Skip to content

Commit

Permalink
Update Local Privilege Escalation.md
Browse files Browse the repository at this point in the history
  • Loading branch information
@Mr-xn
Mr-xn authored Oct 4, 2019
1 parent edcf37a commit 4445b71
Showing 1 changed file with 16 additions and 15 deletions.
31 changes: 16 additions & 15 deletions tools/Local Privilege Escalation.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,10 @@
### windows 溢出提权小记

#### 0x01 前言
平时用的相对比较多,就顺手自己记录了一份,不大完整,关键是大家能用上就好,都是一些已知的windows 0day exp,关于各个漏洞的详情,请自行查阅微软安全公告,链接如下

`https://technet.microsoft.com/zh-cn/library/security/dn639106.aspx`
```
平时用的相对比较多,就顺手自己记录了一份,不大完整,关键是大家能用上就好,都是一些已知的windows 0day exp,关于各个漏洞的详情,请自行查阅微软安全公告,链接如下:
https://technet.microsoft.com/zh-cn/library/security/dn639106.aspx
```
#### 0x02 具体exp利用如下
Expand All @@ -34,7 +35,7 @@ exp 用途: IIS 5.x ,6.x 本地提权
适应平台: 只针对 iis5.x 6.x,菜刀可用
```
![](../img/IIS 5 6.jpg)
![](../img/IIS%205%206.jpg)
***
```
常规内核级漏洞
Expand All @@ -54,9 +55,9 @@ exp 用途: 本地提权
```
***
![](../img/ms10 048 x86_1.jpg)
![](../img/ms10%20048%20x86_1.jpg)
***
![](../img/ms10 048 x86_2.jpg)
![](../img/ms10%20048%20x86_2.jpg)
***
```
Expand All @@ -67,7 +68,7 @@ exp 用途: 本地提权
适应平台: 03(32)菜刀可用,08以后可能不太好使,应该是exp兼容性的原因
```
***
![](../img/ms 11 046.jpg)
![](../img/ms%2011%20046.jpg)
***
Expand All @@ -87,7 +88,7 @@ exp 用途: 本地提权
适应平台: 08 r2 64位本地测试成功,只适合win7 or 2008,有可能会蓝屏,exp不太稳定
```
***
![](../img/ms12 042.jpg)
![](../img/ms12%20042.jpg)
***
Expand All @@ -109,7 +110,7 @@ exp 用途: 本地提权
```
***
![](../img/ms13 053.jpg)
![](../img/ms13%20053.jpg)
***
Expand All @@ -121,7 +122,7 @@ exp 用途: 本地提权
适应平台: 08 以后的系统基本都可以,exp写的很不错,成功率非常高
```
***
![](../img/ms13 053.jpg)
![](../img/ms13%20053.jpg)
***
Expand Down Expand Up @@ -154,7 +155,7 @@ exp 用途: 本地提权
***
![](../img/ms 15 051.jpg)
![](../img/ms 15%20051.jpg)
***
Expand All @@ -166,7 +167,7 @@ exp 用途: 字体提权
适应平台: 可能该exp 32位系统好使,64位均未成功
```
***
![](../img/ms 15 077.jpg)
![](../img/ms 15%20077.jpg)
***
Expand Down Expand Up @@ -196,7 +197,7 @@ exp 用途: 本地提权
***
![](../img/ms16 014.jpg)
![](../img/ms16%20014.jpg)
***
Expand All @@ -219,10 +220,10 @@ exp 用途: powershell本地提权
powershell -nop -exec bypass -c "& {Import-Module 'c:\Invoke-MS16-032.ps1';Invoke-MS16-032 -Application cmd.exe -commandline '/c net user HELPS$ amin!@#45 /add'}"
```
***
![](../img/ms16 032 _1.jpg)
![](../img/ms16%20032%20_1.jpg)
***
![](../img/ms16 032 _2.jpg)
![](../img/ms16%20032%20_2.jpg)
***
Expand Down

0 comments on commit 4445b71

Please sign in to comment.