1. <#
2. .SYNOPSIS
3.   PowerShell adaptation of WinPEAS.exe / WinPeas.bat
4. .DESCRIPTION
5.   For the legal enumeration of windows based computers that you either own or are approved to run this script on
6. .EXAMPLE
7.   # Default - normal operation with username/password audit in drives/registry
8.   .winPeas.ps1
9.  
10.   # Include Excel files in search: .xls, .xlsx, .xlsm
11.   .winPeas.ps1 -Excel
12.  
13.   # Full audit - normal operation with APIs / Keys / Tokens
14.   ## This will produce false positives ##
15.   .winPeas.ps1 -FullCheck
16.  
17.   # Add Time stamps to each command
18.   .winPeas.ps1 -TimeStamp
19.  
20. .NOTES
21.   Version:                    1.3
22.   PEASS-ng Original Author:   carlospolop
23.   winPEAS.ps1 Author:         @RandolphConley
24.   Creation Date:              10/4/2022
25.   Website:                    https://github.com/carlospolop/PEASS-ng
26.  
27.   TESTED: PoSh 5,7
28.   UNTESTED: PoSh 3,4
29.   NOT FULLY COMPATIBLE: PoSh 2 or lower
30. #>
31.  
32. ######################## FUNCTIONS ########################
33.  
34. [CmdletBinding()]
35. param(
36.   [switch]$TimeStamp,
37.   [switch]$FullCheck,
38.   [switch]$Excel
39. )
40.  
41. # Gather KB from all patches installed
42. function returnHotFixID {
43.   param(
44.     [string]$title
45.   )
46.   # Match on KB or if patch does not have a KB, return end result
47.   if (($title | Select-String -AllMatches -Pattern 'KB(d{4,6})').Matches.Value) {
48.     return (($title | Select-String -AllMatches -Pattern 'KB(d{4,6})').Matches.Value)
49.   }
50.   elseif (($title | Select-String -NotMatch -Pattern 'KB(d{4,6})').Matches.Value) {
51.     return (($title | Select-String -NotMatch -Pattern 'KB(d{4,6})').Matches.Value)
52.   }
53. }
54.  
55. Function Start-ACLCheck {
56.   param(
57.     $Target, $ServiceName)
58.   # Gather ACL of object
59.   if ($null -ne $target) {
60.     try {
61.       $ACLObject = Get-Acl $target -ErrorAction SilentlyContinue
62.     }
63.     catch { $null }
64.    
65.     # If Found, Evaluate Permissions
66.     if ($ACLObject) {
67.       $Identity = @()
68.       $Identity += "$env:COMPUTERNAME$env:USERNAME"
69.       if ($ACLObject.Owner -like $Identity ) { Write-Host "$Identity has ownership of $Target" -ForegroundColor Red }
70.       whoami.exe /groups /fo csv | ConvertFrom-Csv | Select-Object -ExpandProperty 'group name' | ForEach-Object { $Identity += $_ }
71.       $IdentityFound = $false
72.       foreach ($i in $Identity) {
73.         $permission = $ACLObject.Access | Where-Object { $_.IdentityReference -like $i }
74.         $UserPermission = ""
75.         switch -WildCard ($Permission.FileSystemRights) {
76.           "FullControl" { $userPermission = "FullControl"; $IdentityFound = $true }
77.           "Write*" { $userPermission = "Write"; $IdentityFound = $true }
78.           "Modify" { $userPermission = "Modify"; $IdentityFound = $true }
79.         }
80.         Switch ($permission.RegistryRights) {
81.           "FullControl" { $userPermission = "FullControl"; $IdentityFound = $true }
82.         }
83.         if ($UserPermission) {
84.           if ($ServiceName) { Write-Host "$ServiceName found with permissions issue:" -ForegroundColor Red }
85.           Write-Host -ForegroundColor red  "Identity $($permission.IdentityReference) has '$userPermission' perms for $Target"
86.         }
87.       }    
88.       # Identity Found Check - If False, loop through and stop at root of drive
89.       if ($IdentityFound -eq $false) {
90.         if ($Target.Length -gt 3) {
91.           $Target = Split-Path $Target
92.           Start-ACLCheck $Target -ServiceName $ServiceName
93.         }
94.       }
95.     }
96.     else {
97.       # If not found, split path one level and Check again
98.       $Target = Split-Path $Target
99.       Start-ACLCheck $Target $ServiceName
100.     }
101.   }
102. }
103.  
