Doc tweak for Codex merge test

.github/workflows/pr-failure-codex-dispatch.yml

@@ -10,7 +10,7 @@ jobs:
     if: >
       ${{ github.event.workflow_run.conclusion == 'failure' &&
           github.event.workflow_run.pull_requests &&
-          github.event.workflow_run.pull_requests[0] &&
+          github.event.workflow_run.pull_requests[0].user.login == 'carlospolop' &&
           !startsWith(github.event.workflow_run.head_commit.message, 'Fix CI failures for PR #') }}
     runs-on: ubuntu-latest
     permissions:
@@ -20,33 +20,10 @@ jobs:
       actions: read
 
     steps:
-      - name: Resolve PR context
-        id: pr_context
-        env:
-          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          pr_author=$(gh api -H "Accept: application/vnd.github+json" \
-            /repos/${{ github.repository }}/pulls/${PR_NUMBER} \
-            --jq '.user.login')
-          pr_head_repo=$(gh api -H "Accept: application/vnd.github+json" \
-            /repos/${{ github.repository }}/pulls/${PR_NUMBER} \
-            --jq '.head.repo.full_name')
-          pr_head_branch=$(gh api -H "Accept: application/vnd.github+json" \
-            /repos/${{ github.repository }}/pulls/${PR_NUMBER} \
-            --jq '.head.ref')
-          {
-            echo "number=${PR_NUMBER}"
-            echo "author=${pr_author}"
-            echo "head_repo=${pr_head_repo}"
-            echo "head_branch=${pr_head_branch}"
-          } >> "$GITHUB_OUTPUT"
-
       - name: Comment on PR with failure info
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         uses: actions/github-script@v7
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
           RUN_URL: ${{ github.event.workflow_run.html_url }}
           WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
         with:
@@ -62,22 +39,19 @@ jobs:
             });
 
       - name: Checkout PR head
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         uses: actions/checkout@v5
         with:
-          repository: ${{ steps.pr_context.outputs.head_repo }}
+          repository: ${{ github.event.workflow_run.head_repository.full_name }}
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
           persist-credentials: true
 
       - name: Configure git author
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         run: |
           git config user.name "codex-action"
           git config user.email "codex-action@users.noreply.github.com"
 
       - name: Fetch failure summary
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RUN_ID: ${{ github.event.workflow_run.id }}
@@ -105,11 +79,10 @@ jobs:
           PY
 
       - name: Create Codex prompt
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
           RUN_URL: ${{ github.event.workflow_run.html_url }}
-          HEAD_BRANCH: ${{ steps.pr_context.outputs.head_branch }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
           {
             echo "You are fixing CI failures for PR #${PR_NUMBER} in ${{ github.repository }}."
@@ -125,7 +98,6 @@ jobs:
           } > codex_prompt.txt
 
       - name: Run Codex
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         id: run_codex
         uses: openai/codex-action@v1
         with:
@@ -135,10 +107,9 @@ jobs:
           model: gpt-5.2-codex
 
       - name: Commit and push if changed
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' }}
         env:
-          TARGET_BRANCH: ${{ steps.pr_context.outputs.head_branch }}
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          TARGET_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
         run: |
           if git diff --quiet; then
             echo "No changes to commit."
@@ -149,10 +120,10 @@ jobs:
           git push origin HEAD:${TARGET_BRANCH}
 
       - name: Comment with Codex result
-        if: ${{ steps.pr_context.outputs.author == 'carlospolop' && steps.run_codex.outputs.final-message != '' }}
+        if: steps.run_codex.outputs.final-message != ''
         uses: actions/github-script@v7
         env:
-          PR_NUMBER: ${{ steps.pr_context.outputs.number }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
           CODEX_MESSAGE: ${{ steps.run_codex.outputs.final-message }}
         with:
           github-token: ${{ github.token }}

