CatalogWADComs

WAD · Tool

Seatbelt

1 techniqueWindowsWADComsGPL-3.0

Privilege Escalation

Privilege EscalationPersistenceWindows

Seatbelt.exe is part of the GhostPack suite of tools that will perform a lot of "safety checks" on the Windows host and collect system data that could be useful for potential privilege escalation or persistence methods. The following command will run all checks on the system and store the output in a file (WARNING: will collect a lot of data. remove `-full` for less output). Command Reference: Run all checks: -group=all Output File: output.txt

Seatbelt.exe -group=all -full > output.txt
Evidence
Upstream reference
Environment
Local host
Native
PrivEsc, Persistence
Requires
Shell