104. Function UnquotedServicePathCheck {
105.   Write-Host "Fetching the list of services, this may take a while...";
106.   $services = Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -inotmatch "`"" -and $_.PathName -inotmatch ":Windows" -and ($_.StartMode -eq "Auto" -or $_.StartMode -eq "Manual") -and ($_.State -eq "Running" -or $_.State -eq "Stopped") };
107.   if ($($services | Measure-Object).Count -lt 1) {
108.     Write-Host "No unquoted service paths were found";
109.   }
110.   else {
111.     $services | ForEach-Object {
112.       Write-Host "Unquoted Service Path found!" -ForegroundColor red
113.       Write-Host Name: $_.Name
114.       Write-Host PathName: $_.PathName
115.       Write-Host StartName: $_.StartName
116.       Write-Host StartMode: $_.StartMode
117.       Write-Host Running: $_.State
118.     }
119.   }
120. }
121.  
122. function TimeElapsed { Write-Host "Time Running: $($stopwatch.Elapsed.Minutes):$($stopwatch.Elapsed.Seconds)" }
123. Function Get-ClipBoardText {
124.   Add-Type -AssemblyName PresentationCore
125.   $text = [Windows.Clipboard]::GetText()
126.   if ($text) {
127.     Write-Host ""
128.     if ($TimeStamp) { TimeElapsed }
129.     Write-Host -ForegroundColor Blue "=========|| ClipBoard text found:"
130.     Write-Host $text
131.    
132.   }
133. }
134.  
135. Function Search-Excel {
136.   [cmdletbinding()]
137.   Param (
138.       [parameter(Mandatory, ValueFromPipeline)]
139.       [ValidateScript({
140.           Try {
141.               If (Test-Path -Path $_) {$True}
142.               Else {Throw "$($_) is not a valid path!"}
143.           }
144.           Catch {
145.               Throw $_
146.           }
147.       })]
148.       [string]$Source,
149.       [parameter(Mandatory)]
150.       [string]$SearchText
151.       #You can specify wildcard characters (*, ?)
152.   )
153.   $Excel = New-Object -ComObject Excel.Application
154.   Try {
155.       $Source = Convert-Path $Source
156.   }
157.   Catch {
158.       Write-Warning "Unable locate full path of $($Source)"
159.       BREAK
160.   }
161.   $Workbook = $Excel.Workbooks.Open($Source)
162.   ForEach ($Worksheet in @($Workbook.Sheets)) {
163.       # Find Method https://msdn.microsoft.com/en-us/vba/excel-vba/articles/range-find-method-excel
164.       $Found = $WorkSheet.Cells.Find($SearchText)
165.       If ($Found) {
166.         try{  
167.           # Address Method https://msdn.microsoft.com/en-us/vba/excel-vba/articles/range-address-property-excel
168.           Write-Host "Pattern: '$SearchText' found in $source" -ForegroundColor Blue
169.           $BeginAddress = $Found.Address(0,0,1,1)
170.           #Initial Found Cell
171.           [pscustomobject]@{
172.               WorkSheet = $Worksheet.Name
173.               Column = $Found.Column
174.               Row =$Found.Row
175.               TextMatch = $Found.Text
176.               Address = $BeginAddress
177.           }
178.           Do {
179.               $Found = $WorkSheet.Cells.FindNext($Found)
180.               $Address = $Found.Address(0,0,1,1)
181.               If ($Address -eq $BeginAddress) {
182.                 Write-host "Address is same as Begin Address"
183.                   BREAK
184.               }
185.               [pscustomobject]@{
186.                   WorkSheet = $Worksheet.Name
187.                   Column = $Found.Column
188.                   Row =$Found.Row
189.                   TextMatch = $Found.Text
190.                   Address = $Address
191.               }                
192.           } Until ($False)
193.         }
194.         catch {
195.           # Null expression in Found
196.         }
197.       }
198.       #Else {
199.       #    Write-Warning "[$($WorkSheet.Name)] Nothing Found!"
