From 3c5fea3719b0bcae48165ff75a6b973c3f23c562 Mon Sep 17 00:00:00 2001
From: Bubbl3H3d <31154539+Bubbl3H3d@users.noreply.github.com>
Date: Sun, 1 Oct 2017 14:51:11 -0400
Subject: [PATCH] PowerUp.ps1:2466 - Check SystemPath only

The current instantiation of code calls the %PATH% environment variable. However, since PowerUp is normally run with the permissions of an unprivileged crappy user in order to privesc, the %PATH% variable is returned as a concatenation of the SystemPath and UserPath. Any exploitable services running as SYSTEM will not call DLLs from the UserPath. Thus, we need to focus on writable folders in the SystemPath only in order to privesc. The proposed change pulls the SystemPath value directly from the registry and places it in the same format as the original code.
---
 Privesc/PowerUp.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Privesc/PowerUp.ps1 b/Privesc/PowerUp.ps1
index 072b03e6..9f62e85c 100644
--- a/Privesc/PowerUp.ps1
+++ b/Privesc/PowerUp.ps1
@@ -2463,7 +2463,7 @@ function Find-PathDLLHijack {
     Param()
 
     # use -LiteralPaths so the spaces in %PATH% folders are not tokenized
-    Get-Item Env:Path | Select-Object -ExpandProperty Value | ForEach-Object { $_.split(';') } | Where-Object {$_ -and ($_ -ne '')} | ForEach-Object {
+     (get-itemproperty "HKLM:\System\CurrentControlSet\Control\Session Manager\Environment").path.split(';') | ForEach-Object {
         $TargetPath = $_
 
         $ModifidablePaths = $TargetPath | Get-ModifiablePath -LiteralPaths | Where-Object {$_ -and ($_ -ne $Null) -and ($_.ModifiablePath -ne $Null) -and ($_.ModifiablePath.Trim() -ne '')}