- removed CMD checks

- small cleanup
- updated PrintAppCmd
- updated AutoRuns checks

winPEAS/winPEASexe/winPEAS/Checks/ApplicationsInfo.cs

@@ -97,7 +97,7 @@ namespace winPEAS.Checks
             }
         }
 
-        void PrintAutoRuns()
+        private static void PrintAutoRuns()
         {
             try
             {
@@ -107,7 +107,7 @@ namespace winPEAS.Checks
 
                 foreach (Dictionary<string, string> app in apps)
                 {
-                    var colorsA = new Dictionary<string, string>()
+                    var colorsA = new Dictionary<string, string>
                         {
                             { "FolderPerms:.*", Beaprint.ansi_color_bad },
                             { "FilePerms:.*", Beaprint.ansi_color_bad },

winPEAS/winPEASexe/winPEAS/Checks/Checks.cs

@@ -15,7 +15,6 @@ namespace winPEAS.Checks
     public static class Checks
     {
         public static bool IsNoColor = false;
-        public static bool ExecCmd = false;
         public static bool Banner = true;
         public static bool IsDebug = false;
 
@@ -108,11 +107,6 @@ namespace winPEAS.Checks
                     Console.SetOut(fileWriter);
                 }
 
-                if (string.Equals(arg, "cmd", StringComparison.CurrentCultureIgnoreCase))
-                {
-                    ExecCmd = true;
-                }
-
                 if (string.Equals(arg, "notcolor", StringComparison.CurrentCultureIgnoreCase))
                 {
                     IsNoColor = true;

winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs

@@ -692,7 +692,7 @@ namespace winPEAS.Checks
             }
         }
 
-        private void PrintPrintersWMIInfo()
+        private static void PrintPrintersWMIInfo()
         {
             Beaprint.MainPrint("Enumerating Printers (WMI)");
 
@@ -714,7 +714,7 @@ namespace winPEAS.Checks
             }
         }
 
-        private void PrintNamedPipes()
+        private static void PrintNamedPipes()
         {
             Beaprint.MainPrint("Enumerating Named Pipes");
 

winPEAS/winPEASexe/winPEAS/Checks/UserInfo.cs

@@ -126,24 +126,11 @@ namespace winPEAS.Checks
             try
             {
                 Beaprint.MainPrint("Clipboard text");
-                string clipboard = Info.UserInfo.UserInfoHelper.GetClipboardText();
+                string clipboard = UserInfoHelper.GetClipboardText();
                 if (!string.IsNullOrEmpty(clipboard))
                 {
                     Beaprint.BadPrint(clipboard);
                 }
-                else
-                {
-                    if (Checks.ExecCmd)
-                    {
-                        Beaprint.BadPrint("    " + MyUtils.ExecCMD("-command Get-Clipboard", "powershell.exe"));
-                    }
-                    else
-                    {
-                        Beaprint.NotFoundPrint();
-                        Beaprint.InfoPrint("    This C# implementation to capture the clipboard is not trustable in every Windows version");
-                        Beaprint.InfoPrint("    If you want to see what is inside the clipboard execute 'powershell -command \"Get - Clipboard\"'");
-                    }
-                }
             }
             catch (Exception ex)
             {