linPEAS/builder/linpeas_parts/3_cloud/3_AWS_ECS.sh

@@ -1,14 +1,14 @@
 # Title: Cloud - AWS ECS
 # ID: CL_AWS_ECS
 # Author: Carlos Polop
-# Last Update: 17-01-2026
+# Last Update: 22-08-2023
 # Description: AWS ECS Enumeration
 # License: GNU GPL
 # Version: 1.0
 # Functions Used: check_aws_ecs, exec_with_jq, print_2title, print_3title
 # Global Variables: $aws_ecs_metadata_uri, $aws_ecs_service_account_uri, $is_aws_ecs
 # Initial Functions: check_aws_ecs
-# Generated Global Variables: $aws_ecs_req, $aws_exec_env, $ecs_task_metadata, $launch_type, $network_modes, $imds_tool, $imds_token, $imds_roles, $imds_http_code, $ecs_block_line, $ecs_host_line, $iptables_cmd, $docker_rules, $first_role
+# Generated Global Variables: $aws_ecs_req
 # Fat linpeas: 0
 # Small linpeas: 1
 
@@ -44,146 +44,5 @@ if [ "$is_aws_ecs" = "Yes" ]; then
     else
         echo "I couldn't find AWS_CONTAINER_CREDENTIALS_RELATIVE_URI env var to get IAM role info (the task is running without a task role probably)"
     fi
-
-    print_3title "ECS task metadata hints"
-    aws_exec_env=$(printenv AWS_EXECUTION_ENV 2>/dev/null)
-    if [ "$aws_exec_env" ]; then
-        printf "AWS_EXECUTION_ENV=%s\n" "$aws_exec_env"
-    fi
-
-    ecs_task_metadata=""
-    if [ "$aws_ecs_metadata_uri" ]; then
-        ecs_task_metadata=$(eval $aws_ecs_req "$aws_ecs_metadata_uri/task" 2>/dev/null)
-    fi
-
-    if [ "$ecs_task_metadata" ]; then
-        launch_type=$(printf "%s" "$ecs_task_metadata" | grep -oE '"LaunchType":"[^"]+"' | head -n 1 | cut -d '"' -f4)
-        if [ "$launch_type" ]; then
-            printf "ECS LaunchType reported: %s\n" "$launch_type"
-        fi
-        network_modes=$(printf "%s" "$ecs_task_metadata" | grep -oE '"NetworkMode":"[^"]+"' | cut -d '"' -f4 | sort -u | tr '\n' ' ')
-        if [ "$network_modes" ]; then
-            printf "Reported NetworkMode(s): %s\n" "$network_modes"
-        fi
-    else
-        echo "Unable to fetch task metadata (check ECS_CONTAINER_METADATA_URI)."
-    fi
     echo ""
-
-    print_3title "IMDS reachability from this task"
-    imds_token=""
-    imds_roles=""
-    imds_http_code=""
-    imds_tool=""
-
-    if command -v curl >/dev/null 2>&1; then
-        imds_tool="curl"
-    elif command -v wget >/dev/null 2>&1; then
-        imds_tool="wget"
-    fi
-
-    if [ "$imds_tool" = "curl" ]; then
-        imds_token=$(curl -s --connect-timeout 2 --max-time 2 -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null)
-        if [ "$imds_token" ]; then
-            printf "[!] IMDSv2 token request succeeded (metadata reachable from this task).\n"
-            imds_roles=$(curl -s --connect-timeout 2 --max-time 2 -H "X-aws-ec2-metadata-token: $imds_token" "http://169.254.169.254/latest/meta-data/iam/security-credentials/" 2>/dev/null | tr '\n' ' ')
-            if [ "$imds_roles" ]; then
-                printf "    Instance profile role(s) exposed via IMDS: %s\n" "$imds_roles"
-                first_role=$(printf "%s" "$imds_roles" | awk '{print $1}')
-                if [ "$first_role" ]; then
-                    printf "    Example: curl -H 'X-aws-ec2-metadata-token: <TOKEN>' http://169.254.169.254/latest/meta-data/iam/security-credentials/%s\n" "$first_role"
-                fi
-            else
-                printf "    No IAM role names returned (instance profile might be missing).\n"
-            fi
-        else
-            imds_http_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 --max-time 2 "http://169.254.169.254/latest/meta-data/" 2>/dev/null)
-            case "$imds_http_code" in
-                000|"")
-                    printf "[i] IMDS endpoint did not respond (likely blocked via hop-limit or host firewalling).\n"
-                    ;;
-                401)
-                    printf "[i] IMDS requires v2 tokens but token requests are being blocked (bridge-mode tasks rely on this when hop limit = 1).\n"
-                    ;;
-                *)
-                    printf "[i] IMDS GET returned HTTP %s (investigate host configuration).\n" "$imds_http_code"
