StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

elevationstation

Elevation Station Stealing and Duplicating SYSTEM tokens for fun & profit! We duplicate things, make twin copies, and then ride away. You have used Metasploit's getsystem and SysInternals PSEXEC for getting system privs, correct? Well, here's a similar standalone version of that...but without the...

ATP-PowerShell-Scripts

ATP-PowerShell-Scripts Microsoft Signed PowerShell scripts List of all the signed scripts available in C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection Accessing the file By default the files cannot be accessed. You need the TrustedInstaller privilege...

Elevate-System-Trusted-BOF

Elevate-System-Trusted-BOF This BOF can be used to elevate the current beacon to SYSTEM and obtain the TrustedInstaller group privilege. The impersonation is done through the SetThreadToken API. Compiling gcc elevatex64.c -c -o elevatex64.o Usage inline-execute C:\elevatex64.o Credit Mr.Un1k0d3r...

elevationstation

Stazione di Elevazione Rubare e duplicare i token SYSTEM per divertimento e profitto! Duplichiamo le cose, creiamo copie gemelle, e poi ce ne andiamo in sella. Hai usato getsystem di Metasploit e PSEXEC di SysInternals per ottenere privilegi di sistema, vero? Bene, ecco una versione standalone...

trustme

trustme BOF to impersonate TrustedInstaller via DISM API trigger and thread impersonation. What this does Elevates a Cobalt Strike Beacon from an admin context to NT AUTHORITY\SYSTEM with the NT SERVICE\TrustedInstaller SID in the token groups. This gives you the ability to modify files, registry...