winpeas fix

2022-03-07 22:49:35 +00:00 · 2022-03-07 22:49:35 +00:00 · 09312c6883
commit 09312c6883
parent b6bf6a702a
9 changed files with 289 additions and 91 deletions
--- a/build_lists/sensitive_files.yaml
+++ b/build_lists/sensitive_files.yaml
@ -92,7 +92,9 @@ cap_setgid_markup: "peass{CAP_SETGID_HERE}"
 les_markup: "peass{LES}"
 les2_markup: "peass{LES2}"

-
+fat_linpeas_amicontained_markup: "peass{AMICONTAINED}"
+fat_linpeas_gitleaks_linux_markup: "peass{GITLEAKS_LINUX}"
+fat_linpeas_gitleaks_macos_markup: "peass{GITLEAKS_MACOS}"

 ##############################
 ## AUTO GENERATED VARIABLES ##
@ -118,7 +120,7 @@ defaults:
  check_extra_path: ""        #Check if the found files are in a specific path (only linpeas)
  good_regex: ""              #The regex to color green
  just_list_file: False       #Just mention the path to the file, do not cat it
-  line_grep: ""               #The regex to grep lines in a file. IMPORTANT: This is the argument for "grep" command so you need to specify the single and double quotes (see examples)
+  line_grep: ""               #The regex to grep lines in a file. IMPORTANT: This is the argument for "grep" command so you need to specify the single and double quotes (see examples). USE douable quotes for the final regex and single quotes for everything, winpeas search things inside the double quotes only!
  only_bad_lines: False       #Only print lines containing something red (cnotaining bad_regex)
  remove_empty_lines: False   #Remove empty lines, use only for text files (-I param in grep)
  remove_path: ""             #Not interested in files containing this path (only linpeas)
@ -316,6 +318,24 @@ search:
                remove_path: "mysql/mysql"
                search_in: 
                  - common
+          
+          - name: "passwd.ibd"
+            value: 
+                type: f
+                search_in: 
+                  - common
+          
+          - name: "password*.ibd"
+            value: 
+                type: f
+                search_in: 
+                  - common
+          
+          - name: "pwd.ibd"
+            value: 
+                type: f
+                search_in: 
+                  - common

  - name: MariaDB
    value:
@ -383,15 +403,17 @@ search:
                search_in: 
                  - common
    
-  - name: Apache
+  - name: Apache-Nginx
    value:
        config:
            auto_check: True
            exec:
-            - 'echo "Version: $(warn_exec apache2 -v 2>/dev/null; warn_exec httpd -v 2>/dev/null)"'
+            - 'echo "Apache version: $(warn_exec apache2 -v 2>/dev/null; warn_exec httpd -v 2>/dev/null)"'
+            - 'echo "Nginx version: $(warn_exec nginx -v 2>/dev/null)"'
+            - if [ -d "/etc/apache2" ] && [ -r "/etc/apache2" ]; then 'grep -R -B1 "httpd-php" /etc/apache2 2>/dev/null'; fi
+            - if [ -d "/usr/share/nginx/modules" ] && [ -r "/usr/share/nginx/modules" ]; then print_3title 'Nginx modules'; ls /usr/share/nginx/modules | sed -${E} "s,$NGINX_KNOWN_MODULES,${SED_GREEN},g"; fi
            - "print_3title 'PHP exec extensions'"
-            - 'grep -R -B1 "httpd-php" /etc/apache2 2>/dev/null'
-    
+            
        files:
            - name: "sites-enabled"
              value: 
@ -399,8 +421,7 @@ search:
                files:
                    - name: "*"
                      value:
-                        bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias"
-                        only_bad_lines: True
+                        bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|command on"
                        remove_empty_lines: True
                        remove_regex: '#'
                search_in: 
@ -409,6 +430,7 @@ search:
            - name: "000-default.conf"
              value: 
                bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias"
+                remove_regex: '#'
                type: f
                search_in: 
                    - common
@ -417,7 +439,7 @@ search:
              value: 
                bad_regex: "On"
                remove_regex: "^;"
-                line_grep: "allow_"
+                line_grep: '"allow_"'
                type: f
                search_in: 
                    - common
@ -541,6 +563,7 @@ search:
          auto_check: True
          exec:
            - 'echo "Version: $(warn_exec mongo --version 2>/dev/null; warn_exec mongod --version 2>/dev/null)"'
+            - if [ "$(command -v mongo)" ]; then echo "show dbs" | mongo 127.0.0.1 > /dev/null 2>&1;[ "$?" == "0" ] && echo "Possible mongo anonymous authentication" | sed -${E} "s,.*|kube,${SED_RED},"; fi

