winpeas fix

2025-12-15 21:09:02 +00:00 · 2022-03-07 22:49:35 +00:00
parent b6bf6a702a
commit 09312c6883
9 changed files with 289 additions and 91 deletions
--- a/winPEAS/winPEASexe/winPEAS/Checks/Checks.cs
+++ b/winPEAS/winPEASexe/winPEAS/Checks/Checks.cs
@@ -42,7 +42,7 @@ namespace winPEAS.Checks
        private static readonly HashSet<string> _systemCheckSelectedKeysHashSet = new HashSet<string>();

        // github url for Linpeas.sh
-        public static string LinpeasUrl = "https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh";
+        public static string LinpeasUrl = "https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh";

        public const string DefaultLogFile = "out.txt";

@@ -80,7 +80,7 @@ namespace winPEAS.Checks
                new SystemCheck("windowscreds", new WindowsCreds()),
                new SystemCheck("browserinfo", new BrowserInfo()),
                new SystemCheck("filesinfo", new FilesInfo()),
-                new SystemCheck("fileAnalysis", new FileAnalysis())
+                new SystemCheck("fileanalysis", new FileAnalysis())
            };

            var systemCheckAllKeys = new HashSet<string>(_systemChecks.Select(i => i.Key));
--- a/winPEAS/winPEASexe/winPEAS/Checks/FileAnalysis.cs
+++ b/winPEAS/winPEASexe/winPEAS/Checks/FileAnalysis.cs
@@ -53,7 +53,7 @@ namespace winPEAS.Checks
            }

            files.AddRange(SearchHelper.RootDirUsers);
-          //  files.AddRange(SearchHelper.RootDirCurrentUser); // not needed, it's contained within RootDirUsers
+            // files.AddRange(SearchHelper.RootDirCurrentUser); // not needed, it's contained within RootDirUsers
            files.AddRange(SearchHelper.DocumentsAndSettings);
            files.AddRange(SearchHelper.GroupPolicyHistory);    // TODO maybe not needed here
            files.AddRange(SearchHelper.ProgramFiles);
@@ -62,7 +62,7 @@ namespace winPEAS.Checks
            return files;
        }

-        private static bool Search(List<CustomFileInfo> files, string fileName, FileSettings fileSettings, ref int resultsCount)
+        private static bool[] Search(List<CustomFileInfo> files, string fileName, FileSettings fileSettings, ref int resultsCount, string searchName, bool somethingFound)
        {
            bool isRegexSearch = fileName.Contains("*");
            string pattern = string.Empty;
@@ -86,13 +86,18 @@ namespace winPEAS.Checks

                if (isFileFound)
                {
+                    if (!somethingFound) {
+                        Beaprint.MainPrint($"Found {searchName} Files");
+                        somethingFound = true;
+                    }
+
                    // there are no inner sections
                    if (fileSettings.files == null)
                    {
                        var isProcessed = ProcessResult(file, fileSettings, ref resultsCount);
                        if (!isProcessed)
                        {
-                            return true;
+                            return new bool[] { true, somethingFound };
                        }
                    }
                    // there are inner sections
@@ -109,7 +114,7 @@ namespace winPEAS.Checks
                                var isProcessed = ProcessResult(innerFile, innerFileToSearch.value, ref resultsCount);
                                if (!isProcessed)
                                {
-                                    return true;
+                                    return new bool[] { true, somethingFound };
                                }
                            }
                        }
@@ -117,7 +122,7 @@ namespace winPEAS.Checks
                }
            }

-            return false;
+            return new bool[] { false, somethingFound };
        }
       
        private static void PrintYAMLSearchFiles()
@@ -133,15 +138,17 @@ namespace winPEAS.Checks

                foreach (var searchItem in searchItems)
                {
+                    if (searchItem.name != "Wifi Connections")
+                        continue;
                    var searchName = searchItem.name;
                    var value = searchItem.value;
                    var searchConfig = value.config;
+                    bool somethingFound = false;

                    CheckRunner.Run(() =>
                    {
-                        Beaprint.MainPrint($"Analyzing {searchName} Files (limit {ListFileLimit})");
-
                        int resultsCount = 0;
+                        bool[] results;
                        bool isSearchFinished = false;

                        foreach (var file in value.files)
@@ -150,7 +157,10 @@ namespace winPEAS.Checks
                            var fileSettings = file.value;
                            var itemsToSearch = fileSettings.type == "f" ? files : folders;

