LaunchSystemCmd
LaunchSystemCmd copied to clipboard
Published
20 hours ago •
yanghaoi
yanghaoi
在权限足够的情况下弹出system权限的cmd命令行，包含exe和dll两种文件类型，可用于一些可能存在本地提权漏洞的测试。
LaunchSystemCmdExe
launch a cmd.exe process with system permissions.
launch cmd.exe in Session 0
WTSGetActiveConsoleSessionId() / ProcessIdToSessionId() / DuplicateTokenEx() / WTSEnumerateSessions() / CreateProcessAsUser()
Injetc session>0(gui system process)
ZwCreateThreadEx() / CreateRemoteThread()
Set Parent
CreateProcessA()
GIF Show
LaunchSystemCmdDll
System Process Dll Hijack Test :) , Command line:
rundll32 LaunchSystemCmdDll.dll,Run
yanghaoi