        files:
          - name: "mongod*.conf"
@ -684,6 +707,34 @@ search:
                search_in: 
                  - /etc
  
+  - name: GlusterFS
+    value:
+        config:
+          auto_check: True
+
+        files:
+          - name: "glusterfs.pem"
+            value: 
+                type: f
+                just_list_file: True
+                search_in: 
+                  - common
+          
+          - name: "glusterfs.ca"
+            value: 
+                type: f
+                just_list_file: True
+                search_in: 
+                  - common
+          
+          - name: "glusterfs.key"
+            value: 
+                type: f
+                just_list_file: True
+                search_in: 
+                  - common
+  
+  
  - name: Anaconda ks
    value:
        config:
@ -721,31 +772,73 @@ search:
                search_in: 
                  - common

-  - name: Kubelet
+  - name: Kubernetes
    value:
        config:
          auto_check: True
+          exec:
+          - (env || set) | grep -Ei "kubernetes|kube" | grep -v "PSTORAGE_KUBERNETES|USEFUL_SOFTWARE" | sed -${E} "s,kubernetes|kube,${SED_RED},"

        files:
+          - name: "kubeconfig"
+            value:
+                bad_regex: "server:|cluster:|namespace:|user:|exec:"
+            type: d
+            search_in: 
+              - common
+          
+          - name: "kubelet-kubeconfig"
+            value:
+                bad_regex: "server:|cluster:|namespace:|user:|exec:"
+            type: d
+            search_in: 
+              - common
+            
+          - name: "psk.txt"
+            value:
+                remove_empty_lines: True
+                bad_regex: ".*"
+                type: f
+                search_in: 
+                  - common
+
+          - name: ".kube*"
+            value: 
+                files:
+                  - name: "config"
+                    value:
+                        bad_regex: "server:|cluster:|namespace:|user:|exec:"
+                type: d
+                search_in: 
+                  - common
+
          - name: "kubelet"
            value: 
                files:
-                  - name: "kubeconfig"
+                  - name: "kubelet.conf"
                    value:
                        bad_regex: "server:|cluster:|namespace:|user:|exec:"
+                  - name: "config.yaml"
+                    value:
+                        bad_regex: "server:|cluster:|namespace:|user:|exec:"
+                  - name: "kubeadm-flags.env"
+                    value:
+                        remove_empty_lines: True
                type: d
                search_in: 
                  - /var
          
          - name: "kube-proxy"
            value: 
-                files:
-                  - name: "kubeconfig"
-                    value:
-                        bad_regex: "cluster:|certificate-authority-data:|namespace:|user:|token:"
                type: d
                search_in: 
                  - /var
+          
+          - name: "kubernetes"
+            value: 
+                type: d
+                search_in: 
+                  - /etc
  
  - name: VNC
    value:
@ -766,6 +859,7 @@ search:
          - name: "*vnc*.c*nf*"
            value: 
                bad_regex: ".*"
+                remove_regex: '^#'
                type: f
                search_in: 
                  - common
@ -976,12 +1070,12 @@ search:
          auto_check: True

        files:
-          - name: "credentials"
-            value: 
-                bad_regex: ".*"
-                type: f
-                search_in: 
-                  - common
+          #- name: "credentials"
+          #  value: 
+          #      bad_regex: ".*"
+          #      type: f
+          #      search_in: 
+          #        - common
      