winPEAS/winPEASexe/winPEAS/Checks/WindowsCreds.cs

@@ -1,11 +1,14 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.IO;
 using System.Linq;
+using System.Text;
 using System.Xml;
 using winPEAS.Helpers;
 using winPEAS.Helpers.CredentialManager;
 using winPEAS.Helpers.Registry;
+using winPEAS.Info.WindowsCreds.AppCmd;
 using winPEAS.KnownFileCreds;
 using winPEAS.KnownFileCreds.Kerberos;
 using winPEAS.KnownFileCreds.SecurityPackages;
@@ -66,17 +69,7 @@ namespace winPEAS.Checks
             {
                 Beaprint.MainPrint("Checking Credential manager");
                 Beaprint.LinkPrint("https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#credentials-manager-windows-vault");
-                if (Checks.ExecCmd)
+
-                {
-                    Dictionary<string, string> colorsC = new Dictionary<string, string>()
-                    {
-                        { "User:.*", Beaprint.ansi_color_bad },
-                    };
-                    Beaprint.AnsiPrint(MyUtils.ExecCMD("/list", "cmdkey.exe"), colorsC);
-                    Beaprint.InfoPrint("If any cred was found, you can use it with 'runas /savecred'");
-                }
-                else
-                {
                 var colorsC = new Dictionary<string, string>()
                 {
                     { "Warning:", Beaprint.YELLOW },
@@ -110,7 +103,6 @@ namespace winPEAS.Checks
                     Beaprint.PrintLineSeparator();
                 }
             }
-            }
             catch (Exception ex)
             {
                 Beaprint.PrintException(ex.Message);
@@ -260,20 +252,6 @@ namespace winPEAS.Checks
             try
             {
                 Beaprint.MainPrint("Looking for saved Wifi credentials");
-                if (Checks.ExecCmd)
-                {
-                    Dictionary<string, string> networkConnections = Wifi.Wifi.Retrieve();
-                    Dictionary<string, string> ansi_colors_regexp = new Dictionary<string, string>();
-
-                    //Make sure the passwords are all flagged as ansi_color_bad.
-                    foreach (var connection in networkConnections)
-                    {
-                        ansi_colors_regexp.Add(connection.Value, Beaprint.ansi_color_bad);
-                    }
-                    Beaprint.DictPrint(networkConnections, ansi_colors_regexp, false);
-                }
-                else
-                {
                 foreach (var @interface in new WlanClient().Interfaces)
                 {
                     foreach (var profile in @interface.GetProfiles())
@@ -289,8 +267,8 @@ namespace winPEAS.Checks
                         {
                             string password = keyMaterial[0].InnerText;
 
-                                Beaprint.BadPrint($"  found Wifi password for SSID: '{profile.profileName}', password: '{password}'  ");
+                            Beaprint.BadPrint($"   SSID         :       '{profile.profileName}\n'" +
-                            }
+                                              $"   password     :       '{password}'  \n\n");
                         }
                     }
                 }
@@ -308,15 +286,53 @@ namespace winPEAS.Checks
                 Beaprint.MainPrint("Looking AppCmd.exe");
                 Beaprint.LinkPrint("https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#appcmd-exe");
 
-                if (File.Exists(Environment.ExpandEnvironmentVariables(@"%systemroot%\system32\inetsrv\appcmd.exe")))
+                var appCmdPath = Environment.ExpandEnvironmentVariables(@"%systemroot%\system32\inetsrv\appcmd.exe");
+
+                if (File.Exists(appCmdPath))
                 {
-                    Beaprint.BadPrint("    AppCmd.exe was found in " + 
+                    Beaprint.BadPrint($"    AppCmd.exe was found in {appCmdPath}");
-                                      Environment.ExpandEnvironmentVariables(@"%systemroot%\system32\inetsrv\appcmd.exe You should try to search for credentials"));
                 }
                 else
                 {
                     Beaprint.NotFoundPrint();
                 }
+
+                if (!MyUtils.IsHighIntegrity())
+                {
+                    Beaprint.NoColorPrint("      You must be an administrator to run this check");
+                    return;
+                }
+                
+                var script = AppCmd.GetExtractAppCmdCredsPowerShellScript();
+
+                string args = @$" {script}";
+
+                var processStartInfo = new ProcessStartInfo
+                {
+                    UseShellExecute = false,
+                    CreateNoWindow = true,
+                    FileName = "powershell.exe",
+                    Arguments = args,
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                    StandardOutputEncoding = Encoding.UTF8
+                };
+
+                using (var process = Process.Start(processStartInfo))
+                {
+                    if (process != null)
+                    {
+                        while (!process.StandardOutput.EndOfStream)
+                        {
+                            Beaprint.BadPrint($"    {process.StandardOutput.ReadLine()}");
+                        }
+
+                        while (!process.StandardError.EndOfStream)
+                        {
+                            Console.WriteLine(process.StandardError.ReadLine());
+                        }
+                    }
+                }
             }
             catch (Exception ex)
             {
@@ -412,33 +428,25 @@ namespace winPEAS.Checks
 