-                    ;;
-            esac
-        fi
-    elif [ "$imds_tool" = "wget" ]; then
-        imds_token=$(wget -q -O - --timeout=2 --tries=1 --method=PUT --header="X-aws-ec2-metadata-token-ttl-seconds: 21600" "http://169.254.169.254/latest/api/token" 2>/dev/null)
-        if [ "$imds_token" ]; then
-            printf "[!] IMDSv2 token request succeeded (metadata reachable from this task).\n"
-            imds_roles=$(wget -q -O - --timeout=2 --tries=1 --header="X-aws-ec2-metadata-token: $imds_token" "http://169.254.169.254/latest/meta-data/iam/security-credentials/" 2>/dev/null | tr '\n' ' ')
-            if [ "$imds_roles" ]; then
-                printf "    Instance profile role(s) exposed via IMDS: %s\n" "$imds_roles"
-            else
-                printf "    No IAM role names returned (instance profile might be missing).\n"
-            fi
-        else
-            wget --server-response -O /dev/null --timeout=2 --tries=1 "http://169.254.169.254/latest/meta-data/" 2>&1 | awk 'BEGIN{code=""} /^  HTTP/{code=$2} END{ if(code!="") { printf("[i] IMDS GET returned HTTP %s (token could not be retrieved).\n", code); } else { print "[i] IMDS endpoint did not respond (likely blocked)."; } }'
-        fi
-    else
-        echo "Neither curl nor wget were found, I can't test IMDS reachability."
-    fi
-    echo ""
-
-    print_3title "ECS agent IMDS settings"
-    if [ -r "/etc/ecs/ecs.config" ]; then
-        ecs_block_line=$(grep -E "^ECS_AWSVPC_BLOCK_IMDS=" /etc/ecs/ecs.config 2>/dev/null | tail -n 1)
-        ecs_host_line=$(grep -E "^ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST=" /etc/ecs/ecs.config 2>/dev/null | tail -n 1)
-        if [ "$ecs_block_line" ]; then
-            printf "%s\n" "$ecs_block_line"
-            if echo "$ecs_block_line" | grep -qi "=true"; then
-                echo "    -> awsvpc-mode tasks should be blocked from IMDS by the ECS agent."
-            else
-                echo "    -> awsvpc-mode tasks can still reach IMDS (set this to true to block)."
-            fi
-        else
-            echo "ECS_AWSVPC_BLOCK_IMDS not set (awsvpc tasks inherit host IMDS reachability)."
-        fi
-
-        if [ "$ecs_host_line" ]; then
-            printf "%s\n" "$ecs_host_line"
-            if echo "$ecs_host_line" | grep -qi "=false"; then
-                echo "    -> Host-network tasks lose IAM task roles but IMDS is blocked."
-            else
-                echo "    -> Host-network tasks keep IAM task roles and retain IMDS access."
-            fi
-        else
-            echo "ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST not set (defaults keep IMDS reachable for host-mode tasks)."
-        fi
-    else
-        echo "Cannot read /etc/ecs/ecs.config (file missing or permissions denied)."
-    fi
-    echo ""
-
-    print_3title "DOCKER-USER IMDS filtering"
-    iptables_cmd=""
-    if command -v iptables >/dev/null 2>&1; then
-        iptables_cmd=$(command -v iptables)
-    elif command -v iptables-nft >/dev/null 2>&1; then
-        iptables_cmd=$(command -v iptables-nft)
-    fi
-
-    if [ "$iptables_cmd" ]; then
-        docker_rules=$($iptables_cmd -S DOCKER-USER 2>/dev/null)
-        if [ $? -eq 0 ]; then
-            if [ "$docker_rules" ]; then
-                echo "$docker_rules"
-            else
-                echo "(DOCKER-USER chain exists but no rules were found)"
-            fi
-            if echo "$docker_rules" | grep -q "169\\.254\\.169\\.254"; then
-                echo "    -> IMDS traffic is explicitly filtered before Docker NAT."
-            else
-                echo "    -> No DOCKER-USER rule drops 169.254.169.254 traffic (bridge tasks rely on hop limit or host firewalling)."
-            fi
-        else
-            echo "Unable to read DOCKER-USER chain (missing chain or insufficient permissions)."
-        fi
-    else
-        echo "iptables binary not found; cannot inspect DOCKER-USER chain."
-    fi
-    echo ""
-fi
+fi