          - name: "credentials.db"
            value: 
@ -1530,6 +1624,37 @@ search:
                type: f
                search_in: 
                  - common
+          
+          - name: "dockershim.sock"
+            value: 
+                type: f
+                search_in: 
+                  - common
+          
+          - name: "containerd.sock"
+            value: 
+                type: f
+                search_in: 
+                  - common
+          
+          - name: "crio.sock"
+            value: 
+                type: f
+                search_in: 
+                  - common
+          
+          - name: "frakti.sock"
+            value: 
+                type: f
+                search_in: 
+                  - common
+          
+          - name: "rktlet.sock"
+            value: 
+                type: f
+                search_in: 
+                  - common
+

  - name: Firefox
    value:
@ -2582,7 +2707,7 @@ search:
                search_in: 
                  - common

-  - name: Other Interesting Files
+  - name: Other Interesting
    value:
        config:
          auto_check: True
@ -2651,7 +2776,7 @@ search:
                search_in: 
                  - common

-  - name: Windows Files
+  - name: Windows
    value:
        config:
          auto_check: True
@ -3000,7 +3125,7 @@ search:
                search_in:
                  - common

-  - name: Other Windows Files
+  - name: Other Windows
    value:
        config:
          auto_check: True
--- a/winPEAS/winPEASexe/winPEAS/Checks/Checks.cs
+++ b/winPEAS/winPEASexe/winPEAS/Checks/Checks.cs
@ -42,7 +42,7 @@ namespace winPEAS.Checks
        private static readonly HashSet<string> _systemCheckSelectedKeysHashSet = new HashSet<string>();

        // github url for Linpeas.sh
-        public static string LinpeasUrl = "https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh";
+        public static string LinpeasUrl = "https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh";

        public const string DefaultLogFile = "out.txt";

@ -80,7 +80,7 @@ namespace winPEAS.Checks
                new SystemCheck("windowscreds", new WindowsCreds()),
                new SystemCheck("browserinfo", new BrowserInfo()),
                new SystemCheck("filesinfo", new FilesInfo()),
-                new SystemCheck("fileAnalysis", new FileAnalysis())
+                new SystemCheck("fileanalysis", new FileAnalysis())
            };

            var systemCheckAllKeys = new HashSet<string>(_systemChecks.Select(i => i.Key));
--- a/winPEAS/winPEASexe/winPEAS/Checks/FileAnalysis.cs
+++ b/winPEAS/winPEASexe/winPEAS/Checks/FileAnalysis.cs
@ -53,7 +53,7 @@ namespace winPEAS.Checks
            }

            files.AddRange(SearchHelper.RootDirUsers);
-          //  files.AddRange(SearchHelper.RootDirCurrentUser); // not needed, it's contained within RootDirUsers
+            // files.AddRange(SearchHelper.RootDirCurrentUser); // not needed, it's contained within RootDirUsers
            files.AddRange(SearchHelper.DocumentsAndSettings);
            files.AddRange(SearchHelper.GroupPolicyHistory);    // TODO maybe not needed here
            files.AddRange(SearchHelper.ProgramFiles);
@ -62,7 +62,7 @@ namespace winPEAS.Checks
            return files;
        }

-        private static bool Search(List<CustomFileInfo> files, string fileName, FileSettings fileSettings, ref int resultsCount)
+        private static bool[] Search(List<CustomFileInfo> files, string fileName, FileSettings fileSettings, ref int resultsCount, string searchName, bool somethingFound)
        {
            bool isRegexSearch = fileName.Contains("*");
            string pattern = string.Empty;
@ -86,13 +86,18 @@ namespace winPEAS.Checks

                if (isFileFound)
                {
+                    if (!somethingFound) {
+                        Beaprint.MainPrint($"Found {searchName} Files");
+                        somethingFound = true;
+                    }
+
                    // there are no inner sections
                    if (fileSettings.files == null)
                    {
                        var isProcessed = ProcessResult(file, fileSettings, ref resultsCount);
                        if (!isProcessed)
                        {
-                            return true;
+                            return new bool[] { true, somethingFound };
                        }
                    }
                    // there are inner sections
@ -109,7 +114,7 @@ namespace winPEAS.Checks
                                var isProcessed = ProcessResult(innerFile, innerFileToSearch.value, ref resultsCount);
                                if (!isProcessed)
                                {
-                                    return true;
+                                    return new bool[] { true, somethingFound };
                                }
                            }
                        }
@ -117,7 +122,7 @@ namespace winPEAS.Checks
                }
            }