-                            isSearchFinished = Search(itemsToSearch, fileName, fileSettings, ref resultsCount);
+                            results = Search(itemsToSearch, fileName, fileSettings, ref resultsCount, searchName, somethingFound);
+
+                            isSearchFinished = results[0];
+                            somethingFound = results[1];

                            if (isSearchFinished)
                            {
@@ -193,18 +203,22 @@ namespace winPEAS.Checks

            if (fileSettings.type == "f")
            {
-                if ((bool)fileSettings.just_list_file)
-                {
-                    Beaprint.BadPrint($"    {fileInfo.FullPath}");
-                }
-                else
+                var colors = new Dictionary<string, string>();
+                colors.Add(fileInfo.Filename, Beaprint.ansi_color_bad);
+                Beaprint.AnsiPrint($"File: {fileInfo.FullPath}", colors);
+
+                if   (!(bool)fileSettings.just_list_file)
                {
                    GrepResult(fileInfo, fileSettings);
                }
            }
            else if (fileSettings.type == "d")
            {
-                // just list the directory 
+                var colors = new Dictionary<string, string>();
+                colors.Add(fileInfo.Filename, Beaprint.ansi_color_bad);
+                Beaprint.AnsiPrint($"Folder: {fileInfo.FullPath}", colors);
+
+                // just list the directory
                if ((bool)fileSettings.just_list_file)
                {
                    string[] files = Directory.GetFiles(fileInfo.FullPath, "*", SearchOption.TopDirectoryOnly);
@@ -225,8 +239,6 @@ namespace winPEAS.Checks

        private static void GrepResult(CustomFileInfo fileInfo, FileSettings fileSettings)
        {
-            Beaprint.NoColorPrint($"    '{fileInfo.FullPath}' - content:");
-
            var fileContent = File.ReadLines(fileInfo.FullPath);
            var colors = new Dictionary<string, string>();

@@ -272,7 +284,8 @@ namespace winPEAS.Checks

            Beaprint.AnsiPrint(content, colors);

-            Console.WriteLine();
+            if (content.Length > 0)
+                Console.WriteLine();
        }

        private static string SanitizeLineGrep(string lineGrep)
@@ -281,7 +294,16 @@ namespace winPEAS.Checks
            // '-i -a -o "description.*" | sort | uniq'
            // - remove everything except from "description.*"

-            Regex regex = new Regex("\"([^\"]+)\"");
+            Regex regex;
+            if (lineGrep.Contains("-i"))
+            {
+                regex = new Regex("\"([^\"]+)\"", RegexOptions.IgnoreCase);
+            }
+            else
+            {
+                regex = new Regex("\"([^\"]+)\"");
+            }
+
            Match match = regex.Match(lineGrep);