winPEAS/winPEASexe/winPEAS/Checks/Checks.cs

@@ -94,7 +94,6 @@ namespace winPEAS.Checks
                 new SystemCheck("activedirectoryinfo", new ActiveDirectoryInfo()),
                 new SystemCheck("cloudinfo", new CloudInfo()),
                 new SystemCheck("windowscreds", new WindowsCreds()),
-                new SystemCheck("registryinfo", new RegistryInfo()),
                 new SystemCheck("browserinfo", new BrowserInfo()),
                 new SystemCheck("filesinfo", new FilesInfo()),
                 new SystemCheck("fileanalysis", new FileAnalysis()),

winPEAS/winPEASexe/winPEAS/Checks/RegistryInfo.cs

@@ -1,141 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using winPEAS.Helpers;
-using winPEAS.Helpers.Registry;
-
-namespace winPEAS.Checks
-{
-    internal class RegistryInfo : ISystemCheck
-    {
-        private const string TypingInsightsRelativePath = @"Software\Microsoft\Input\TypingInsights";
-
-        private static readonly string[] KnownWritableSystemKeyCandidates = new[]
-        {
-            @"SOFTWARE\Microsoft\CoreShell",
-            @"SOFTWARE\Microsoft\DRM",
-            @"SOFTWARE\Microsoft\Input\Locales",
-            @"SOFTWARE\Microsoft\Input\Settings",
-            @"SOFTWARE\Microsoft\Shell\Oobe",
-            @"SOFTWARE\Microsoft\Shell\Session",
-            @"SOFTWARE\Microsoft\Tracing",
-            @"SOFTWARE\Microsoft\Windows\UpdateApi",
-            @"SOFTWARE\Microsoft\WindowsUpdate\UX",
-            @"SOFTWARE\WOW6432Node\Microsoft\DRM",
-            @"SOFTWARE\WOW6432Node\Microsoft\Tracing",
-            @"SYSTEM\Software\Microsoft\TIP",
-            @"SYSTEM\ControlSet001\Control\Cryptography\WebSignIn\Navigation",
-            @"SYSTEM\ControlSet001\Control\MUI\StringCacheSettings",
-            @"SYSTEM\ControlSet001\Control\USB\AutomaticSurpriseRemoval",
-            @"SYSTEM\ControlSet001\Services\BTAGService\Parameters\Settings",
-        };
-
-        private static readonly string[] ScanBasePaths = new[]
-        {
-            @"SOFTWARE\Microsoft",
-            @"SOFTWARE\WOW6432Node\Microsoft",
-            @"SYSTEM\CurrentControlSet\Services",
-            @"SYSTEM\CurrentControlSet\Control",
-            @"SYSTEM\ControlSet001\Control",
-        };
-
-        public void PrintInfo(bool isDebug)
-        {
-            Beaprint.GreatPrint("Registry permissions for hive exploitation");
-
-            new List<Action>
-            {
-                PrintTypingInsightsPermissions,
-                PrintKnownSystemWritableKeys,
-                PrintHeuristicWritableKeys,
-            }.ForEach(action => CheckRunner.Run(action, isDebug));
-        }
-
-        private void PrintTypingInsightsPermissions()
-        {
-            Beaprint.MainPrint("Cross-user TypingInsights key (HKCU/HKU)");
-
-            var matches = new List<RegistryWritableKeyInfo>();
-            var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
-
-            if (RegistryAclScanner.TryGetWritableKey("HKCU", TypingInsightsRelativePath, out var currentUserKey))
-            {
-                if (seen.Add(currentUserKey.FullPath))
-                {
-                    matches.Add(currentUserKey);
-                }
-            }
-
-            foreach (var sid in RegistryHelper.GetUserSIDs())
-            {
-                if (string.IsNullOrEmpty(sid) || sid.Equals(".DEFAULT", StringComparison.OrdinalIgnoreCase) || sid.EndsWith("_Classes", StringComparison.OrdinalIgnoreCase))
-                {
-                    continue;
-                }
-
-                string relativePath = $"{sid}\\{TypingInsightsRelativePath}";
-                if (RegistryAclScanner.TryGetWritableKey("HKU", relativePath, out var info) && seen.Add(info.FullPath))
