Merge pull request #148 from PowerShellMafia/powerup_psreflect

PowerUp PSReflect

1 files changed, 30 insertions, 23 deletions

diff --git a/Privesc/README.md b/Privesc/README.md
index bb68a43..7f57768 100644
--- a/Privesc/README.md
+++ b/Privesc/README.md
@@ -28,32 +28,39 @@ Optional Dependencies: None
 
 
 ### Service Enumeration:
-    Get-ServiceUnquoted             -   returns services with unquoted paths that also have a space in the name
-    Get-ServiceFilePermission       -   returns services where the current user can write to the service binary path or its config
-    Get-ServicePermission           -   returns services the current user can modify
-    Get-ServiceDetail               -   returns detailed information about a specified service
+    Get-ServiceUnquoted                 -   returns services with unquoted paths that also have a space in the name
+    Get-ModifiableServiceFile           -   returns services where the current user can write to the service binary path or its config
+    Get-ModifiableService               -   returns services the current user can modify
+    Get-ServiceDetail                   -   returns detailed information about a specified service
 
 ### Service Abuse:
-    Invoke-ServiceAbuse             -   modifies a vulnerable service to create a local admin or execute a custom command
-    Write-ServiceBinary             -   writes out a patched C# service binary that adds a local admin or executes a custom command
-    Install-ServiceBinary           -   replaces a service binary with one that adds a local admin or executes a custom command
-    Restore-ServiceBinary           -   restores a replaced service binary with the original executable
+    Invoke-ServiceAbuse                 -   modifies a vulnerable service to create a local admin or execute a custom command
+    Write-ServiceBinary                 -   writes out a patched C# service binary that adds a local admin or executes a custom command
+    Install-ServiceBinary               -   replaces a service binary with one that adds a local admin or executes a custom command
+    Restore-ServiceBinary               -   restores a replaced service binary with the original executable
 
 ### DLL Hijacking:
-    Find-DLLHijack                  -   finds .dll hijacking opportunities for currently running processes
-    Find-PathHijack                 -   finds service %PATH% .dll hijacking opportunities
-    Write-HijackDll                 -   writes out a hijackable .dll
+    Find-ProcessDLLHijack               -   finds potential DLL hijacking opportunities for currently running processes
+    Find-PathDLLHijack                  -   finds service %PATH% DLL hijacking opportunities
+    Write-HijackDll                     -   writes out a hijackable DLL
     
 ### Registry Checks:
-    Get-RegAlwaysInstallElevated    -   checks if the AlwaysInstallElevated registry key is set
-    Get-RegAutoLogon                -   checks for Autologon credentials in the registry
-    Get-VulnAutoRun                 -   checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns
-
-### Misc.:
-    Get-VulnSchTask                 -   find schtasks with modifiable target files
-    Get-UnattendedInstallFile       -   finds remaining unattended installation files
-    Get-Webconfig                   -   checks for any encrypted web.config strings
-    Get-ApplicationHost             -   checks for encrypted application pool and virtual directory passwords
-    Write-UserAddMSI                -   write out a MSI installer that prompts for a user to be added
-    Invoke-AllChecks                -   runs all current escalation checks and returns a report
-
+    Get-RegistryAlwaysInstallElevated   -  checks if the AlwaysInstallElevated registry key is set
+    Get-RegistryAutoLogon               -   checks for Autologon credentials in the registry
+    Get-ModifiableRegistryAutoRun       -   checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns
+
+### Miscellaneous Checks:
+    Get-ModifiableScheduledTaskFile     -   find schtasks with modifiable target files
+    Get-UnattendedInstallFile           -   finds remaining unattended installation files
+    Get-Webconfig                       -   checks for any encrypted web.config strings
+    Get-ApplicationHost                 -   checks for encrypted application pool and virtual directory passwords
+    Get-SiteListPassword                -   retrieves the plaintext passwords for any found McAfee's SiteList.xml files
+
+### Other Helpers/Meta-Functions:
+    Get-ModifiablePath                  -   tokenizes an input string and returns the files in it the current user can modify
+    Get-CurrentUserTokenGroupSid        -   returns all SIDs that the current user is a part of, whether they are disabled or not
+    Add-ServiceDacl                     -   adds a Dacl field to a service object returned by Get-Service
+    Set-ServiceBinPath                  -   sets the binary path for a service to a specified value through Win32 API methods
+    Test-ServiceDaclPermission          -   tests one or more passed services or service names against a given permission set
+    Write-UserAddMSI                    -   write out a MSI installer that prompts for a user to be added
+    Invoke-AllChecks                    -   runs all current escalation checks and returns a report