mirror of
https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook
synced 2026-06-08 16:23:53 +00:00
Edit DLL Hijacking
This commit is contained in:
@@ -1,4 +1,3 @@
|
||||
Monitor_AMD64.exe D7CD130E242A2CEFCC33A8F8529DDDA7
|
||||
NCV_AMD64.exe 21A208E615C77D2CA3B2C16C86851A0F
|
||||
Service 1.exe AD78384BB3D30A47E32B7080D24B332C
|
||||
Service2.exe 936D5F332168C263C1B43DCF24350438
|
||||
|
||||
Binary file not shown.
@@ -1,58 +0,0 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
class Program
|
||||
{
|
||||
static void Main(string[] args)
|
||||
{
|
||||
string filename = "process_log.txt";
|
||||
string tempfilename = "temp_process_log.txt";
|
||||
|
||||
// Open file for appending
|
||||
StreamWriter fptr;
|
||||
try
|
||||
{
|
||||
fptr = File.AppendText(filename);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine("Cannot open file: " + e.Message);
|
||||
return;
|
||||
}
|
||||
|
||||
// Get current time
|
||||
DateTime now = DateTime.Now;
|
||||
|
||||
// Write timestamp to the file
|
||||
fptr.WriteLine("\nList of processes on the system");
|
||||
fptr.WriteLine("Timestamp: " + now.ToString());
|
||||
|
||||
// Run system command to get all processes and save in a temporary file
|
||||
System.Diagnostics.Process.Start("CMD.exe", "/C tasklist > temp_process_log.txt").WaitForExit();
|
||||
|
||||
// Append contents of temporary file to the log file
|
||||
try
|
||||
{
|
||||
using (StreamReader tempfptr = new StreamReader(tempfilename))
|
||||
{
|
||||
string line;
|
||||
while ((line = tempfptr.ReadLine()) != null)
|
||||
{
|
||||
fptr.WriteLine(line);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine("Cannot open temporary file: " + e.Message);
|
||||
return;
|
||||
}
|
||||
|
||||
File.Delete(tempfilename);
|
||||
|
||||
// Close file
|
||||
fptr.Close();
|
||||
|
||||
Console.WriteLine("Data appended to " + filename);
|
||||
}
|
||||
}
|
||||
@@ -58,7 +58,6 @@ This Cookbook presents the following Windows vulnerabilities:
|
||||
- [SeBackupPrivilege](/Notes/SeBackupPrivilege.md)
|
||||
- [SeImpersonatePrivilege](/Notes/SeImpersonatePrivilege.md)
|
||||
- [Stored Credentials (Runas)](/Notes/StoredCredentialsRunas.md)
|
||||
- Scheduled Task/Job
|
||||
- [UAC Bypass](/Notes/UACBypass.md)
|
||||
- [Unquoted Service Path](/Notes/UnquotedServicePath.md)
|
||||
- [Weak Service Binary Permissions](/Notes/WeakServiceBinaryPermissions.md)
|
||||
|
||||
Reference in New Issue
Block a user