-                {
-                    matches.Add(info);
-                }
-            }
-
-            if (matches.Count == 0)
-            {
-                Beaprint.GrayPrint("  [-] TypingInsights key does not grant write access to low-privileged groups.");
-                return;
-            }
-
-            PrintEntries(matches);
-            Beaprint.LinkPrint("https://projectzero.google/2025/05/the-windows-registry-adventure-8-exploitation.html", "Writable TypingInsights enables cross-user hive tampering and DoS.");
-        }
-
-        private void PrintKnownSystemWritableKeys()
-        {
-            Beaprint.MainPrint("Known HKLM descendants writable by standard users");
-
-            var matches = new List<RegistryWritableKeyInfo>();
-            foreach (var path in KnownWritableSystemKeyCandidates)
-            {
-                if (RegistryAclScanner.TryGetWritableKey("HKLM", path, out var info))
-                {
-                    matches.Add(info);
-                }
-            }
-
-            if (matches.Count == 0)
-            {
-                Beaprint.GrayPrint("  [-] None of the tracked HKLM keys are writable by low-privileged groups.");
-                return;
-            }
-
-            PrintEntries(matches);
-        }
-
-        private void PrintHeuristicWritableKeys()
-        {
-            Beaprint.MainPrint("Sample of additional writable HKLM keys (depth-limited scan)");
-
-            var matches = RegistryAclScanner.ScanWritableKeys("HKLM", ScanBasePaths, maxDepth: 3, maxResults: 25);
-            if (matches.Count == 0)
-            {
-                Beaprint.GrayPrint("  [-] No additional writable HKLM keys were found within the sampled paths.");
-                return;
-            }
-
-            PrintEntries(matches);
-            Beaprint.GrayPrint("  [*] Showing up to 25 entries from the sampled paths to avoid noisy output.");
-        }
-
-        private static void PrintEntries(IEnumerable<RegistryWritableKeyInfo> entries)
-        {
-            foreach (var entry in entries)
-            {
-                var principals = string.Join(", ", entry.Principals);
-                var rights = entry.Rights.Count > 0 ? string.Join(", ", entry.Rights.Distinct(StringComparer.OrdinalIgnoreCase)) : "Write access";
-                var displayPath = string.IsNullOrEmpty(entry.FullPath) ? $"{entry.Hive}\\{entry.RelativePath}" : entry.FullPath;
-                Beaprint.BadPrint($"  [!] {displayPath} -> {principals} ({rights})");
-            }
-        }
-    }
-}

winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs

@@ -132,7 +132,6 @@ namespace winPEAS.Helpers
             Console.WriteLine(LCYAN + "        activedirectoryinfo" + GRAY + "   Quick AD checks (gMSA readable passwords, AD CS template rights)" + NOCOLOR);
             Console.WriteLine(LCYAN + "        cloudinfo" + GRAY + "            Enumerate cloud information" + NOCOLOR);
             Console.WriteLine(LCYAN + "        windowscreds" + GRAY + "         Search windows credentials" + NOCOLOR);
-            Console.WriteLine(LCYAN + "        registryinfo" + GRAY + "         Flag writable HKLM/HKU keys that enable hive tampering" + NOCOLOR);
             Console.WriteLine(LCYAN + "        browserinfo" + GRAY + "          Search browser information" + NOCOLOR);
             Console.WriteLine(LCYAN + "        filesinfo" + GRAY + "            Search generic files that can contains credentials" + NOCOLOR);
             Console.WriteLine(LCYAN + "        fileanalysis" + GRAY + "         [NOT RUN BY DEFAULT] Search specific files that can contains credentials and for regexes inside files. Might take several minutes." + NOCOLOR);