-            return false;
+            return new bool[] { false, somethingFound };
        }
       
        private static void PrintYAMLSearchFiles()
@ -133,15 +138,17 @@ namespace winPEAS.Checks

                foreach (var searchItem in searchItems)
                {
+                    if (searchItem.name != "Wifi Connections")
+                        continue;
                    var searchName = searchItem.name;
                    var value = searchItem.value;
                    var searchConfig = value.config;
+                    bool somethingFound = false;

                    CheckRunner.Run(() =>
                    {
-                        Beaprint.MainPrint($"Analyzing {searchName} Files (limit {ListFileLimit})");
-
                        int resultsCount = 0;
+                        bool[] results;
                        bool isSearchFinished = false;

                        foreach (var file in value.files)
@ -150,7 +157,10 @@ namespace winPEAS.Checks
                            var fileSettings = file.value;
                            var itemsToSearch = fileSettings.type == "f" ? files : folders;

-                            isSearchFinished = Search(itemsToSearch, fileName, fileSettings, ref resultsCount);
+                            results = Search(itemsToSearch, fileName, fileSettings, ref resultsCount, searchName, somethingFound);
+
+                            isSearchFinished = results[0];
+                            somethingFound = results[1];

                            if (isSearchFinished)
                            {
@ -193,18 +203,22 @@ namespace winPEAS.Checks

            if (fileSettings.type == "f")
            {
-                if ((bool)fileSettings.just_list_file)
-                {
-                    Beaprint.BadPrint($"    {fileInfo.FullPath}");
-                }
-                else
+                var colors = new Dictionary<string, string>();
+                colors.Add(fileInfo.Filename, Beaprint.ansi_color_bad);
+                Beaprint.AnsiPrint($"File: {fileInfo.FullPath}", colors);
+
+                if   (!(bool)fileSettings.just_list_file)
                {
                    GrepResult(fileInfo, fileSettings);
                }
            }
            else if (fileSettings.type == "d")
            {
-                // just list the directory 
+                var colors = new Dictionary<string, string>();
+                colors.Add(fileInfo.Filename, Beaprint.ansi_color_bad);
+                Beaprint.AnsiPrint($"Folder: {fileInfo.FullPath}", colors);
+
+                // just list the directory
                if ((bool)fileSettings.just_list_file)
                {
                    string[] files = Directory.GetFiles(fileInfo.FullPath, "*", SearchOption.TopDirectoryOnly);
@ -225,8 +239,6 @@ namespace winPEAS.Checks

        private static void GrepResult(CustomFileInfo fileInfo, FileSettings fileSettings)
        {
-            Beaprint.NoColorPrint($"    '{fileInfo.FullPath}' - content:");
-
            var fileContent = File.ReadLines(fileInfo.FullPath);
            var colors = new Dictionary<string, string>();

@ -272,7 +284,8 @@ namespace winPEAS.Checks

            Beaprint.AnsiPrint(content, colors);

-            Console.WriteLine();
+            if (content.Length > 0)
+                Console.WriteLine();
        }

        private static string SanitizeLineGrep(string lineGrep)
@ -281,7 +294,16 @@ namespace winPEAS.Checks
            // '-i -a -o "description.*" | sort | uniq'
            // - remove everything except from "description.*"