                 var server = info.ServerSettings;
                 Beaprint.ColorPrint("  RDP Server Settings", Beaprint.LBLUE);
-                Beaprint.NoColorPrint($"    NetworkLevelAuthentication          :       {server.NetworkLevelAuthentication}");
+                Beaprint.NoColorPrint($"    Network Level Authentication            :       {server.NetworkLevelAuthentication}\n" +
-                Beaprint.NoColorPrint($"    BlockClipboardRedirection           :       {server.BlockClipboardRedirection}");
+                                             $"    Block Clipboard Redirection             :       {server.BlockClipboardRedirection}\n" +
-                Beaprint.NoColorPrint($"    BlockComPortRedirection             :       {server.BlockComPortRedirection}");
+                                             $"    Block COM Port Redirection              :       {server.BlockComPortRedirection}\n" +
-                Beaprint.NoColorPrint($"    BlockDriveRedirection               :       {server.BlockDriveRedirection}");
+                                             $"    Block Drive Redirection                 :       {server.BlockDriveRedirection}\n" +
-                Beaprint.NoColorPrint($"    BlockLptPortRedirection             :       {server.BlockLptPortRedirection}");
+                                             $"    Block LPT Port Redirection              :       {server.BlockLptPortRedirection}\n" +
-                Beaprint.NoColorPrint($"    BlockPnPDeviceRedirection           :       {server.BlockPnPDeviceRedirection}");
+                                             $"    Block PnP Device Redirection            :       {server.BlockPnPDeviceRedirection}\n" +
-                Beaprint.NoColorPrint($"    BlockPrinterRedirection             :       {server.BlockPrinterRedirection}");
+                                             $"    Block Printer Redirection               :       {server.BlockPrinterRedirection}\n" +
-                Beaprint.NoColorPrint($"    AllowSmartCardRedirection           :       {server.AllowSmartCardRedirection}");
+                                             $"    Allow Smart Card Redirection            :       {server.AllowSmartCardRedirection}");
 
                 Beaprint.ColorPrint("\n  RDP Client Settings", Beaprint.LBLUE);
-                Beaprint.NoColorPrint($"    DisablePasswordSaving               :       {info.ClientSettings.DisablePasswordSaving}");
+                Beaprint.NoColorPrint($"    Disable Password Saving                 :       {info.ClientSettings.DisablePasswordSaving}\n" +
-                Beaprint.NoColorPrint($"    RestrictedRemoteAdministration      :       {info.ClientSettings.RestrictedRemoteAdministration}");
+                                             $"    Restricted Remote Administration        :       {info.ClientSettings.RestrictedRemoteAdministration}");
 
                 var type = info.ClientSettings.RestrictedRemoteAdministrationType;
-
-                var types = new Dictionary<uint, string>()
-                {
-                    { 1, "Require Restricted Admin Mode" },
-                    { 2, "Require Remote Credential Guard" },
-                    { 3, "Require Restricted Admin or Remote Credential Guard" },
-                };
-                
                 if (type != null)
                 {
                     var str = GetDescriptionByType(type);
 
-                    Beaprint.NoColorPrint($"  RestrictedRemoteAdministrationType: {str}");
+                    Beaprint.NoColorPrint($"  Restricted Remote Administration Type: {str}");
                 }
 
                 var level = info.ClientSettings.ServerAuthLevel;
@@ -446,7 +454,7 @@ namespace winPEAS.Checks
                 {
                     var str = GetDescriptionByType(level);
 
-                    Beaprint.NoColorPrint($"  ServerAuthenticationLevel: {level} - {str}");
+                    Beaprint.NoColorPrint($"  Server Authentication Level: {level} - {str}");
                 }
             }
             catch (Exception ex)
@@ -456,14 +464,14 @@ namespace winPEAS.Checks
 
         private static string GetDescriptionByType(uint? type)
         {
-            var types = new Dictionary<uint, string>()
+            var types = new Dictionary<uint, string>
                 {
                     { 1, "Require Restricted Admin Mode" },
                     { 2, "Require Remote Credential Guard" },
                     { 3, "Require Restricted Admin or Remote Credential Guard" },
                 };
             
