BUG - script don't launch

PrivescCheck

This script aims to identify Local Privilege Escalation (LPE) vulnerabilities that are usually due to Windows configuration issues, or bad practices. It can also gather useful information for some exploitation and post-exploitation tasks.

Getting started

After downloading the script and copying it onto the target Windows machine, run it using one of the commands below.

Note

You don't need to clone the entire repository. The file PrivescCheck.ps1 is a standalone PowerShell script that contains all the code required by PrivescCheck to run.

Important

In the commands below, the first . (dot) is used for "dot sourcing" the script, so that the functions and cmdlets can be used in the current scope (see PowerShell dot sourcing feature).

Basic checks only

Quickly identify important issues, such as local privilege escalation vulnerabilities.

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

Extended checks + human-readable reports

Identify important issues, but also gather additional information, and save the results to report files that are easy to read.

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"

All checks + all reports

Perform extended and audit checks, and save the results to human-readable reports, but also machine-readable files, which can later be parsed for automated report generation.

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Audit -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML,CSV,XML"

Check types

All the checks implemented in PrivescCheck have a Type. This value, and the flags specified on the command line, will determine if they are run, or not.

Base

Checks of type Base will always be executed, unless the script is run as an administrator. They are mainly intended for identifying privilege escalation vulnerabilities, or other important issues.

Extended

Checks of type Extended can only be executed if the option -Extended is specified on the command line. They are mainly intended for providing additional information that could be useful for exploit development, or post-exploitation.

Audit

Checks of type Audit can only be executed if the option -Audit is specified on the command line. They are mainly intended for providing information that is relevant in the context of a configuration audit.

Experimental

Checks of type Experimental can only be executed if the option -Experimental is specified on the command line. These are unstable checks that need further work. Use them with caution.

Tips and tricks

PowerShell execution policy

By default, the PowerShell execution policy is set to Restricted on clients, and RemoteSigned on servers, when a new powershell.exe process is started. These policies block the execution of (unsigned) scripts, but they can be overriden within the current scope as follows.

Set-ExecutionPolicy Bypass -Scope Process -Force
. .\PrivescCheck.ps1

However, this trick does not work when the execution policy is enforced through a GPO. In this case, after starting a new PowerShell session, you can load the script as follows.

Get-Content .\PrivescCheck.ps1 | Out-String | Invoke-Expression

PowerShell version 2

A common way to bypass Constrained Language Mode consists in starting PowerShell version 2 as it does not implement this protection. Therefore, a significant part of the development effort goes into maintaining this compatibility.

Note

Although PowerShell version 2 is still enabled by default on recent versions of Windows, it cannot run without the .Net framework version 2.0, which requires a manual install.

Known issues

Metasploit timeout

If you run this script within a Meterpreter session, you will likely get a "timeout" error. Metasploit has a "response timeout" value, which is set to 15 seconds by default, but this script takes a lot more time to run in most environments.

meterpreter > load powershell
Loading extension powershell...Success.
meterpreter > powershell_import /local/path/to/PrivescCheck.ps1
[+] File successfully imported. No result was returned.
meterpreter > powershell_execute "Invoke-PrivescCheck"
[-] Error running command powershell_execute: Rex::TimeoutError Operation timed out.

It is possible to set a different value thanks to the -t option of the sessions command (documentation). In the following example, a timeout of 2 minutes is set for the session with ID 1.

msf6 exploit(multi/handler) > sessions -t 120 -i 1
[*] Starting interaction with 1...
meterpreter > powershell_execute "Invoke-PrivescCheck"

	$TaskCommandLine = "$($TaskExec.Command) $($TaskExec.Arguments)"
	$Principal = $TaskXml.GetElementsByTagName("Principal")

	$CurrentUserIsOwner = $False

	if ($Principal.UserId) {
	$PrincipalName = Convert-SidToName -Sid $Principal.UserId

	if ($(Invoke-UserCheck).SID -eq $Principal.UserId) {
	$CurrentUserIsOwner = $True
	}
	} elseif ($Principal.GroupId) {
	$PrincipalName = Convert-SidToName -Sid $Principal.GroupId
	}

	if ($TaskExec.Command.Length -gt 0) {

	function Find-SccmCacheFileCredentials {
	<#
	.SYNOPSIS
	Helper - Find potentially hard coded credentials in SCCM cache files.

