Skip to content

Commit 4915945

Browse files
HarmJ0yHarmJ0y
committed
Renamed Get-RegistryAutoRun to Get-ModifiableRegistryAutoRun
Renamed Find-PathHijack to Find-PathDLLHijack Fixed exposed functions in PowerSploit.psd1
1 parent 1b359e7 commit 4915945

File tree

5 files changed

+43
-37
lines changed

5 files changed

+43
-37
lines changed

‎PowerSploit.psd1

+15-8
Original file line numberDiff line numberDiff line change
@@ -25,34 +25,41 @@ FunctionsToExport = @(
2525
'Add-NetUser',
2626
'Add-ObjectAcl',
2727
'Add-Persistence',
28+
'Add-ServiceDacl',
2829
'Convert-NameToSid',
2930
'Convert-NT4toCanonical',
3031
'Convert-SidToName',
3132
'Copy-ClonedFile',
3233
'Find-AVSignature',
3334
'Find-ComputerField',
34-
'Find-DLLHijack',
3535
'Find-ForeignGroup',
3636
'Find-ForeignUser',
3737
'Find-GPOComputerAdmin',
3838
'Find-GPOLocation',
3939
'Find-InterestingFile',
4040
'Find-LocalAdminAccess',
41+
'Find-PathDLLHijack',
42+
'Find-ProcessDLLHijack',
4143
'Find-ManagedSecurityGroups',
42-
'Find-PathHijack',
4344
'Find-UserField',
4445
'Get-ADObject',
4546
'Get-ApplicationHost',
4647
'Get-CachedRDPConnection',
4748
'Get-ComputerDetails',
4849
'Get-ComputerProperty',
50+
'Get-CurrentUserTokenGroupSid',
4951
'Get-DFSshare',
5052
'Get-DomainPolicy',
5153
'Get-ExploitableSystem',
5254
'Get-GPPPassword',
5355
'Get-HttpStatus',
5456
'Get-Keystrokes',
5557
'Get-LastLoggedOn',
58+
'Get-ModifiablePath',
59+
'Get-ModifiableRegistryAutoRun',
60+
'Get-ModifiableScheduledTaskFile',
61+
'Get-ModifiableService',
62+
'Get-ModifiableServiceFile',
5663
'Get-NetComputer',
5764
'Get-NetDomain',
5865
'Get-NetDomainController',
@@ -79,21 +86,19 @@ FunctionsToExport = @(
7986
'Get-ObjectAcl',
8087
'Get-PathAcl',
8188
'Get-Proxy',
82-
'Get-RegAlwaysInstallElevated',
83-
'Get-RegAutoLogon',
89+
'Get-RegistryAlwaysInstallElevated',
90+
'Get-RegistryAutoLogon',
8491
'Get-SecurityPackages',
8592
'Get-ServiceDetail',
86-
'Get-ServiceFilePermission',
87-
'Get-ServicePermission',
8893
'Get-ServiceUnquoted',
94+
'Get-SiteListPassword',
95+
'Get-System',
8996
'Get-TimedScreenshot',
9097
'Get-UnattendedInstallFile',
9198
'Get-UserEvent',
9299
'Get-UserProperty',
93100
'Get-VaultCredential',
94101
'Get-VolumeShadowCopy',
95-
'Get-VulnAutoRun',
96-
'Get-VulnSchTask',
97102
'Get-Webconfig',
98103
'Install-ServiceBinary',
99104
'Install-SSP',
@@ -133,6 +138,8 @@ FunctionsToExport = @(
133138
'Set-CriticalProcess',
134139
'Set-MacAttribute',
135140
'Set-MasterBootRecord',
141+
'Set-ServiceBinPath',
142+
'Test-ServiceDaclPermission',
136143
'Write-HijackDll',
137144
'Write-ServiceBinary',
138145
'Write-UserAddMSI'

‎Privesc/PowerUp.ps1

+7-8
Original file line numberDiff line numberDiff line change
@@ -2361,7 +2361,7 @@ function Find-ProcessDLLHijack {
23612361
}
23622362

23632363

2364-
function Find-PathHijack {
2364+
function Find-PathDLLHijack {
23652365
<#
23662366
.SYNOPSIS
23672367

@@ -2379,7 +2379,7 @@ function Find-PathHijack {
23792379

23802380
.EXAMPLE
23812381

2382-
PS C:\> Find-PathHijack
2382+
PS C:\> Find-PathDLLHijack
23832383

23842384
Finds all %PATH% .DLL hijacking opportunities.
23852385

@@ -2720,8 +2720,7 @@ function Get-RegistryAutoLogon {
27202720
}
27212721
}
27222722

