search

Metasploit Modules

useful metasploit modules for privilege escalation

hashtag
Windows Gather Privileges

This module will print if UAC is enabled, and if the current account is ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status and current process PRIVILEGES.

hashtag
Bypassuac

You can use one of the following modules to perform UAC bypass

msf5 > search bypassuac 

Matching Modules 
================ 
   #   Name                                                   Disclosure Date  Rank       Check  Description 
   -   ----                                                   ---------------  ----       -----  ----------- 
   0   exploit/windows/local/bypassuac                        2010-12-31       excellent  No     Windows Escalate UAC Protection Bypass 
   1   exploit/windows/local/bypassuac_comhijack              1900-01-01       excellent  Yes    Windows Escalate UAC Protection Bypass (Via COM Handler Hijack) 
   2   exploit/windows/local/bypassuac_eventvwr               2016-08-15       excellent  Yes    Windows Escalate UAC Protection Bypass (Via Eventvwr Registry Key) 
   3   exploit/windows/local/bypassuac_fodhelper              2017-05-12       excellent  Yes    Windows UAC Protection Bypass (Via FodHelper Registry Key) 
   4   exploit/windows/local/bypassuac_injection              2010-12-31       excellent  No     Windows Escalate UAC Protection Bypass (In Memory Injection) 
   5   exploit/windows/local/bypassuac_injection_winsxs       2017-04-06       excellent  No     Windows Escalate UAC Protection Bypass (In Memory Injection) abusing WinSXS 
   6   exploit/windows/local/bypassuac_silentcleanup          2019-02-24       excellent  No     Windows Escalate UAC Protection Bypass (Via SilentCleanup) 
   7   exploit/windows/local/bypassuac_sluihijack             2018-01-15       excellent  Yes    Windows UAC Protection Bypass (Via Slui File Handler Hijack) 
   8   exploit/windows/local/bypassuac_vbs                    2015-08-22       excellent  No     Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability) 
   9   exploit/windows/local/bypassuac_windows_store_filesys  2019-08-22       manual     Yes    Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe) 
   10  exploit/windows/local/bypassuac_windows_store_reg      2019-02-19       manual     Yes    Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe) and Registry

Example:

hashtag
Gather installed applications

hashtag
credential_collector

The credential_collector module harvests passwords hashes and tokens on the compromised host.

Example:

hashtag
Enum shares

The enum_shares post module returns a listing of both configured and recently used shares on the compromised system.

Example:

hashtag
Check if it's a VM

hashtag
Local_exploit_suggester

Metasploit has a nice module to check for local exploits:

hashtag
Weak service permissions

exploit/windows/local/service_permissions

hashtag
GPP

Decrypting passwords that are stored in the Group Policy Preferences can be done automatically though Metaasploit. The following post exploitation module will obtain and decrypt the cPassword from the Groups.xml file which is stored in the SYSVOL.

post/windows/gather/credentials/gpp

PreviousAutomated toolsNextPassword Dumping

Last updated