Comments (7)
No worries, thank you for your time.
I just did a quick test and it seems to be working fine.
from privesccheck.
Hi,
I think that would be a completely different check.
With Invoke-WinlogonCheck
I check whether the registry key is present and if it contains a cleartext password.
WIth Invoke-GPPPasswordCheck
, on the other hand, I was already parsing local Group Policy files, so implementing a "remote" version was easy because I just had to change the path used for the file search.
For Winlogon
I don't even know which file to look for. Perhaps you could elaborate a bit on what you expect.
As far as I know you need to create a GPO that populates the Winlogon
registry key "manually".
This means that I would need to grep all the cached GPO files. 🤔
from privesccheck.
Hi,
My bad, I didn't closely check the source code of Invoke-WinlogonCheck
.
I think these settings can only be configured through Computer configuration > Preferences > Windows Settings > Registry
and the corresponding file is \\dc\sysvol\test.lab\Policies\<guid>\Machine\Preferences\Registry\Registry.xml
. Here's a sample: Registry.xml.
I think the annoying part is that technically, it's possible to add duplicate registry key/values in a group policy. I created the following sample snippet based on Invoke-GPPPasswordCheck
which I think is correct but it's quite ugly.
$GppPath = "\\$($Env:USERDNSDOMAIN)\SYSVOL"
$CachedGPPFiles = Get-ChildItem -Path $GppPath -Recurse -Include 'Registry.xml' -Force -ErrorAction SilentlyContinue
foreach ($File in $CachedGPPFiles) {
$FileFullPath = $File.FullName
Write-Verbose $FileFullPath
try {
[xml]$XmlFile = Get-Content -Path $FileFullPath -ErrorAction SilentlyContinue
}
catch [Exception] {
Write-Verbose $_.Exception.Message
}
if ($null -eq $XmlFile) {
continue
}
$Results = New-Object -TypeName PSObject -Property @{
DefaultDomainName = [System.Collections.ArrayList]@()
DefaultUserName = [System.Collections.ArrayList]@()
DefaultPassword = [System.Collections.ArrayList]@()
AutoAdminLogon = [System.Collections.ArrayList]@()
AltDefaultDomainName = [System.Collections.ArrayList]@()
AltDefaultUserName = [System.Collections.ArrayList]@()
AltDefaultPassword = [System.Collections.ArrayList]@()
AltAutoAdminLogon = [System.Collections.ArrayList]@()
}
$XmlFile.GetElementsByTagName("Properties") | ForEach-Object {
$Properties = $_
if ([string]::IsNullOrEmpty($Properties.value)) {
return
}
switch ($Properties.name) {
DefaultDomainName {
$null = $Results.DefaultDomainName.Add($Properties.value)
}
DefaultUserName {
$null = $Results.DefaultUserName.Add($Properties.value)
}
DefaultPassword {
$null = $Results.DefaultPassword.Add($Properties.value)
}
AutoAdminLogon {
$null = $Results.AutoAdminLogon.Add($Properties.value)
}
AltDefaultDomainName {
$null = $Results.AltDefaultDomainName.Add($Properties.value)
}
AltDefaultUserName {
$null = $Results.AltDefaultUserName.Add($Properties.value)
}
AltDefaultPassword {
$null = $Results.AltDefaultPassword.Add($Properties.value)
}
AltAutoAdminLogon {
$null = $Results.AltAutoAdminLogon.Add($Properties.value)
}
}
}
if ($Results.DefaultPassword.Count -ne 0) {
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "Domains" -Value $Results.DefaultDomainName
$Result | Add-Member -MemberType "NoteProperty" -Name "Usernames" -Value $Results.DefaultUserName
$Result | Add-Member -MemberType "NoteProperty" -Name "Passwords" -Value $Results.DefaultPassword
$Result | Add-Member -MemberType "NoteProperty" -Name "AutoAdminLogons" -Value $Results.AutoAdminLogon
$Result
}
if ($Results.AltDefaultPassword.Count -ne 0) {
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "Domains" -Value $Results.AltDefaultDomainName
$Result | Add-Member -MemberType "NoteProperty" -Name "Usernames" -Value $Results.AltDefaultUserName
$Result | Add-Member -MemberType "NoteProperty" -Name "Passwords" -Value $Results.AltDefaultPassword
$Result | Add-Member -MemberType "NoteProperty" -Name "AutoAdminLogon" -Value $Results.AltAutoAdminLogon
$Result
}
}
from privesccheck.
Oh nice! Thank you very much for your detailed answer!
Your implementation seems pretty close to what I would have probably done.
I thought about another way to handle the duplicate values but I think the one you chose is the most relevant. As we cannot really determine which value is correct beforehand, the best solution is to return all the values as you did.
I will just make some slight adjustments but, overall, your code seems fine to me.
Thanks again. I will probably take care of this in the coming days. :)
from privesccheck.
I had to find the time and motivation to do it, but it's finally there!
I did some testing using the sample file you attached. It seems to work pretty fine.
But of course, I would be glad to have some feedback as well. 🙂
from privesccheck.
By the way, if you want to test it quickly, you can use the following command:
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-WinlogonCheck -Remote"
from privesccheck.
Nice! Thank you for your feedback.
So, I close the issue for now but don't hesitate to let me know if something looks wrong.
from privesccheck.
Related Issues (20)
- Wifi Airstrike Attack (CVE-2021-28316) already mitigated Apr 13, 2021 HOT 2
- Cannot find process with ID for UDP Endpoints HOT 2
- Specified cast is not valid HOT 9
- Windows 11 detected as Windows 10 HOT 3
- Scheduled Task: Binary Exploitation no detection HOT 2
- Empty WinLogon credentials HOT 1
- Check for vulnerable WPAD configuration? HOT 2
- Report Improvement Suggestion HOT 2
- [Improvement] Check for vulnerable drivers HOT 1
- SERVICES > Unquoted Path not work as expected HOT 3
- Credential Guard HOT 3
- [Feature Request] Readd Compliance Field HOT 4
- Getting erros when trying to run it HOT 2
- Get-HotFixList misses updates HOT 2
- LapsV2 is not being checked? HOT 3
- Check SMB signing required HOT 5
- Service binary permissions false positive HOT 1
- List ASR rules HOT 2
- Bug in Find-SccmCacheFileCredentials? HOT 2
- Detect Defender exclusions rules and ASR rules HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from privesccheck.