            if (match.Success)
--- a/winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs
+++ b/winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs
@@ -44,32 +44,31 @@ namespace winPEAS.Helpers
        public static void PrintBanner()
        {
            Console.WriteLine(BLUE + string.Format(@"     
-             {0}*((,.,/((((((((((((((((((((/,  */               
-      {0},/*,..*((((((((((((((((((((((((((((((((((,           
-    {0},*/((((((((((((((((((/,  .*//((//**, .*(((((((*       
-    {0}(((((((((((((((({2}**********/{1}########## {0}.(* ,(((((((   
-    {0}(((((((((((/{2}********************/{1}####### {0}.(. (((((((
-    {0}((((((..{2}******************{3}/@@@@@/{2}***/{1}###### {0}./(((((((
-    {0},,....{2}********************{3}@@@@@@@@@@{2}(***,{1}#### {0}.//((((((
-    {0}, ,..{2}********************{3}/@@@@@%@@@@{2}/********{1}##{0}((/ /((((
-    {0}..(({1}###########{2}*********{3}/%@@@@@@@@@{2}/************{0},,..((((
-    {0}.({1}##################(/{2}******{3}/@@@@@{2}/***************{0}.. /((
-    {0}.({1}#########################(/{2}**********************{0}..*((
-    {0}.({1}##############################(/{2}*****************{0}.,(((
-    {0}.({1}###################################(/{2}************{0}..(((
-    {0}.({1}#######################################({2}*********{0}..(((
-    {0}.({1}#######(,.***.,(###################(..***.{2}*******{0}..(((
-    {0}.({1}#######*(#####((##################((######/({2}*****{0}..(((
-    {0}.({1}###################(/***********(##############({0}...(((
-    {0}.(({1}#####################/*******(################{0}.((((((
-    {0}.((({1}############################################{0}(..((((
-    {0}..((({1}##########################################{0}(..(((((
-    {0}....(({1}########################################{0}( .(((((
-    {0}......(({1}####################################{0}( .((((((
-    {0}((((((((({1}#################################{0}(../((((((
-        {0}(((((((((/{1}##########################{0}(/..((((((
-              {0}(((((((((/,.  ,*//////*,. ./(((((((((((((((.
-                 {0}(((((((((((((((((((((((((((((/", LGREEN, GREEN, BLUE, NOCOLOR) + NOCOLOR);
+               {0}((((((((((((((((((((((((((((((((
+        {0}(((((((((((((((((((((((((((((((((((((((((((
+      {0}(((((((((((((({2}**********/{1}##########{0}.((((((((((((   
+    {0}(((((((((((/{2}********************/{1}#######{0}.((((((((((
+    {0}(((((((.{2}******************{3}/@@@@@/{0}{2}****{1}######{0}.(((((((((
+    {0}(((((.{2}********************{3}@@@@@@@@@@/{0}{2}***,{1}####{0}.(((((((((
+    {0}((((.{2}********************{3}/@@@@@%@@@@{0}{2}/********{1}##{0}(((((((((
+    {0}.(({1}############{2}*********{3}/%@@@@@@@@@{0}{2}/************{0}.(((((((
+    {0}.({1}##################(/{2}******{3}/@@@@@{0}{2}/***************{0}.(((((
+    {0}.({1}#########################(/{2}**********************{0}.((((
+    {0}.({1}##############################(/{2}*****************{0}.((((
+    {0}.({1}###################################(/{2}************{0}.((((
+    {0}.({1}#######################################({2}*********{0}.((((
+    {0}.({1}#######(,.***.,(###################(..***.{2}*******{0}.((((
+    {0}.({1}#######*(#####((##################((######/({2}*****{0}.((((
+    {0}.({1}###################(/***********(##############({0}).((((
+    {0}.(({1}#####################/*******(################{0})((((((
+    {0}.((({1}############################################{0}).(((((
+    {0}..((({1}##########################################{0}).((((((
+    {0}....(({1}########################################{0}).((((((
+    {0}......(({1}####################################{0}).(((((((
+    {0}((((((((({1}#################################{0}).((((((((
+        {0}(((((((((/{1}##########################{0}).((((((((
+              {0}((((((((((((((((((((((((((((((((((((((
+                 {0}((((((((((((((((((((((((((((((", LGREEN, GREEN, BLUE, NOCOLOR) + NOCOLOR);

            Console.WriteLine();
            Console.WriteLine(LYELLOW + "ADVISORY: " + BLUE + Advisory);
@@ -136,7 +135,8 @@ namespace winPEAS.Helpers
            Console.WriteLine(LBLUE + "        networkinfo" + GRAY + "          Search network information" + NOCOLOR);
            Console.WriteLine(LBLUE + "        windowscreds" + GRAY + "         Search windows credentials" + NOCOLOR);
            Console.WriteLine(LBLUE + "        browserinfo" + GRAY + "          Search browser information" + NOCOLOR);
-            Console.WriteLine(LBLUE + "        filesinfo" + GRAY + "            Search files that can contains credentials" + NOCOLOR);
+            Console.WriteLine(LBLUE + "        filesinfo" + GRAY + "            Search generic files that can contains credentials" + NOCOLOR);
+            Console.WriteLine(LBLUE + "        fileanalysis" + GRAY + "         Search specific files that can contains credentials" + NOCOLOR);
            Console.WriteLine(LBLUE + "        eventsinfo" + GRAY + "           Display interesting events information" + NOCOLOR);
            Console.WriteLine(LBLUE + "        wait" + GRAY + "                 Wait for user input between checks" + NOCOLOR);
            Console.WriteLine(LBLUE + "        debug" + GRAY + "                Display debugging information - memory usage, method execution time" + NOCOLOR);
--- a/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs
+++ b/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs
@@ -25,6 +25,7 @@ namespace winPEAS.Helpers.Search
            ConcurrentBag<CustomFileInfo> files = new ConcurrentBag<CustomFileInfo>();
            IEnumerable<DirectoryInfo> startDirs = GetStartDirectories(folder, files, pattern, isFoldersIncluded);
            IList<DirectoryInfo> startDirsExcluded = new List<DirectoryInfo>();
+            IList<string> known_dirs = new List<string>();

            if (excludedDirs != null)
            {
@@ -51,9 +52,18 @@ namespace winPEAS.Helpers.Search
                Parallel.ForEach(GetStartDirectories(d.FullName, files, pattern, isFoldersIncluded), (dir) =>
                {
                    GetFiles(dir.FullName, pattern).ForEach(
-                        (f) =>
-                            files.Add(new CustomFileInfo(f.Name, f.Extension, f.FullName, false))
-                        );
+                        (f) => {
+                            CustomFileInfo file_info = new CustomFileInfo(f.Name, f.Extension, f.FullName, false);
+                            files.Add(file_info);
+                            
+                            CustomFileInfo file_dir = new CustomFileInfo(f.Directory.Name, "", f.Directory.FullName, true);
+                            if (!known_dirs.Contains(file_dir.FullPath))
+                            {
+                                known_dirs.Add(file_dir.FullPath);
+                                files.Add(file_dir);
+                            }
+                            }
+                        ) ;
                });
            });