-            Regex regex = new Regex("\"([^\"]+)\"");
+            Regex regex;
+            if (lineGrep.Contains("-i"))
+            {
+                regex = new Regex("\"([^\"]+)\"", RegexOptions.IgnoreCase);
+            }
+            else
+            {
+                regex = new Regex("\"([^\"]+)\"");
+            }
+
            Match match = regex.Match(lineGrep);

            if (match.Success)
--- a/winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs
+++ b/winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs
@ -44,32 +44,31 @@ namespace winPEAS.Helpers
        public static void PrintBanner()
        {
            Console.WriteLine(BLUE + string.Format(@"     
-             {0}*((,.,/((((((((((((((((((((/,  */               
-      {0},/*,..*((((((((((((((((((((((((((((((((((,           
-    {0},*/((((((((((((((((((/,  .*//((//**, .*(((((((*       
-    {0}(((((((((((((((({2}**********/{1}########## {0}.(* ,(((((((   
-    {0}(((((((((((/{2}********************/{1}####### {0}.(. (((((((
-    {0}((((((..{2}******************{3}/@@@@@/{2}***/{1}###### {0}./(((((((
-    {0},,....{2}********************{3}@@@@@@@@@@{2}(***,{1}#### {0}.//((((((
-    {0}, ,..{2}********************{3}/@@@@@%@@@@{2}/********{1}##{0}((/ /((((
-    {0}..(({1}###########{2}*********{3}/%@@@@@@@@@{2}/************{0},,..((((
-    {0}.({1}##################(/{2}******{3}/@@@@@{2}/***************{0}.. /((
-    {0}.({1}#########################(/{2}**********************{0}..*((
-    {0}.({1}##############################(/{2}*****************{0}.,(((
-    {0}.({1}###################################(/{2}************{0}..(((
-    {0}.({1}#######################################({2}*********{0}..(((
-    {0}.({1}#######(,.***.,(###################(..***.{2}*******{0}..(((
-    {0}.({1}#######*(#####((##################((######/({2}*****{0}..(((
-    {0}.({1}###################(/***********(##############({0}...(((
-    {0}.(({1}#####################/*******(################{0}.((((((
-    {0}.((({1}############################################{0}(..((((
-    {0}..((({1}##########################################{0}(..(((((
-    {0}....(({1}########################################{0}( .(((((
-    {0}......(({1}####################################{0}( .((((((
-    {0}((((((((({1}#################################{0}(../((((((
-        {0}(((((((((/{1}##########################{0}(/..((((((
-              {0}(((((((((/,.  ,*//////*,. ./(((((((((((((((.
-                 {0}(((((((((((((((((((((((((((((/", LGREEN, GREEN, BLUE, NOCOLOR) + NOCOLOR);
+               {0}((((((((((((((((((((((((((((((((
+        {0}(((((((((((((((((((((((((((((((((((((((((((
+      {0}(((((((((((((({2}**********/{1}##########{0}.((((((((((((   
+    {0}(((((((((((/{2}********************/{1}#######{0}.((((((((((
+    {0}(((((((.{2}******************{3}/@@@@@/{0}{2}****{1}######{0}.(((((((((
+    {0}(((((.{2}********************{3}@@@@@@@@@@/{0}{2}***,{1}####{0}.(((((((((
+    {0}((((.{2}********************{3}/@@@@@%@@@@{0}{2}/********{1}##{0}(((((((((
+    {0}.(({1}############{2}*********{3}/%@@@@@@@@@{0}{2}/************{0}.(((((((
+    {0}.({1}##################(/{2}******{3}/@@@@@{0}{2}/***************{0}.(((((
+    {0}.({1}#########################(/{2}**********************{0}.((((
+    {0}.({1}##############################(/{2}*****************{0}.((((
+    {0}.({1}###################################(/{2}************{0}.((((
+    {0}.({1}#######################################({2}*********{0}.((((
+    {0}.({1}#######(,.***.,(###################(..***.{2}*******{0}.((((
+    {0}.({1}#######*(#####((##################((######/({2}*****{0}.((((
+    {0}.({1}###################(/***********(##############({0}).((((
+    {0}.(({1}#####################/*******(################{0})((((((
+    {0}.((({1}############################################{0}).(((((
+    {0}..((({1}##########################################{0}).((((((
+    {0}....(({1}########################################{0}).((((((
+    {0}......(({1}####################################{0}).(((((((
+    {0}((((((((({1}#################################{0}).((((((((
+        {0}(((((((((/{1}##########################{0}).((((((((
+              {0}((((((((((((((((((((((((((((((((((((((
+                 {0}((((((((((((((((((((((((((((((", LGREEN, GREEN, BLUE, NOCOLOR) + NOCOLOR);