winPEAS/winPEASexe/winPEAS/Helpers/Registry/RegistryAclScanner.cs

@@ -1,221 +0,0 @@
-using Microsoft.Win32;
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Security.AccessControl;
-using System.Security.Principal;
-using winPEAS.Helpers;
-
-namespace winPEAS.Helpers.Registry
-{
-    internal class RegistryWritableKeyInfo
-    {
-        public string Hive { get; set; }
-        public string RelativePath { get; set; }
-        public string FullPath { get; set; }
-        public List<string> Principals { get; set; } = new List<string>();
-        public List<string> Rights { get; set; } = new List<string>();
-    }
-
-    internal static class RegistryAclScanner
-    {
-        private static readonly Dictionary<string, string> LowPrivSidMap = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
-        {
-            { new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null).Value, "BUILTIN\\Users" },
-            { new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null).Value, "Authenticated Users" },
-            { new SecurityIdentifier(WellKnownSidType.WorldSid, null).Value, "Everyone" },
-            { new SecurityIdentifier(WellKnownSidType.InteractiveSid, null).Value, "Interactive" },
-            { new SecurityIdentifier(WellKnownSidType.BuiltinGuestsSid, null).Value, "BUILTIN\\Guests" },
-        };
-
-        public static bool TryGetWritableKey(string hive, string relativePath, out RegistryWritableKeyInfo info)
-        {
-            info = null;
-            using (var key = OpenKey(hive, relativePath))
-            {
-                if (key == null)
-                {
-                    return false;
-                }
-
-                return TryCollectWritableInfo(hive, relativePath, key, out info);
-            }
-        }
-
-        public static List<RegistryWritableKeyInfo> ScanWritableKeys(string hive, IEnumerable<string> basePaths, int maxDepth, int maxResults)
-        {
-            var results = new List<RegistryWritableKeyInfo>();
-            var seenPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
-
-            foreach (var basePath in basePaths ?? Enumerable.Empty<string>())
-            {
-                if (results.Count >= maxResults)
-                {
-                    break;
-                }
-
-                using (var key = OpenKey(hive, basePath))
-                {
-                    if (key == null)
-                    {
-                        continue;
-                    }
-
-                    Traverse(hive, key, basePath, 0, maxDepth, maxResults, seenPaths, results);
-                }
-            }
-
-            return results;
-        }
-
-        private static void Traverse(string hive, RegistryKey currentKey, string currentPath, int depth, int maxDepth, int maxResults, HashSet<string> seenPaths, List<RegistryWritableKeyInfo> results)
-        {
-            if (currentKey == null || results.Count >= maxResults)
-            {
-                return;
-            }
-
-            if (TryCollectWritableInfo(hive, currentPath, currentKey, out var info))
-            {
-                if (seenPaths.Add(info.FullPath))
-                {
-                    results.Add(info);
-                }
-
-                if (results.Count >= maxResults)
-                {
-                    return;
-                }
-            }
-
-            if (depth >= maxDepth)
-            {
-                return;
-            }
-
-            string[] subKeys;
-            try
-            {
-                subKeys = currentKey.GetSubKeyNames();
-            }
-            catch
-            {
-                return;
-            }
-
-            foreach (var subKeyName in subKeys)
-            {
-                if (results.Count >= maxResults)
-                {
-                    break;
-                }
-
-                try
-                {
-                    using (var childKey = currentKey.OpenSubKey(subKeyName))
-                    {
-                        if (childKey == null)
-                        {
-                            continue;
-                        }
-
-                        string childPath = string.IsNullOrEmpty(currentPath) ? subKeyName : $"{currentPath}\\{subKeyName}";