@@ -175,29 +185,28 @@ namespace winPEAS.Helpers.Search

            // c:\users\current_user
            string rootCurrentUserSearchPath = Environment.GetEnvironmentVariable("USERPROFILE");
-            SearchHelper.RootDirCurrentUser = SearchHelper.GetFilesFast(rootCurrentUserSearchPath, GlobalPattern);
+            SearchHelper.RootDirCurrentUser = SearchHelper.GetFilesFast(rootCurrentUserSearchPath, GlobalPattern, isFoldersIncluded: true);

            // c:\Program Files\
            string rootProgramFiles = $"{SystemDrive}\\Program Files\\";
-            SearchHelper.ProgramFiles = SearchHelper.GetFilesFast(rootProgramFiles, GlobalPattern);
+            SearchHelper.ProgramFiles = SearchHelper.GetFilesFast(rootProgramFiles, GlobalPattern, isFoldersIncluded: true);

            // c:\Program Files (x86)\
            string rootProgramFilesX86 = $"{SystemDrive}\\Program Files (x86)\\";
-            SearchHelper.ProgramFilesX86 = SearchHelper.GetFilesFast(rootProgramFilesX86, GlobalPattern);
+            SearchHelper.ProgramFilesX86 = SearchHelper.GetFilesFast(rootProgramFilesX86, GlobalPattern, isFoldersIncluded: true);

            // c:\Documents and Settings\
            string documentsAndSettings = $"{SystemDrive}\\Documents and Settings\\";
-            SearchHelper.DocumentsAndSettings = SearchHelper.GetFilesFast(documentsAndSettings, GlobalPattern);
+            SearchHelper.DocumentsAndSettings = SearchHelper.GetFilesFast(documentsAndSettings, GlobalPattern, isFoldersIncluded: true);

            // c:\ProgramData\Microsoft\Group Policy\History
            string groupPolicyHistory = $"{SystemDrive}\\ProgramData\\Microsoft\\Group Policy\\History";
-            SearchHelper.GroupPolicyHistory = SearchHelper.GetFilesFast(groupPolicyHistory, GlobalPattern);
+            SearchHelper.GroupPolicyHistory = SearchHelper.GetFilesFast(groupPolicyHistory, GlobalPattern, isFoldersIncluded: true);

            // c:\Documents and Settings\All Users\Application Data\\Microsoft\\Group Policy\\History
            string groupPolicyHistoryLegacy = $"{documentsAndSettings}\\All Users\\Application Data\\Microsoft\\Group Policy\\History";
            //SearchHelper.GroupPolicyHistoryLegacy = SearchHelper.GetFilesFast(groupPolicyHistoryLegacy, globalPattern);
-            var groupPolicyHistoryLegacyFiles = SearchHelper.GetFilesFast(groupPolicyHistoryLegacy, GlobalPattern);
-
+            var groupPolicyHistoryLegacyFiles = SearchHelper.GetFilesFast(groupPolicyHistoryLegacy, GlobalPattern, isFoldersIncluded: true);
            SearchHelper.GroupPolicyHistory.AddRange(groupPolicyHistoryLegacyFiles);
        }

--- a/winPEAS/winPEASexe/winPEAS/Info/ServicesInfo/ServicesInfoHelper.cs
+++ b/winPEAS/winPEASexe/winPEAS/Info/ServicesInfo/ServicesInfoHelper.cs
@@ -217,11 +217,15 @@ namespace winPEAS.Info.ServicesInfo
                    {
                        if (SIDs.ContainsKey(ace.SecurityIdentifier.ToString()))
                        {
-                            int serviceRights = ace.AccessMask;
-
-                            string current_perm_str = PermissionsHelper.PermInt2Str(serviceRights, PermissionType.WRITEABLE_OR_EQUIVALENT_SVC);
-                            if (!string.IsNullOrEmpty(current_perm_str) && !permissions.Contains(current_perm_str))
-                                permissions.Add(current_perm_str);
+                            string aceType = ace.AceType.ToString();
+                            if (!(aceType.Contains("Denied")))
+                            { //https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonace?view=net-6.0
+                                int serviceRights = ace.AccessMask;
+                                string current_perm_str = PermissionsHelper.PermInt2Str(serviceRights, PermissionType.WRITEABLE_OR_EQUIVALENT_SVC);
+                                
+                                if (!string.IsNullOrEmpty(current_perm_str) && !permissions.Contains(current_perm_str))
+                                    permissions.Add(current_perm_str);
+                            }
                        }
                    }

