'AbuseFunction' "Write-UserAddMSI"
4802-
$Results = $Out
4803-
4804-
$Results | Format-List
4805-
if ($HTMLReport) {
4806-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>AlwaysInstallElevated</H2>" | Out-File -Append $HtmlReportFile
4826+
switch($Format){
4827+
Object { $Results }
4828+
List { "`n`n[*] Checking for $($Check.Type)..."; $Results | Format-List }
4829+
HTML { $Results | ConvertTo-HTML -Head $Header -Body "<H2>$($Check.Type)</H2>" | Out-File -Append $HtmlReportFile }
48074830
}
48084831
}
48094832

4810-
"`n`n[*] Checking for Autologon credentials in registry..."
4811-
$Results = Get-RegistryAutoLogon
4812-
$Results | Format-List
4813-
if ($HTMLReport) {
4814-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Registry Autologons</H2>" | Out-File -Append $HtmlReportFile
4815-
}
4816-
4817-
4818-
"`n`n[*] Checking for modifidable registry autoruns and configs..."
4819-
$Results = Get-ModifiableRegistryAutoRun
4820-
$Results | Format-List
4821-
if ($HTMLReport) {
4822-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Registry Autoruns</H2>" | Out-File -Append $HtmlReportFile
4823-
}
4824-
4825-
# other checks
4826-
4827-
"`n`n[*] Checking for modifiable schtask files/configs..."
4828-
$Results = Get-ModifiableScheduledTaskFile
4829-
$Results | Format-List
4830-
if ($HTMLReport) {
4831-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Modifidable Schask Files</H2>" | Out-File -Append $HtmlReportFile
4832-
}
4833-
4834-
"`n`n[*] Checking for unattended install files..."
4835-
$Results = Get-UnattendedInstallFile
4836-
$Results | Format-List
4837-
if ($HTMLReport) {
4838-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Unattended Install Files</H2>" | Out-File -Append $HtmlReportFile
4839-
}
4840-
4841-
"`n`n[*] Checking for encrypted web.config strings..."
4842-
$Results = Get-Webconfig | Where-Object {$_}
4843-
$Results | Format-List
4844-
if ($HTMLReport) {
4845-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Encrypted 'web.config' String</H2>" | Out-File -Append $HtmlReportFile
4846-
}
4847-
4848-
"`n`n[*] Checking for encrypted application pool and virtual directory passwords..."
4849-
$Results = Get-ApplicationHost | Where-Object {$_}
4850-
$Results | Format-List
4851-
if ($HTMLReport) {
4852-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Encrypted Application Pool Passwords</H2>" | Out-File -Append $HtmlReportFile
4853-
}
4854-
4855-
"`n`n[*] Checking for plaintext passwords in McAfee SiteList.xml files..."
4856-
$Results = Get-SiteListPassword | Where-Object {$_}
4857-
$Results | Format-List
4858-
if ($HTMLReport) {
4859-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>McAfee's SiteList.xml's</H2>" | Out-File -Append $HtmlReportFile
4860-
}
4861-
4862-
"`n`n[*] Checking for cached Group Policy Preferences .xml files..."
4863-
$Results = Get-CachedGPPPassword | Where-Object {$_}
4864-
$Results | Format-List
4865-
if ($HTMLReport) {
4866-
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Cached GPP Files</H2>" | Out-File -Append $HtmlReportFile
4867-
}
4868-
"`n"
4869-
4870-
if ($HTMLReport) {
4871-
"[*] Report written to '$HtmlReportFile' `n"
4833+
if ($Format -eq 'HTML') {
4834+
Write-Verbose "[*] Report written to '$HtmlReportFile' `n"
48724835
}
48734836
}
48744837

0 commit comments

Comments
 (0)