Author Archives: illwill

Powershell to exe using iexpress

By | | ,
1 Comment

Saw something on twitter today about using the old standby program, iexpress.exe, which is still available in Win10, you can package your powershell scripts inside an executable. You can use it to run malicious powershell scripts etc…
SO I was thinking of some fun things to do with it, getting reverse shells, dumping passwords with mimikatz, compiling .cs files etc to evade AV and whitelisting. It’s fairly simple to do ,here’s an example of a powershell reverse shell: Continue reading →

ms16-032 one-liners

By | | , ,
Leave a comment

I was playing around with box in my lab earlier testing out ms16-032, which is a privilege escalation exploit that got patched earlier this year that affected windows versions vista,2k8,7,8.1,2k12, and 10. It was a bug in the Secondary Logon service that allows you to leak a handle opened in a privileged process into a lower privileged process. @FuzzySec made a powershell script to exploit this that works really well, but I wanted to make it into as easy 1-liner to paste into a cmd prompt. Continue reading →

tricky.lnk – Unicode Text Spoofing

By | |
Leave a comment

Collaborative editing can quickly become a textual rap battle fought with increasingly convoluted invocations of U+202a to U+202e

Bidirectional Unicode spoofing is not a new concept, malware has been using the technique for the last decade, but I was toying around with unicode earlier today for a phishing engagement, by default Win7 doesn’t allow you to create filenames with unicode chars unless you:

    a. Open RegEdit
    b. Navigate to HKey_Current_User/Control Panel/Input Method
    c. Set REG_SZ “EnableHexNumpad” to be “1” (If there is no EnableHexNumpad, then add it and set its value to 1).
    d. Reboot your system.

I didnt want to do this so I created a .vbs script that creates a .lnk file that spoofs the file extension with Unicode chars. This allows you to reverse the “.lnk” file extension, append “.txt” to the end and change the icon to notepad.exe’s icon to make it appear as a text file. When executed, the Target payload is a powershell webdl and execute. Continue reading →

Pivoting through Tomcat

By | | , ,
Leave a comment

On a recent pen-test engagement we had come across a Tomcat server with default creds. Trying to old tried and true methods with Metasploit did not work to get a shell on the box , which was running proprietary IBM_AIX. The exploit would be successful but no connect-back. Because of the limited time instead of trying to test for egress (and later finding out theres no payloads for metasploit), we tried another method of uploading a JSP .war file to the box that once deployed, enabled us to browse and run commands. Continue reading →

How not to roll out a website

By | |
2 Comments

Prophets-616x420
I’m posting this now because the hosting company has seem to finally fix the issues, I tried emailing and tweeting to them but got no response from any of the parties.

A few weeks ago there was some buzz on Rage Against the Machine’s site: Rage Against the Machine, Public Enemy & Cypress Hill member were forming a supergroup called Prophets of Rage. On the day of announcement they posted a mysterious webpage with just a countdown clock, http://prophetsofrage.com . Continue reading →

SSH Tunneling RDP Using Putty

By | |
Leave a comment

Recently I was trying RDP from a Windows10 laptop through SSH on a Debian web-server to an internal Windows7 box that was on a different VLAN. I had only a Windows10 laptop with Putty to do it. So Basically Win10laptop>debianwebserver>win7through a secure ssh session and get to the internal Win7 without port forwarding on the router.

I had access to SSH account on the Debian web-server, so I was able to use this as a pivot point to get into the internal network. Luckily even though the Debian web-server and Win7 box were on different VLANs, the VLANs were able to talk to each other. The Debian web-server was on 10.0.10.21 , it could still ping Win7 on 192.168.0.146.

Just in case your head is spinning trying to read this, below is a diagram how I achieved this using Putty. Im posting it here so next time I need to do this I dont need to try to figure it out again.

SSH_Tunnel

Windows 10 RS1 14316

By | |
Leave a comment

The build brings new changes targeting previously exploited dll-hijacking and uac bypass method vulnerabilities.

cliconfg.exe – can no longer be used as target for autoelevation as MS changed it manifest to autoelevate=false.

mmc.exe – event viewer console fixed, dll hijacking no longer works.

fake IIS inetmgr.exe launch from inetsrv appinfo hardcoded directory fixed too – Windows will not allow you to run & autoelevate anything except legit InetMgr.exe from system32inetsrv directory.

Bypasses alot of the methods used by UACme that is posted in my ::Wiki::