            Console.WriteLine();
            Console.WriteLine(LYELLOW + "ADVISORY: " + BLUE + Advisory);
@ -136,7 +135,8 @@ namespace winPEAS.Helpers
            Console.WriteLine(LBLUE + "        networkinfo" + GRAY + "          Search network information" + NOCOLOR);
            Console.WriteLine(LBLUE + "        windowscreds" + GRAY + "         Search windows credentials" + NOCOLOR);
            Console.WriteLine(LBLUE + "        browserinfo" + GRAY + "          Search browser information" + NOCOLOR);
-            Console.WriteLine(LBLUE + "        filesinfo" + GRAY + "            Search files that can contains credentials" + NOCOLOR);
+            Console.WriteLine(LBLUE + "        filesinfo" + GRAY + "            Search generic files that can contains credentials" + NOCOLOR);
+            Console.WriteLine(LBLUE + "        fileanalysis" + GRAY + "         Search specific files that can contains credentials" + NOCOLOR);
            Console.WriteLine(LBLUE + "        eventsinfo" + GRAY + "           Display interesting events information" + NOCOLOR);
            Console.WriteLine(LBLUE + "        wait" + GRAY + "                 Wait for user input between checks" + NOCOLOR);
            Console.WriteLine(LBLUE + "        debug" + GRAY + "                Display debugging information - memory usage, method execution time" + NOCOLOR);
--- a/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs
+++ b/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs
@ -25,6 +25,7 @@ namespace winPEAS.Helpers.Search
            ConcurrentBag<CustomFileInfo> files = new ConcurrentBag<CustomFileInfo>();
            IEnumerable<DirectoryInfo> startDirs = GetStartDirectories(folder, files, pattern, isFoldersIncluded);
            IList<DirectoryInfo> startDirsExcluded = new List<DirectoryInfo>();
+            IList<string> known_dirs = new List<string>();

            if (excludedDirs != null)
            {
@ -51,9 +52,18 @@ namespace winPEAS.Helpers.Search
                Parallel.ForEach(GetStartDirectories(d.FullName, files, pattern, isFoldersIncluded), (dir) =>
                {
                    GetFiles(dir.FullName, pattern).ForEach(
-                        (f) =>
-                            files.Add(new CustomFileInfo(f.Name, f.Extension, f.FullName, false))
-                        );
+                        (f) => {
+                            CustomFileInfo file_info = new CustomFileInfo(f.Name, f.Extension, f.FullName, false);
+                            files.Add(file_info);
+                            
+                            CustomFileInfo file_dir = new CustomFileInfo(f.Directory.Name, "", f.Directory.FullName, true);
+                            if (!known_dirs.Contains(file_dir.FullPath))
+                            {
+                                known_dirs.Add(file_dir.FullPath);
+                                files.Add(file_dir);
+                            }
+                            }
+                        ) ;
                });
            });

@ -175,29 +185,28 @@ namespace winPEAS.Helpers.Search

            // c:\users\current_user
            string rootCurrentUserSearchPath = Environment.GetEnvironmentVariable("USERPROFILE");
-            SearchHelper.RootDirCurrentUser = SearchHelper.GetFilesFast(rootCurrentUserSearchPath, GlobalPattern);
+            SearchHelper.RootDirCurrentUser = SearchHelper.GetFilesFast(rootCurrentUserSearchPath, GlobalPattern, isFoldersIncluded: true);

