Vault_Beyond

Beyond

---

This is the beyond page that an additional post enumeration and assessment are conducted as SYSTEM after compromising the target system.

GPO

---

Default Domain Policy: Delegation is set to the anirudh user

The task created by thepyGPOAbuse can be seen Literally ANYTHING can be done through GPO as it affects the entire domain Any form of Write access to Default Domain Policy basically means a complete domain compromise

Scheduled Tasks

---

• Killexplorer
• ShareCheck

Killexplorer Task

---

Every 5 minutes, executing powershell.exe C:\Users\anirudh\KillExplorer.ps1

C:\Users\anirudh\KillExplorer.ps1

---

PS C:\Windows\system32> cat C:\Users\anirudh\KillExplorer.ps1
$shell=New-Object -ComObject Shell.Application
$window = $shell.Windows() | Where-Object { $_.LocationURL -like "$(([uri]"C:\DocumentsShare").AbsoluteUri)*" }
$window | ForEach-Object { $_.Quit() }

This just kills the explorer process created by the ShareCheck task below

ShareCheck Task

---

Every minute, executing explorer.exe "C:\DocumentsShare"