2723-
2724-
function Get-RegistryAutoRun {
2723+
function Get-ModifiableRegistryAutoRun {
27252724
<#
27262725
.SYNOPSIS
27272726

@@ -2736,7 +2735,7 @@ function Get-RegistryAutoRun {
27362735

27372736
.EXAMPLE
27382737

2739-
PS C:\> Get-RegistryAutoRun
2738+
PS C:\> Get-ModifiableRegistryAutoRun
27402739

27412740
Return vulneable autorun binaries (or associated configs).
27422741
#>
@@ -3571,7 +3570,7 @@ function Invoke-AllChecks {
35713570
# DLL hijacking
35723571

35733572
"`n`n[*] Checking %PATH% for potentially hijackable DLL locations..."
3574-
$Results = Find-PathHijack
3573+
$Results = Find-PathDLLHijack
35753574
$Results | Foreach-Object {
35763575
$AbuseString = "Write-HijackDll -DllPath '$($_.Path)\wlbsctrl.dll'"
35773576
$_ | Add-Member Noteproperty 'AbuseFunction' $AbuseString
@@ -3604,8 +3603,8 @@ function Invoke-AllChecks {
36043603
}
36053604

36063605

3607-
"`n`n[*] Checking for registry autoruns and configs..."
3608-
$Results = Get-RegistryAutoRun
3606+
"`n`n[*] Checking for modifidable registry autoruns and configs..."
3607+
$Results = Get-ModifiableRegistryAutoRun
36093608
$Results | Format-List
36103609
if($HTMLReport) {
36113610
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Registry Autoruns</H2>" | Out-File -Append $HtmlReportFile

‎Privesc/Privesc.psd1

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,17 +24,17 @@ PowerShellVersion = '2.0'
2424
# Functions to export from this module
2525
FunctionsToExport = @(
2626
'Add-ServiceDacl',
27-
'Find-PathHijack',
27+
'Find-PathDLLHijack',
2828
'Find-ProcessDLLHijack',
2929
'Get-ApplicationHost',
3030
'Get-CurrentUserTokenGroupSid',
3131
'Get-ModifiablePath',
32+
'Get-ModifiableRegistryAutoRun',
3233
'Get-ModifiableScheduledTaskFile',
3334
'Get-ModifiableService',
3435
'Get-ModifiableServiceFile',
3536
'Get-RegistryAlwaysInstallElevated',
3637
'Get-RegistryAutoLogon',
37-
'Get-RegistryAutoRun',
3838
'Get-ServiceDetail',
3939
'Get-ServiceUnquoted',
4040
'Get-SiteListPassword',

‎Privesc/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,13 @@ Optional Dependencies: None
4141

4242
### DLL Hijacking:
4343
Find-ProcessDLLHijack - finds potential DLL hijacking opportunities for currently running processes
44-
Find-PathHijack - finds service %PATH% .dll hijacking opportunities
45-
Write-HijackDll - writes out a hijackable .dll
44+
Find-PathDLLHijack - finds service %PATH% DLL hijacking opportunities
45+
Write-HijackDll - writes out a hijackable DLL
4646

4747
### Registry Checks:
4848
Get-RegistryAlwaysInstallElevated - checks if the AlwaysInstallElevated registry key is set
4949
Get-RegistryAutoLogon - checks for Autologon credentials in the registry
50-
Get-RegistryAutoRun - checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns
50+
Get-ModifiableRegistryAutoRun - checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns
5151

5252
### Miscellaneous Checks:
5353
Get-ModifiableScheduledTaskFile - find schtasks with modifiable target files

‎Tests/Privesc.tests.ps1

+16-16
Original file line numberDiff line numberDiff line change
@@ -873,10 +873,10 @@ Describe 'Find-ProcessDLLHijack' {
873873
}
874874

875875

876-
Describe 'Find-PathHijack' {
876+
Describe 'Find-PathDLLHijack' {
877877

878878
if(-not $(Test-IsAdmin)) {
879-
Throw "'Find-PathHijack' Pester test needs local administrator privileges."
879+
Throw "'Find-PathDLLHijack' Pester test needs local administrator privileges."
880880
}
881881

882882
It 'Should find a hijackable %PATH% folder.' {
@@ -887,22 +887,22 @@ Describe 'Find-PathHijack' {
887887
$OldPath = $Env:PATH
888888
$Env:PATH += ';C:\PowerUpTest\'
889889

