search

PowerShellEmpire / PowerTools

PowerTools is a collection of PowerShell projects with a focus on offensive operations.
Other
2.05k stars 811 forks source link

Invoke-FindDLLHijack - Differentiate between System and current user's path #23

Open leechristensen opened 9 years ago

leechristensen commented 9 years ago

Currently, Invoke-FindDLLHijack does not differentiate between directories in the System path and directories in the current user's path. It'd be nice to be able to quickly determine if the hijack-able location is only in the current user's path since it affects whether or not the directory can be used for local privilege escalation.

HarmJ0y commented 9 years ago

There is a -ExcludeWindows flag as well as -ExcludeProgramFiles flag which will exclude all paths found from C:\Windows, C:\Program Files and C:\Program Files (x86)* . Are you thinking of a flag that filters just for the current user's directory path?

leechristensen commented 9 years ago

Not necessarily a filter, just a way to differentiate between writable directories in the current user's path(HKCU\Environment\PATH) and the system path(HKLM\System\ControlSet001\Control\Session Manager\Environment\Path?). Only writable directories in the SYSTEM path can be used for local privilege escalation, whereas writable directories in the current user's path can potentially be used for persistence or horizontal privilege escalation (but not local privilege escalation).

HarmJ0y commented 9 years ago

Cool, will check back into this shortly!