Running Implants

In this case, the bypassuac_eventvwr implant is used for escalating the privileges from ring 3 (user land privs) to SYSTEM. To use an implant, you can execute the following command:

use implant/elevate/bypassuac_eventvwr 

The option is changed from stager to the implant now and just like we did it when configuring the stager, we need to configure the implant before executing it.

We can find the options by executing the following command:

Info 

This will show two options that need to be configured for a successful implant execution: PAYLOAD and ZOMBIE. To set up the payload, execute the following command:

set payload 0  

Get Hands-On Red Team Tactics now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.