890-
$Output = Find-PathHijack | Where-Object {$_.Path -like "*PowerUpTest*"} | Select-Object -First 1
890+
$Output = Find-PathDLLHijack | Where-Object {$_.Path -like "*PowerUpTest*"} | Select-Object -First 1
891891

892892
$Env:PATH = $OldPath
893893

894894
$Output.Path | Should Be 'C:\PowerUpTest\'
895895

896896
if ($Output.PSObject.Properties.Name -notcontains 'Path') {
897-
Throw "Find-PathHijack result doesn't contain 'Path' field."
897+
Throw "Find-PathDLLHijack result doesn't contain 'Path' field."
898898
}
899899

900900
if ($Output.PSObject.Properties.Name -notcontains 'Permissions') {
901-
Throw "Find-PathHijack result doesn't contain 'Permissions' field."
901+
Throw "Find-PathDLLHijack result doesn't contain 'Permissions' field."
902902
}
903903

904904
if ($Output.PSObject.Properties.Name -notcontains 'IdentityReference') {
905-
Throw "Find-PathHijack result doesn't contain 'IdentityReference' field."
905+
Throw "Find-PathDLLHijack result doesn't contain 'IdentityReference' field."
906906
}
907907
}
908908
catch {
@@ -952,14 +952,14 @@ Describe 'Get-RegistryAutoLogon' {
952952
}
953953

954954

955-
Describe 'Get-RegistryAutoRun' {
955+
Describe 'Get-ModifiableRegistryAutoRun' {
956956

957957
if(-not $(Test-IsAdmin)) {
958-
Throw "'Get-RegistryAutoRun' Pester test needs local administrator privileges."
958+
Throw "'Get-ModifiableRegistryAutoRun' Pester test needs local administrator privileges."
959959
}
960960

961961
It 'Should not throw.' {
962-
{Get-RegistryAutoRun} | Should Not Throw
962+
{Get-ModifiableRegistryAutoRun} | Should Not Throw
963963
}
964964

965965
It 'Should find a vulnerable autorun.' {
@@ -968,28 +968,28 @@ Describe 'Get-RegistryAutoRun' {
968968
$Null | Out-File -FilePath $FilePath -Force
969969
$Null = Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name PowerUp -Value "vuln.exe -i '$FilePath'"
970970

971-
$Output = Get-RegistryAutoRun | Where-Object {$_.Path -like "*$FilePath*"} | Select-Object -First 1
971+
$Output = Get-ModifiableRegistryAutoRun | Where-Object {$_.Path -like "*$FilePath*"} | Select-Object -First 1
972972

973973
$Output.ModifiableFile.Path | Should Be $FilePath
974974

975975
if ($Output.PSObject.Properties.Name -notcontains 'Key') {
976-
Throw "Get-RegistryAutoRun result doesn't contain 'Key' field."
976+
Throw "Get-ModifiableRegistryAutoRun result doesn't contain 'Key' field."
977977
}
978978
if ($Output.PSObject.Properties.Name -notcontains 'Path') {
979-
Throw "Get-RegistryAutoRun result doesn't contain 'Path' field."
979+
Throw "Get-ModifiableRegistryAutoRun result doesn't contain 'Path' field."
980980
}
981981
if ($Output.PSObject.Properties.Name -notcontains 'ModifiableFile') {
982-
Throw "Get-RegistryAutoRun result doesn't contain 'ModifiableFile' field."
982+
Throw "Get-ModifiableRegistryAutoRun result doesn't contain 'ModifiableFile' field."
983983
}
984984

985985
if ($Output.ModifiableFile.PSObject.Properties.Name -notcontains 'Path') {
986-
Throw "Get-RegistryAutoRun ModifiableFile result doesn't contain 'Path' field."
986+
Throw "Get-ModifiableRegistryAutoRun ModifiableFile result doesn't contain 'Path' field."
987987
}
988988
if ($Output.ModifiableFile.PSObject.Properties.Name -notcontains 'Permissions') {
989-
Throw "Get-RegistryAutoRun ModifiableFile result doesn't contain 'Permissions' field."
989+
Throw "Get-ModifiableRegistryAutoRun ModifiableFile result doesn't contain 'Permissions' field."
990990
}
991991
if ($Output.ModifiableFile.PSObject.Properties.Name -notcontains 'IdentityReference') {
992-
Throw "Get-RegistryAutoRun ModifiableFile result doesn't contain 'IdentityReference' field."
992+
Throw "Get-ModifiableRegistryAutoRun ModifiableFile result doesn't contain 'IdentityReference' field."
993993
}
994994

995995
$Null = Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name PowerUp

0 commit comments

Comments
 (0)