# Windows RID Hijacking with Empire

## Module Testing
The module `Invoke-RIDHijacking` is compatible with Powershell >=2.0. It requires a previous agent with administrative privileges. 

This module has been tested against:

- Windows XP, 2003. (32 bits)
- Windows 8.1 Pro. (64 bits)
- Windows 10. (64 bits)
- Windows Server 2012. (64 bits)

## Execution

![12](https://user-images.githubusercontent.com/14118912/52924244-efa00d00-32f9-11e9-9810-95a687393fd9.png)

## References
https://github.com/r4wd3r/RID-Hijacking

https://r4wsecurity.blogspot.com/2017/12/rid-hijacking-maintaining-access-on.html

https://r4wsec.com/notes/rid_hijacking/
