darnellkeith/PEASS-ng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- added domain argument (to enable enumeration of domain users)

Browse Source 
- only local users enumerated by default
- added permissions check for SAM backups
- fixed GetPermissionsFile - did not process files without an extension
- added Read / ReadData permission to PermInt2Str
- updated WinPEAS.exe README.md
This commit is contained in:
makikvues 2021-03-02 20:36:08 +01:00
parent d41684d66c
commit 94f9bb72ac
7 changed files with 43 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
winPEAS/winPEASexe/README.md
View File

@ -17,6 +17,7 @@ Download the **[latest obfuscated version from here](https://github.com/carlospo
winpeas.exe #run all checks (except for additional slower checks - LOLBAS and linpeas.sh in WSL) (noisy - CTFs)
winpeas.exe systeminfo userinfo #Only systeminfo and userinfo checks executed
winpeas.exe notcolor #Do not color the output
winpeas.exe domain #enumerate also domain information
winpeas.exe wait #wait for user input between tests
winpeas.exe debug #display additional debug information
winpeas.exe log #log output to out.txt instead of standard output

18
winPEAS/winPEASexe/winPEAS/Checks/Checks.cs
View File

@ -14,6 +14,7 @@ namespace winPEAS.Checks
{
public static class Checks
{
public static bool IsDomainEnumeration = false;
public static bool IsNoColor = false;
public static bool Banner = true;
public static bool IsDebug = false;
@ -129,6 +130,11 @@ namespace winPEAS.Checks
IsDebug = true;
}
if (string.Equals(arg, "domain", StringComparison.CurrentCultureIgnoreCase))
{
IsDomainEnumeration = true;
}
if (string.Equals(arg, "-lolbas", StringComparison.CurrentCultureIgnoreCase))
{
IsLolbas = true;
@ -235,7 +241,14 @@ namespace winPEAS.Checks
try
{
Beaprint.GrayPrint(" - Getting Win32_UserAccount info...");
var query = new SelectQuery("Win32_UserAccount");
// by default only enumerate local users
SelectQuery query = new SelectQuery("Win32_UserAccount", "LocalAccount=true");
if (IsDomainEnumeration)
{
// include also domain users
query = new SelectQuery("Win32_UserAccount");
}
using (var searcher = new ManagementObjectSearcher(query))
{
@ -275,7 +288,8 @@ namespace winPEAS.Checks
try
{
Beaprint.GrayPrint(" - Creating active users list...");
var domainString = IsDomainEnumeration ? "(local + domain)" : "(local only)";
Beaprint.GrayPrint($" - Creating active users list {domainString}...");
_paintActiveUsers = string.Join("|", User.GetMachineUsers(true, false, false, false, false));
PaintActiveUsersNoAdministrator = _paintActiveUsers.Replace("|Administrator", "").Replace("Administrator|", "").Replace("Administrator", "");
}

9
winPEAS/winPEASexe/winPEAS/Checks/FilesInfo.cs
View File

@ -200,8 +200,15 @@ namespace winPEAS.Checks
Beaprint.MainPrint("Looking for common SAM & SYSTEM backups");
List<string> sam_files = InterestingFiles.InterestingFiles.GetSAMBackups();
foreach (string path in sam_files)
Beaprint.BadPrint(" " + path);
{
var permissions = PermissionsHelper.GetPermissionsFile(path, Checks.CurrentUserSiDs);
if (permissions.Any())
{
Beaprint.BadPrint(" " + path);
Beaprint.BadPrint(" File Permissions: " + string.Join(", ", permissions) + "\n");
}
}
}
catch (Exception ex)
{

2
winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs
View File

@ -635,7 +635,7 @@ namespace winPEAS.Checks
{ "null", Beaprint.ansi_color_bad},
{ "Require Signing", Beaprint.ansi_color_good},
{ "Negotiate signing", Beaprint.ansi_color_yellow},
{ "Unknown", Beaprint.ansi_color_bad},
{ "Unknown", Beaprint.ansi_color_bad},
};
Beaprint.ColorPrint("\n NTLM Signing Settings", Beaprint.LBLUE);

