adityatelange / adityatelange/evil-winrm-py
[FEATURE] interactive logon type execution
- 主要语言
- Python
- 星标
- 396
- 派生
- 37
- PR 合并指标
- 30 天内没有已合并 PR
描述
Because we are using WinRM we have a "network" logon type which has less permissions than an "interactive" logon type. "interactive" logon type is particularly useful when using COM objects to privesc as the "NT authority\Interactive" group has much more permissions on COM objects than "NT authority\Network" but "interactive" is also useful for a lot of other purposes.
To give a concrete example, in order to display all sessions on the current machine the easiest is to run it with [RunasCs.exe](https://github.com/antonioCoco/RunasCs) like this:
```evil-winrm-py PS[...]> .\RunasCs.exe x x -l 9 "qwinsta"```
Which calls CreateProcessWithLogonW with the LOGON_NETCREDENTIALS_ONLY behind the hood. Or if plaintext password has been provided to evil-winrm-py it's even better as it would allow to have an interactive session working also for network operations such as ldap, etc (I don't think a krb key, ticket or nt hash can be used to get an interactive process).
So I was thinking about having a builtin command for it like below:
```
$ evil-winrm-py -i 192.168.100.10 -u john -p 'password'
evil-winrm-py PS[...]> interactive
evil-winrm-py PS-interactive [...]> qwinsta
evil-winrm-py PS-interactive [...]> ([ADSI]"").distinguishedName
evil-winrm-py PS-interactive[...]> exit
evil-winrm-py PS [...]>
$ evil-winrm-py -i 192.168.100.10 -u john -H 'somehash'
evil-winrm-py PS[...]> interactive
[!] password plaintext not provided, network ops won't work
evil-winrm-py PS-netonly [...]> qwinsta
evil-winrm-py PS-netonly [...]> ([ADSI]"").distinguishedName
< SOME ERROR MSG CAUSE DUMMY CREDS>
evil-winrm-py PS-netonly[...]> exit
evil-winrm-py PS [...]>
```
贡献指南
这个仓库没有索引到贡献指南
调研方向
Start by tracing the CLI's session creation and existing WinRM logon path; the issue provides no file or test names. Done should include an interactive command that changes the prompt, supports commands such as qwinsta and ADSI operations when a plaintext password is available, warns for hash-only authentication, and returns to the original session after exit.
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- cli, security
- Issue 类型
- 功能
- 难度
- 5/5
- 预计耗时
- 一周以上
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100