-                        Traverse(hive, childKey, childPath, depth + 1, maxDepth, maxResults, seenPaths, results);
-                    }
-                }
-                catch
-                {
-                    // Ignore keys we cannot open
-                }
-            }
-        }
-
-        private static bool TryCollectWritableInfo(string hive, string relativePath, RegistryKey key, out RegistryWritableKeyInfo info)
-        {
-            info = null;
-
-            try
-            {
-                var acl = key.GetAccessControl(AccessControlSections.Access);
-
-                var principals = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
-                var rights = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
-
-                foreach (RegistryAccessRule rule in acl.GetAccessRules(true, true, typeof(SecurityIdentifier)))
-                {
-                    if (rule.AccessControlType != AccessControlType.Allow)
-                    {
-                        continue;
-                    }
-
-                    var sid = rule.IdentityReference as SecurityIdentifier ?? rule.IdentityReference.Translate(typeof(SecurityIdentifier)) as SecurityIdentifier;
-                    if (sid == null)
-                    {
-                        continue;
-                    }
-
-                    if (!LowPrivSidMap.TryGetValue(sid.Value, out var label))
-                    {
-                        continue;
-                    }
-
-                    string interestingRight = PermissionsHelper.PermInt2Str((int)rule.RegistryRights, PermissionType.WRITEABLE_OR_EQUIVALENT_REG);
-                    if (string.IsNullOrEmpty(interestingRight))
-                    {
-                        continue;
-                    }
-
-                    principals.Add($"{label} ({sid.Value})");
-                    rights.Add(interestingRight);
-                }
-
-                if (principals.Count == 0)
-                {
-                    return false;
-                }
-
-                string normalizedRelativePath = relativePath ?? string.Empty;
-                string fullPath = string.IsNullOrEmpty(normalizedRelativePath) ? key.Name : $"{hive}\\{normalizedRelativePath}";
-
-                info = new RegistryWritableKeyInfo
-                {
-                    Hive = hive,
-                    RelativePath = normalizedRelativePath,
-                    FullPath = fullPath,
-                    Principals = principals.ToList(),
-                    Rights = rights.ToList(),
-                };
-                return true;
-            }
-            catch
-            {
-                return false;
-            }
-        }
-
-        private static RegistryKey OpenKey(string hive, string path)
-        {
-            if (string.IsNullOrEmpty(path))
-            {
-                return null;
-            }
-
-            try
-            {
-                RegistryKey baseKey = hive switch
-                {
-                    "HKLM" => Microsoft.Win32.Registry.LocalMachine,
-                    "HKCU" => Microsoft.Win32.Registry.CurrentUser,
-                    "HKU" => Microsoft.Win32.Registry.Users,
-                    _ => null,
-                };
-
-                return baseKey?.OpenSubKey(path);
-            }
-            catch
-            {
-                return null;
-            }
-        }
-    }
-}

winPEAS/winPEASexe/winPEAS/winPEAS.csproj

@@ -1201,7 +1201,6 @@
     <Compile Include="Checks\SystemInfo.cs" />
     <Compile Include="Checks\UserInfo.cs" />
     <Compile Include="Checks\WindowsCreds.cs" />
-    <Compile Include="Checks\RegistryInfo.cs" />
     <Compile Include="Helpers\AppLocker\AppLockerHelper.cs" />
     <Compile Include="Helpers\AppLocker\AppLockerRules.cs" />
     <Compile Include="Helpers\AppLocker\IAppIdPolicyHandler.cs" />
@@ -1470,7 +1469,6 @@
     <Compile Include="Helpers\CheckRunner.cs" />
     <Compile Include="Helpers\ReflectionHelper.cs" />
     <Compile Include="Helpers\Registry\RegistryHelper.cs" />
-    <Compile Include="Helpers\Registry\RegistryAclScanner.cs" />
     <Compile Include="Helpers\Search\SearchHelper.cs" />
     <Compile Include="Wifi\Wifi.cs" />
     <Compile Include="Wifi\NativeWifiApi\Interop.cs" />