1
winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs
View File

@ -126,6 +126,7 @@ namespace winPEAS.Helpers
Console.WriteLine(YELLOW + " [*] " + GREEN + "WinPEAS is a binary to enumerate possible paths to escalate privileges locally" + NOCOLOR);
Console.WriteLine(LBLUE + " quiet" + GRAY + " Do not print banner" + NOCOLOR);
Console.WriteLine(LBLUE + " notcolor" + GRAY + " Don't use ansi colors (all white)" + NOCOLOR);
Console.WriteLine(LBLUE + " domain" + GRAY + " Enumerate domain information" + NOCOLOR);
Console.WriteLine(LBLUE + " systeminfo" + GRAY + " Search system information" + NOCOLOR);
Console.WriteLine(LBLUE + " userinfo" + GRAY + " Search user information" + NOCOLOR);
Console.WriteLine(LBLUE + " processinfo" + GRAY + " Search processes information" + NOCOLOR);

8
winPEAS/winPEASexe/winPEAS/Helpers/PermissionsHelper.cs
View File

@ -27,7 +27,7 @@ namespace winPEAS.Helpers
if (path == null || path == "")
return results;
Match reg_path = Regex.Match(path.ToString(), @"\W*([a-z]:\\.+?(\.[a-zA-Z0-9_-]+))\W*", RegexOptions.IgnoreCase);
Match reg_path = Regex.Match(path.ToString(), @"\W*([a-z]:\\[^.]+(\.[a-zA-Z0-9_-]+)?)\W*", RegexOptions.IgnoreCase);
string binaryPath = reg_path.Groups[1].ToString();
path = binaryPath;
if (path == null || path == "")
@ -178,11 +178,17 @@ namespace winPEAS.Helpers
{ "GenericAll", 0x10000000},
{ "FullControl", (int)FileSystemRights.FullControl },
{ "TakeOwnership", (int)FileSystemRights.TakeOwnership },
{ "GenericWrite", 0x40000000 },
{ "WriteData/CreateFiles", (int)FileSystemRights.WriteData },
{ "Modify", (int)FileSystemRights.Modify },
{ "Write", (int)FileSystemRights.Write },
{ "Read", (int)FileSystemRights.Read },
{ "ReadData", (int)FileSystemRights.ReadData },
{ "ChangePermissions", (int)FileSystemRights.ChangePermissions },
{ "Delete", (int)FileSystemRights.Delete },
{ "DeleteSubdirectoriesAndFiles", (int)FileSystemRights.DeleteSubdirectoriesAndFiles },
{ "AppendData/CreateDirectories", (int)FileSystemRights.AppendData },

25
winPEAS/winPEASexe/winPEAS/Info/UserInfo/User.cs
View File

@ -207,25 +207,18 @@ namespace winPEAS.Info.UserInfo
string currentUsername = Environment.UserName?.ToLower();
var usersBaseDirectory = Path.Combine(Path.GetPathRoot(Environment.SystemDirectory), "Users");
SelectQuery query = new SelectQuery("Win32_UserAccount");
using (ManagementObjectSearcher searcher = new ManagementObjectSearcher(query))
foreach (ManagementObject envVar in Checks.Checks.Win32Users)
{
using (var data = searcher.Get())
string username = (string)envVar["Name"];
username = username?.ToLower();
if (currentUsername != username)
{
foreach (ManagementObject envVar in data)
string userDirectory = Path.Combine(usersBaseDirectory, username);
if (Directory.Exists(userDirectory))
{
string username = (string)envVar["Name"];
username = username?.ToLower();
if (currentUsername != username)
{
string userDirectory = Path.Combine(usersBaseDirectory, username);
if (Directory.Exists(userDirectory))
{
result.Add(userDirectory.ToLower());
}
}
result.Add(userDirectory.ToLower());
}
}
}