• Stars
    star
    331
  • Rank 127,323 (Top 3 %)
  • Language
    C
  • Created almost 2 years ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Abuse Impersonate Privilege from Service to SYSTEM like other potatoes do

RasmanPotato

Thanks to @Wh04m1001 for continuous communication over time

Just another potato like other potatoes, using RasMan service for privilege escalation

For Windows 10(11 not test), Windows Server 2012 - 2019(2022 not test)

Usage

magicRasMan v0.1
Provided that the current user has the SeImpersonate privilege, this tool will have an escalation to SYSTEM
Arguments:
 -c <CMD>       Execute the command *CMD*
 -m <METHOD>            Choose The RPC Function [1]VpnProtEngWinRtConnect [2]VpnProtEngGetInterface
 -i             Interact with the new process in the current command prompt (default is non-interactive)

Example

More Repositories

1

BypassUserAdd

通过反射DLL注入、Win API、C#、以及底层实现NetUserAdd方式实现BypassAV进行增加用户的功能,实现Cobalt Strike插件化
C++
271
star
2

Shellcode_Memory_Loader

基于Golang实现的Shellcode内存加载器,共实现3中内存加载shellcode方式,UUID加载,MAC加载和IPv4加载,目前能过主流杀软(包括Windows Defender)
Go
233
star
3

PetitPotam

替代PrintBug用于本地提权的新方式,主要利用MS-EFSR协议中的接口函数 借鉴了Potitpotam中对于EFSR协议的利用,实现了本地提权的一系列方式 Drawing on the use of the EFSR protocol in Potitpotam, a series of local rights escalation methods have been realized
C
140
star
4

PrintSpoofer

PrintSpoofer的反射dll实现,结合Cobalt Strike使用
C
76
star
5

net_memory_webshell

用来存放平时写的一些net内存马,仅用于练手,需要可以自行修改
C#
75
star
6

magicNetdefs

Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged processes to access malicious pipes for exploitation
C
50
star
7

Extracted_WD_VDM

Windows Defender VDM lua collections
Lua
39
star
8

goHashDumper

用于Dump指定进程的内存,主要利用静默退出机制(SilentProcessExit)和Windows API(MiniDumpW)实现
25
star
9

magicDiagTrack

DiagTrack Eop (From Service Account to SYSTEM)
C
20
star
10

magicAzureAttestService

针对于AzureAttestService服务的本地提权Eop,微软表示已经进行修复
C
19
star
11

sucksAV

This project used to learn golang and try to bypass AV
Go
18
star
12

Laravel_CVE-2021-3129_EXP

Python
17
star
13

ProcessPlayer

一些进程注入或者Shellcode注入的实例代码,用于练习和熟悉
C
17
star
14

listTokeninfoByPipe

用于列出基于管道模拟RPC客户端获得令牌时的令牌详细信息和通过转化为主令牌从而执行创建进程等相关操作
C++
6
star
15

crisprss

1
star
16

wikicrawl

Python
1
star
17

crisprss.github.io

HTML
1
star
18

csdn_crawl

Python
1
star
19

token_vault

Used to be familiar with and understand the related mechanism of Token in Windows
Rust
1
star
20

zhipinspider

Python
1
star
21

CVEs

List for some of my cves
1
star
22

ProcessMonitor

ProcessMonitor
C++
1
star