            // c:\Program Files\
            string rootProgramFiles = $"{SystemDrive}\\Program Files\\";
-            SearchHelper.ProgramFiles = SearchHelper.GetFilesFast(rootProgramFiles, GlobalPattern);
+            SearchHelper.ProgramFiles = SearchHelper.GetFilesFast(rootProgramFiles, GlobalPattern, isFoldersIncluded: true);

            // c:\Program Files (x86)\
            string rootProgramFilesX86 = $"{SystemDrive}\\Program Files (x86)\\";
-            SearchHelper.ProgramFilesX86 = SearchHelper.GetFilesFast(rootProgramFilesX86, GlobalPattern);
+            SearchHelper.ProgramFilesX86 = SearchHelper.GetFilesFast(rootProgramFilesX86, GlobalPattern, isFoldersIncluded: true);

            // c:\Documents and Settings\
            string documentsAndSettings = $"{SystemDrive}\\Documents and Settings\\";
-            SearchHelper.DocumentsAndSettings = SearchHelper.GetFilesFast(documentsAndSettings, GlobalPattern);
+            SearchHelper.DocumentsAndSettings = SearchHelper.GetFilesFast(documentsAndSettings, GlobalPattern, isFoldersIncluded: true);

            // c:\ProgramData\Microsoft\Group Policy\History
            string groupPolicyHistory = $"{SystemDrive}\\ProgramData\\Microsoft\\Group Policy\\History";
-            SearchHelper.GroupPolicyHistory = SearchHelper.GetFilesFast(groupPolicyHistory, GlobalPattern);
+            SearchHelper.GroupPolicyHistory = SearchHelper.GetFilesFast(groupPolicyHistory, GlobalPattern, isFoldersIncluded: true);

            // c:\Documents and Settings\All Users\Application Data\\Microsoft\\Group Policy\\History
            string groupPolicyHistoryLegacy = $"{documentsAndSettings}\\All Users\\Application Data\\Microsoft\\Group Policy\\History";
            //SearchHelper.GroupPolicyHistoryLegacy = SearchHelper.GetFilesFast(groupPolicyHistoryLegacy, globalPattern);
-            var groupPolicyHistoryLegacyFiles = SearchHelper.GetFilesFast(groupPolicyHistoryLegacy, GlobalPattern);
-
+            var groupPolicyHistoryLegacyFiles = SearchHelper.GetFilesFast(groupPolicyHistoryLegacy, GlobalPattern, isFoldersIncluded: true);
            SearchHelper.GroupPolicyHistory.AddRange(groupPolicyHistoryLegacyFiles);
        }

--- a/winPEAS/winPEASexe/winPEAS/Info/ServicesInfo/ServicesInfoHelper.cs
+++ b/winPEAS/winPEASexe/winPEAS/Info/ServicesInfo/ServicesInfoHelper.cs
@ -217,11 +217,15 @@ namespace winPEAS.Info.ServicesInfo
                    {
                        if (SIDs.ContainsKey(ace.SecurityIdentifier.ToString()))
                        {
-                            int serviceRights = ace.AccessMask;
-
-                            string current_perm_str = PermissionsHelper.PermInt2Str(serviceRights, PermissionType.WRITEABLE_OR_EQUIVALENT_SVC);
-                            if (!string.IsNullOrEmpty(current_perm_str) && !permissions.Contains(current_perm_str))
-                                permissions.Add(current_perm_str);
+                            string aceType = ace.AceType.ToString();
+                            if (!(aceType.Contains("Denied")))
+                            { //https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonace?view=net-6.0
+                                int serviceRights = ace.AccessMask;
+                                string current_perm_str = PermissionsHelper.PermInt2Str(serviceRights, PermissionType.WRITEABLE_OR_EQUIVALENT_SVC);
+                                
+                                if (!string.IsNullOrEmpty(current_perm_str) && !permissions.Contains(current_perm_str))
+                                    permissions.Add(current_perm_str);
+                            }
                        }
                    }

