Mr.Combet Webshell 🔥

Mr.Combet Webshell

Your IP : 216.73.216.136

Server IP : 103.233.58.157

Server : Windows NT WIN-4PGF72KEHKB 10.0 build 17763 (Windows Server 2016) AMD64

Server Software : Microsoft-IIS/10.0

PHP Version : 7.3.25

Add File : Submit

Add Directory : Submit

Dir : C:/Windows/diagnostics/system/Apps/

Edit File Name : VF_UAC.ps1

#====================================================================================
# Initialize
#====================================================================================
PARAM($uacConsent)

#====================================================================================
# Main
#====================================================================================

# Verifying root cause only if user choose to enable UAC with default settings.
if($uacConsent -eq $true)
{
	$detected = $true
	$uacAdminValue = Get-ItemProperty 'registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -ErrorAction SilentlyContinue
	$uacSecureDesktopValue = Get-ItemProperty 'registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'PromptOnSecureDesktop' -ErrorAction SilentlyContinue
	$uacEnableLUAValue = Get-ItemProperty 'registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -ErrorAction SilentlyContinue

# Check for the ConsentPromptBehaviorAdmin value
	$detected = ($uacAdminValue.ConsentPromptBehaviorAdmin -eq 0) -or ($uacSecureDesktopValue.PromptOnSecureDesktop -eq 0)-or ($uacEnableLUAValue.EnableLUA -eq 0)

Update-DiagRootCause -Id 'RC_UAC' -Detected $detected -Parameter @{'uacConsent' = $uacConsent}
}