--- a/winPEAS/winPEASexe/winPEAS/Properties/AssemblyInfo.cs
+++ b/winPEAS/winPEASexe/winPEAS/Properties/AssemblyInfo.cs
@@ -5,12 +5,12 @@ using System.Runtime.InteropServices;
 // General Information about an assembly is controlled through the following
 // set of attributes. Change these attribute values to modify the information
 // associated with an assembly.
-[assembly: AssemblyTitle("asdas2dasd")]
+[assembly: AssemblyTitle("")]
 [assembly: AssemblyDescription("")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
-[assembly: AssemblyProduct("asdas2dasd")]
-[assembly: AssemblyCopyright("Copyright ©  2019")]
+[assembly: AssemblyProduct("")]
+[assembly: AssemblyCopyright("")]
 [assembly: AssemblyTrademark("")]
 [assembly: AssemblyCulture("")]

--- a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj
+++ b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj
@@ -14,6 +14,21 @@
    <NuGetPackageImportStamp>
    </NuGetPackageImportStamp>
    <TargetFrameworkProfile />
+    <PublishUrl>publish\</PublishUrl>
+    <Install>true</Install>
+    <InstallFrom>Disk</InstallFrom>
+    <UpdateEnabled>false</UpdateEnabled>
+    <UpdateMode>Foreground</UpdateMode>
+    <UpdateInterval>7</UpdateInterval>
+    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
+    <UpdatePeriodically>false</UpdatePeriodically>
+    <UpdateRequired>false</UpdateRequired>
+    <MapFileExtensions>true</MapFileExtensions>
+    <ApplicationRevision>0</ApplicationRevision>
+    <ApplicationVersion>1.0.0.%2a</ApplicationVersion>
+    <IsWebBootstrapper>false</IsWebBootstrapper>
+    <UseApplicationTrust>false</UseApplicationTrust>
+    <BootstrapperEnabled>true</BootstrapperEnabled>
  </PropertyGroup>
  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
    <PlatformTarget>AnyCPU</PlatformTarget>
@@ -95,7 +110,8 @@
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
  </PropertyGroup>
  <PropertyGroup>
-    <StartupObject>winPEAS.Program</StartupObject>
+    <StartupObject>
+    </StartupObject>
  </PropertyGroup>
  <ItemGroup>
    <Reference Include="System" />
@@ -692,5 +708,17 @@
    <EmbeddedResource Include="Properties\Resources.ru.resx" />
    <EmbeddedResource Include="Properties\Resources.zh-CN.resx" />
  </ItemGroup>
+  <ItemGroup>
+    <BootstrapperPackage Include=".NETFramework,Version=v4.5.2">
+      <Visible>False</Visible>
+      <ProductName>Microsoft .NET Framework 4.5.2 %28x86 and x64%29</ProductName>
+      <Install>true</Install>
+    </BootstrapperPackage>
+    <BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
+      <Visible>False</Visible>
+      <ProductName>.NET Framework 3.5 SP1</ProductName>
+      <Install>false</Install>
+    </BootstrapperPackage>
+  </ItemGroup>
  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
 </Project>
--- a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user
+++ b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user
@@ -5,7 +5,7 @@
    </StartArguments>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|AnyCPU'">
-    <StartArguments>servicesinfo</StartArguments>
+    <StartArguments>fileAnalysis</StartArguments>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x64'">
    <StartArguments>debug</StartArguments>
@@ -21,4 +21,14 @@
    <StartArguments>
    </StartArguments>
  </PropertyGroup>
+  <PropertyGroup>
+    <PublishUrlHistory>publish\</PublishUrlHistory>
+    <InstallUrlHistory />
+    <SupportUrlHistory />
+    <UpdateUrlHistory />
+    <BootstrapperUrlHistory />
+    <ErrorReportUrlHistory />
+    <FallbackCulture>en-US</FallbackCulture>
+    <VerifyUploadedFiles>false</VerifyUploadedFiles>
+  </PropertyGroup>
 </Project>