--- a/winPEAS/winPEASexe/winPEAS/Properties/AssemblyInfo.cs
+++ b/winPEAS/winPEASexe/winPEAS/Properties/AssemblyInfo.cs
@ -5,12 +5,12 @@ using System.Runtime.InteropServices;
 // General Information about an assembly is controlled through the following
 // set of attributes. Change these attribute values to modify the information
 // associated with an assembly.
-[assembly: AssemblyTitle("asdas2dasd")]
+[assembly: AssemblyTitle("")]
 [assembly: AssemblyDescription("")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
-[assembly: AssemblyProduct("asdas2dasd")]
-[assembly: AssemblyCopyright("Copyright ©  2019")]
+[assembly: AssemblyProduct("")]
+[assembly: AssemblyCopyright("")]
 [assembly: AssemblyTrademark("")]
 [assembly: AssemblyCulture("")]

--- a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj
+++ b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj
@ -14,6 +14,21 @@
    <NuGetPackageImportStamp>
    </NuGetPackageImportStamp>
    <TargetFrameworkProfile />
+    <PublishUrl>publish\</PublishUrl>
+    <Install>true</Install>
+    <InstallFrom>Disk</InstallFrom>
+    <UpdateEnabled>false</UpdateEnabled>
+    <UpdateMode>Foreground</UpdateMode>
+    <UpdateInterval>7</UpdateInterval>
+    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
+    <UpdatePeriodically>false</UpdatePeriodically>
+    <UpdateRequired>false</UpdateRequired>
+    <MapFileExtensions>true</MapFileExtensions>
+    <ApplicationRevision>0</ApplicationRevision>
+    <ApplicationVersion>1.0.0.%2a</ApplicationVersion>
+    <IsWebBootstrapper>false</IsWebBootstrapper>
+    <UseApplicationTrust>false</UseApplicationTrust>
+    <BootstrapperEnabled>true</BootstrapperEnabled>
  </PropertyGroup>
  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
    <PlatformTarget>AnyCPU</PlatformTarget>
@ -95,7 +110,8 @@
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
  </PropertyGroup>
  <PropertyGroup>
-    <StartupObject>winPEAS.Program</StartupObject>
+    <StartupObject>
+    </StartupObject>
  </PropertyGroup>
  <ItemGroup>
    <Reference Include="System" />
@ -692,5 +708,17 @@
    <EmbeddedResource Include="Properties\Resources.ru.resx" />
    <EmbeddedResource Include="Properties\Resources.zh-CN.resx" />
  </ItemGroup>
+  <ItemGroup>
+    <BootstrapperPackage Include=".NETFramework,Version=v4.5.2">
+      <Visible>False</Visible>
+      <ProductName>Microsoft .NET Framework 4.5.2 %28x86 and x64%29</ProductName>
+      <Install>true</Install>
+    </BootstrapperPackage>
+    <BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
+      <Visible>False</Visible>
+      <ProductName>.NET Framework 3.5 SP1</ProductName>
+      <Install>false</Install>
+    </BootstrapperPackage>
+  </ItemGroup>
  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
 </Project>
--- a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user
+++ b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user
@ -5,7 +5,7 @@
    </StartArguments>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|AnyCPU'">
-    <StartArguments>servicesinfo</StartArguments>
+    <StartArguments>fileAnalysis</StartArguments>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x64'">
    <StartArguments>debug</StartArguments>
@ -21,4 +21,14 @@
    <StartArguments>
    </StartArguments>
  </PropertyGroup>
+  <PropertyGroup>
+    <PublishUrlHistory>publish\</PublishUrlHistory>
+    <InstallUrlHistory />
+    <SupportUrlHistory />
+    <UpdateUrlHistory />
+    <BootstrapperUrlHistory />
+    <ErrorReportUrlHistory />
+    <FallbackCulture>en-US</FallbackCulture>
+    <VerifyUploadedFiles>false</VerifyUploadedFiles>
+  </PropertyGroup>
 </Project>