Get-System

SYNOPSIS

GetSystem functionality inspired by Meterpreter's getsystem. 'NamedPipe' impersonation doesn't need SeDebugPrivilege but does create a service, 'Token' duplications a SYSTEM token but needs SeDebugPrivilege. NOTE: if running PowerShell 2.0, start powershell.exe with '-STA' to ensure token duplication works correctly.

PowerSploit Function: Get-System Author: @harmj0y, @mattifestation License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None

SYNTAX

NamedPipe (Default)

Get-System [-Technique <String>] [-ServiceName <String>] [-PipeName <String>]

Token

Get-System [-Technique <String>]

RevToSelf

Get-System [-RevToSelf]

WhoAmI

Get-System [-WhoAmI]

DESCRIPTION

{{Fill in the Description}}

EXAMPLES

-------------------------- EXAMPLE 1 --------------------------

Get-System

Uses named impersonate to elevate the current thread token to SYSTEM.

-------------------------- EXAMPLE 2 --------------------------

Get-System -ServiceName 'PrivescSvc' -PipeName 'secret'

Uses named impersonate to elevate the current thread token to SYSTEM with a custom service and pipe name.

-------------------------- EXAMPLE 3 --------------------------

Get-System -Technique Token

Uses token duplication to elevate the current thread token to SYSTEM.

-------------------------- EXAMPLE 4 --------------------------

Get-System -WhoAmI

Displays the credentials for the current thread.

-------------------------- EXAMPLE 5 --------------------------

Get-System -RevToSelf

Reverts the current thread privileges.

PARAMETERS

-Technique

The technique to use, 'NamedPipe' or 'Token'.

Type: String
Parameter Sets: NamedPipe, Token
Aliases: 

Required: False
Position: Named
Default value: NamedPipe
Accept pipeline input: False
Accept wildcard characters: False

-ServiceName

The name of the service used with named pipe impersonation, defaults to 'TestSVC'.

Type: String
Parameter Sets: NamedPipe
Aliases: 

Required: False
Position: Named
Default value: TestSVC
Accept pipeline input: False
Accept wildcard characters: False

-PipeName

The name of the named pipe used with named pipe impersonation, defaults to 'TestSVC'.

Type: String
Parameter Sets: NamedPipe
Aliases: 

Required: False
Position: Named
Default value: TestSVC
Accept pipeline input: False
Accept wildcard characters: False

-RevToSelf

Reverts the current thread privileges.

Type: SwitchParameter
Parameter Sets: RevToSelf
Aliases: 

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhoAmI

Switch. Display the credentials for the current PowerShell thread.

Type: SwitchParameter
Parameter Sets: WhoAmI
Aliases: 

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False