-            string str = $"{type} - Unknown";
+            var str = $"{type} - Unknown";
 
             if (types.ContainsKey(type.Value))
             {

winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs

@@ -84,7 +84,7 @@ namespace winPEAS.Helpers
                 PrintBanner();
             }
 
-            Console.WriteLine(YELLOW + "  WinPEAS " + GREEN + Version + NOCOLOR + YELLOW + " by carlospolop, makikvues(sergi[dot]chamila[at]gmail[dot]com)" + NOCOLOR);
+            Console.WriteLine(YELLOW + "  WinPEAS " + GREEN + Version + NOCOLOR + YELLOW + " by carlospolop, makikvues(makikvues2[at]gmail[dot]com)" + NOCOLOR);
             Console.WriteLine();
 
             PrintLegend();
@@ -107,7 +107,6 @@ namespace winPEAS.Helpers
         {
             Console.WriteLine(YELLOW + "  [*] " + GREEN + "WinPEAS is a binary to enumerate possible paths to escalate privileges locally" + NOCOLOR);
             Console.WriteLine(LBLUE + "        quiet" + GRAY + "                Do not print banner" + NOCOLOR);
-            Console.WriteLine(LBLUE + "        cmd" + GRAY + "                  Obtain wifi, cred manager and clipboard information executing CMD commands" + NOCOLOR);
             Console.WriteLine(LBLUE + "        notcolor" + GRAY + "             Don't use ansi colors (all white)" + NOCOLOR);
             Console.WriteLine(LBLUE + "        systeminfo" + GRAY + "           Search system information" + NOCOLOR);
             Console.WriteLine(LBLUE + "        userinfo" + GRAY + "             Search user information" + NOCOLOR);

winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/AutoRuns.cs

@@ -378,7 +378,7 @@ namespace winPEAS.Info.ApplicationInfo
                             { "isWritableReg", ""},
                             { "interestingFolderRights", string.Join(", ", PermissionsHelper.GetPermissionsFolder(folder, Checks.Checks.CurrentUserSiDs))},
                             { "interestingFileRights", string.Join(", ", PermissionsHelper.GetPermissionsFile(filepath, Checks.Checks.CurrentUserSiDs))},
-                            { "isUnquotedSpaced", "" }
+                            { "isUnquotedSpaced", MyUtils.CheckQuoteAndSpace(path).ToString() }
                         });
                     }
                 }
@@ -406,7 +406,7 @@ namespace winPEAS.Info.ApplicationInfo
                         { "isWritableReg", ""},
                         { "interestingFolderRights", string.Join(", ", PermissionsHelper.GetPermissionsFolder(folder, Checks.Checks.CurrentUserSiDs))},
                         { "interestingFileRights", ""},
-                        { "isUnquotedSpaced", "" }
+                        { "isUnquotedSpaced", MyUtils.CheckQuoteAndSpace(folder).ToString() }
                     });
                 }
                 catch (Exception)
@@ -510,7 +510,7 @@ namespace winPEAS.Info.ApplicationInfo
                             { "isWritableReg", ""},
                             { "interestingFolderRights", string.Join(", ", PermissionsHelper.GetPermissionsFolder(folder, Checks.Checks.CurrentUserSiDs))},
                             { "interestingFileRights", string.Join(", ", PermissionsHelper.GetPermissionsFile(path, Checks.Checks.CurrentUserSiDs))},
-                            { "isUnquotedSpaced", "" }
+                            { "isUnquotedSpaced",  MyUtils.CheckQuoteAndSpace(path).ToString() }
                         });
                     }
                 }

