1

can someone explain to me the difference between exe, exe-only, exe-service, exe-small   and msi, msi-nouac in msfvenom when generating payload for privilege escalation ?

thanks .

1 Answer 1

2

They are just different wrappers for Windows ShellCode:

  • exe : standard PE format for Windows
  • exe-only: not sure on this on, never used it...
  • exe-service: runs as a service instead of a process
  • exe-small: creates smallest version of ShellCode (may include bad chars). Used for tight buffers
  • msi: wraps an executable in an MSI for auto execution when run
  • msi-nouac: MSI with no UAC
4
  • Msi-nouac gives me SYSTEM in "always install elevated" exploitation for privilege escalation while msi gives me just user rights ,, so msi-nouac search for installation with system privilege ...it's not really goes with intuition Aug 16, 2016 at 20:32
  • Depending on the user access level (i.e. administrator), if UAC is disabled / DNE, it should spawn a shell as SYSTEM. What type of exploit are you using?
    – HashHazard
    Aug 16, 2016 at 22:44
  • MSI packages can be installed with elevated privileges for non-admin users. For a package to use elevated privileges the a registry name “AlwaysInstallElevated” must exist in both keys with a dword value of 1. we can abuse this setting to elevate our privilege but it works when I make a payload with -f msi-nouac if I use just -f msi it gives me the normal user right Aug 16, 2016 at 22:59
  • Ok now i see what you're trying to say, you're not triggering the payload through an exploit your running it standalone.
    – HashHazard
    Aug 17, 2016 at 0:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .