[Suggestion] Enumerate 3rd Party Drivers on Windows about peass-ng HOT 7 CLOSED

Hi @kazkansouh,

Thanks for the suggestion.
I haven't run the code but I suppose we cannot filter by provider name the list of drivers given by the C code as you did in the power-shell on-liner right?
Also, would you like to try to implement it and make a push request?

from peass-ng.

@carlospolop yep, you are correct the API I pointed out just lists the file names, and optionally the whole path of the loaded dll. As far as I can tell the additional information from tools like driverquery appear (I still need to check) to come from the SCM, and the meta information from the Win32_PnPSignedDriver WMI class comes from the digital signatures.

It might make sense to try taking the module names and reading the signatures from them. This would alleviate the need for having a whitelist of Microsoft drivers (assuming all Microsoft drivers are signed, the devil is always in the detail) and come close to the one-liner placed before without the need for WMI access.

Sure, I'll can think about putting PR together, but I still need to do some more testing of the ideas. Hopefully within a couple weeks Ill find the time to submit something.

from peass-ng.

Hey @kazkansouh,

That looks really promising. Good idea to try to filter Microsoft drivers.
If you can prepare a PR and I will merge it with the master version.

Thank you.

from peass-ng.

Hi @kazkansouh,

How is this going?

from peass-ng.

Hello @carlospolop -- I'm currently focused working through OSCP labs at the moment. Ideally I'm waiting to come across a nice machine to develop and test the code against (so I am killing two birds in one stone 😎), if not, Ill set one up myself but that will be when I have time to look at this in more depth.

from peass-ng.

Hi @kazkansouh,

Thank you very much for the pull request. I have merged it and updated Winpeas to add colours to the output (file and folder permissions of the drivers are now checked).
I have also created a new release (Winpeasv1.1) where the new functionality is working.
Thank you again, and let me know if you have more ideas!

from peass-ng.

The changes look good - that's a nice idea to check permissions.

from peass-ng.