	Author: @itm4n
	License: BSD 3-Clause

	.DESCRIPTION
	This function first retrieves a list of potentially interesting files from the SCCM cache folders, and tries to find potentially hard coded credentials or secrets. For binary files, it simply determines whether there is a potential match, without returning anything to avoid messing up with the terminal output. For text files (incl. scripts), it returns all matching results.
	#>

	[CmdletBinding()]
	param ()

	begin {
	$Keywords = @( "password", "SecureString", "secret", "pwd", "token", "username" )
	$CredentialSearchPattern = "($($Keywords -join '\|'))"

	function Get-MatchedKeyword {
	param (
	[string] $InputMatched
	)
	$KeywordMatched = $null
	foreach ($Keyword in $Keywords) {
	$KeywordMatch = $InputMatched \| Select-String -Pattern $Keyword
	if ($null -ne $KeywordMatch) {
	$KeywordMatched = $Keyword
	break
	}
	}
	return $KeywordMatched
	}
	}

	process {

	$SccmCacheFolders = [object[]] (Get-SccmCacheFoldersFromRegistry)

	foreach ($SccmCacheFolder in $SccmCacheFolders) {

	$SccmCacheFiles = [object[]] (Get-SccmCacheFiles -Path $SccmCacheFolder.Path)

	foreach ($SccmCacheFile in $SccmCacheFiles) {

	$FileItem = Get-Item -Path $SccmCacheFile.Path -ErrorAction SilentlyContinue
	if ($null -eq $FileItem) { continue }

	if ($SccmCacheFile.Type -eq "Binary") {

	# For binary files, just check whether the target file matches at least
	# once, without returning anything.

	# Ignore files that are larger than 100 MB to avoid spending too much
	# time on the search.

	if ($FileItem.Length -gt 100000000) {
	Write-Warning "File '$($SccmCacheFile.Path) is too big, ignoring."
	continue
	}

	$TempMatch = Get-Content -Path $SccmCacheFile.Path \| Select-String -Pattern $CredentialSearchPattern
	if ($null -ne $TempMatch) {

	$Result = $SccmCacheFile.PSObject.Copy()
	$Result \| Add-Member -MemberType "NoteProperty" -Name "Match" -Value "(binary file matches)"
	$Result \| Add-Member -MemberType "NoteProperty" -Name "Keyword" -Value (Get-MatchedKeyword -InputMatched $TempMatch.Line)
	$Result
	}
	}
	elseif (($SccmCacheFile.Type -eq "Script") -or ($SccmCacheFile.Type -eq "Text")) {

	# For script files and misc text files, return all matches of the pattern.

	$TempMatch = Get-Content -Path $SccmCacheFile.Path \| Select-String -Pattern $CredentialSearchPattern -AllMatches
	if ($null -ne $TempMatch) {
	Write-Verbose "File '$($SccmCacheFile.Path)' matches pattern."
	foreach ($Match in $TempMatch) {

	$Result = $SccmCacheFile.PSObject.Copy()
	$Result \| Add-Member -MemberType "NoteProperty" -Name "Match" -Value "Line $($Match.LineNumber): $($Match.Line.Trim())"
	$Result \| Add-Member -MemberType "NoteProperty" -Name "Keyword" -Value (Get-MatchedKeyword -InputMatched $TempMatch.Line)
	$Result
	}
	}
	}
	else {
	throw "Unhandled file type: $($SccmCacheFile.Type)"
	}
	}
	}
	}
	}

itm4n / privesccheck Goto Github PK

privesccheck's Introduction

PrivescCheck

Getting started

Basic checks only

Extended checks + human-readable reports

All checks + all reports

Check types

Base

Extended

Audit

Experimental

Tips and tricks

PowerShell execution policy

PowerShell version 2

Known issues

Metasploit timeout

privesccheck's People

Contributors

Stargazers

Watchers

Forkers

privesccheck's Issues

Test Environment:

Steps to Reproduce:

Description:

Intune

GPO

Local

Recommend Projects

Recommend Topics

Recommend Org