# Windows RID Hijacking with ibombshell

## Module Testing
The module `Invoke-RIDHijacking` is compatible with Powershell >=2.0. It requires a previous agent with administrative privileges. 

This module has been tested against:

- Windows XP, 2003. (32 bits)
- Windows 8.1 Pro. (64 bits)
- Windows 10. (64 bits)
- Windows Server 2012. (64 bits)

## Execution

### Module options:

![ibomb1](https://user-images.githubusercontent.com/14118912/53123310-c1ebdb80-3526-11e9-8e77-f685bc10e461.PNG)


### Module execution with built-in guest account and -Silently option:

![ibomb2](https://user-images.githubusercontent.com/14118912/53123324-c87a5300-3526-11e9-8c56-3378320f6d15.PNG)



## References
https://github.com/r4wd3r/RID-Hijacking

https://r4wsecurity.blogspot.com/2017/12/rid-hijacking-maintaining-access-on.html

https://r4wsec.com/notes/rid_hijacking/