winPEAS/winPEASexe/winPEAS/Info/WindowsCreds/AppCmd/AppCmd.cs

@@ -0,0 +1,82 @@
+using System;
+
+namespace winPEAS.Info.WindowsCreds.AppCmd
+{
+    class AppCmd
+    {
+        const string ExtractAppCmdCredsScript = @"  
+                # Check if appcmd.exe exists
+                if (Test-Path  ('%APPCMD%')) {
+                    # Create data table to house results
+                    $DataTable = New-Object System.Data.DataTable
+
+                    # Create and name columns in the data table
+                    $Null = $DataTable.Columns.Add('user')
+                    $Null = $DataTable.Columns.Add('pass')
+                    $Null = $DataTable.Columns.Add('type')
+                    $Null = $DataTable.Columns.Add('vdir')
+                    $Null = $DataTable.Columns.Add('apppool')
+
+                    # Get list of application pools
+                    Invoke-Expression '%APPCMD% list apppools /text:name' | ForEach-Object {
+
+                        # Get application pool name
+                        $PoolName = $_
+
+                        # Get username
+                        $PoolUserCmd = '%APPCMD% list apppool ' + $PoolName + ' /text:processmodel.username'
+                        $PoolUser = Invoke-Expression $PoolUserCmd
+
+                        # Get password
+                        $PoolPasswordCmd = '%APPCMD% list apppool ' + $PoolName + ' /text:processmodel.password'
+                        $PoolPassword = Invoke-Expression $PoolPasswordCmd
+
+                        # Check if credentials exists
+                        if (($PoolPassword -ne '') -and ($PoolPassword -isnot [system.array])) {
+                            # Add credentials to database
+                            $Null = $DataTable.Rows.Add($PoolUser, $PoolPassword,'Application Pool','NA',$PoolName)
+                        }
+                    }
+
+                    # Get list of virtual directories
+                    Invoke-Expression '%APPCMD% list vdir /text:vdir.name' | ForEach-Object {
+
+                        # Get Virtual Directory Name
+                        $VdirName = $_
+
+                        # Get username
+                        $VdirUserCmd = '%APPCMD% list vdir ' + $VdirName + ' /text:userName'
+                        $VdirUser = Invoke-Expression $VdirUserCmd
+
+                        # Get password
+                        $VdirPasswordCmd = '%APPCMD% list vdir ' + $VdirName + ' /text:password'
+                        $VdirPassword = Invoke-Expression $VdirPasswordCmd
+
+                        # Check if credentials exists
+                        if (($VdirPassword -ne '') -and ($VdirPassword -isnot [system.array])) {
+                            # Add credentials to database
+                            $Null = $DataTable.Rows.Add($VdirUser, $VdirPassword,'Virtual Directory',$VdirName,'NA')
+                        }
+                    }
+
+                    # Check if any passwords were found
+                    if( $DataTable.rows.Count -gt 0 ) {
+                        # Display results in list view that can feed into the pipeline
+                        #$DataTable |  Sort-Object type,user,pass,vdir,apppool | Select-Object user,pass,type,vdir,apppool -Unique
+                        $DataTable | Select-Object user,pass,type,vdir,apppool
+                    }
+                    else {
+                        # Status user
+                        Write-host 'No application pool or virtual directory passwords were found.'                        
+                    }
+                }
+            ";
+
+        public static string GetExtractAppCmdCredsPowerShellScript()
+        {
+            var appCmdPath = Environment.ExpandEnvironmentVariables(@"%systemroot%\system32\inetsrv\appcmd.exe");
+
+            return ExtractAppCmdCredsScript.Replace("%APPCMD%", appCmdPath);
+        }
+    }
+}

winPEAS/winPEASexe/winPEAS/winPEAS.csproj

@@ -476,6 +476,7 @@
     <Compile Include="Info\UserInfo\Tenant\JoinType.cs" />
     <Compile Include="Info\UserInfo\Tenant\Tenant.cs" />
     <Compile Include="Info\UserInfo\Tenant\TenantInfo.cs" />
+    <Compile Include="Info\WindowsCreds\AppCmd\AppCmd.cs" />
     <Compile Include="Info\WindowsCreds\RDPClientSettings.cs" />
     <Compile Include="Info\WindowsCreds\RDPServerSettings.cs" />
     <Compile Include="Info\WindowsCreds\RDPSettingsInfo.cs" />