diff --git a/winPEAS/winPEASexe/winPEAS/Checks/ProcessInfo.cs b/winPEAS/winPEASexe/winPEAS/Checks/ProcessInfo.cs index 3d71407..27d545a 100644 --- a/winPEAS/winPEASexe/winPEAS/Checks/ProcessInfo.cs +++ b/winPEAS/winPEASexe/winPEAS/Checks/ProcessInfo.cs @@ -92,7 +92,14 @@ namespace winPEAS.Checks Beaprint.MainPrint("Vulnerable Leaked Handlers"); Beaprint.LinkPrint("https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation"); - List> vulnHandlers = ProcessesInfo.GetVulnHandlers(); + List> vulnHandlers = new List>(); + + Beaprint.InfoPrint("Getting Leaked Handlers, it might take some time..."); + using (var progress = new ProgressBar()) + { + vulnHandlers = ProcessesInfo.GetVulnHandlers(progress); + } + foreach (Dictionary handler in vulnHandlers) { Dictionary colors = new Dictionary() diff --git a/winPEAS/winPEASexe/winPEAS/Info/ProcessInfo/ProcessesInfo.cs b/winPEAS/winPEASexe/winPEAS/Info/ProcessInfo/ProcessesInfo.cs index 103464f..9d6ab25 100644 --- a/winPEAS/winPEASexe/winPEAS/Info/ProcessInfo/ProcessesInfo.cs +++ b/winPEAS/winPEASexe/winPEAS/Info/ProcessInfo/ProcessesInfo.cs @@ -76,14 +76,27 @@ namespace winPEAS.Info.ProcessInfo return f_results; } - public static List> GetVulnHandlers() + public static List> GetVulnHandlers(ProgressBar progress) { List> vulnHandlers = new List>(); List handlers = HandlesHelper.GetAllHandlers(); List interestingHandlerTypes = new List() { "file", "key", "process", "thread" }; //section + int processedHandlersCount = 0; + int UPDATE_PROGRESSBAR_COUNT = 500; + double pb = 0; + int totalCount = handlers.Count; + foreach (HandlesHelper.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX h in handlers) { + processedHandlersCount++; + + if (processedHandlersCount % UPDATE_PROGRESSBAR_COUNT == 0) + { + pb = (double)processedHandlersCount / totalCount; + progress.Report(pb); //Value must be in [0..1] range + } + // skip some objects to avoid getting stuck // see: https://github.com/adamdriscoll/PoshInternals/issues/7 if (h.GrantedAccess == 0x0012019f