200.       #}
201.   }
202.   try{
203.   $workbook.close($False)
204.   [void][System.Runtime.InteropServices.Marshal]::ReleaseComObject([System.__ComObject]$excel)
205.   [gc]::Collect()
206.   [gc]::WaitForPendingFinalizers()
207.   }
208.   catch{
209.     #Usually an RPC error
210.   }
211.   Remove-Variable excel -ErrorAction SilentlyContinue
212. }
213.  
214. function Write-Color([String[]]$Text, [ConsoleColor[]]$Color) {
215.   for ($i = 0; $i -lt $Text.Length; $i++) {
216.     Write-Host $Text[$i] -Foreground $Color[$i] -NoNewline
217.   }
218.   Write-Host
219. }
220.  
221. #Write-Color "    ((,.,/((((((((((((((((((((/,  */" -Color Green
222. Write-Color ",/*,..*(((((((((((((((((((((((((((((((((," -Color Green
223. Write-Color ",*/((((((((((((((((((/,  .*//((//**, .*((((((*" -Color Green
224. Write-Color "((((((((((((((((", "* *****,,,", "########## .(* ,((((((" -Color Green, Blue, Green
225. Write-Color "(((((((((((", "/*******************", "####### .(. ((((((" -Color Green, Blue, Green
226. Write-Color "(((((((", "/******************", "/@@@@@/", "***", "#######((((((" -Color Green, Blue, White, Blue, Green
227. Write-Color ",,..", "**********************", "/@@@@@@@@@/", "***", ",#####./(((((" -Color Green, Blue, White, Blue, Green
228. Write-Color ", ,", "**********************", "/@@@@@+@@@/", "*********", "##((/ /((((" -Color Green, Blue, White, Blue, Green
229. Write-Color "..(((##########", "*********", "/#@@@@@@@@@/", "*************", ",,..((((" -Color Green, Blue, White, Blue, Green
230. Write-Color ".(((################(/", "******", "/@@@@@/", "****************", ".. /((" -Color Green, Blue, White, Blue, Green
231. Write-Color ".((########################(/", "************************", "..*(" -Color Green, Blue, Green
232. Write-Color ".((#############################(/", "********************", ".,(" -Color Green, Blue, Green
233. Write-Color ".((##################################(/", "***************", "..(" -Color Green, Blue, Green
234. Write-Color ".((######################################(/", "***********", "..(" -Color Green, Blue, Green
235. Write-Color ".((######", "(,.***.,(", "###################", "(..***", "(/*********", "..(" -Color Green, Green, Green, Green, Blue, Green
236. Write-Color ".((######*", "(####((", "###################", "((######", "/(********", "..(" -Color Green, Green, Green, Green, Blue, Green
237. Write-Color ".((##################", "(/**********(", "################(**...(" -Color Green, Green, Green
238. Write-Color ".(((####################", "/*******(", "###################.((((" -Color Green, Green, Green
239. Write-Color ".(((((############################################/  /((" -Color Green
240. Write-Color "..(((((#########################################(..(((((." -Color Green
241. Write-Color "....(((((#####################################( .((((((." -Color Green
242. Write-Color "......(((((#################################( .(((((((." -Color Green
243. Write-Color "(((((((((. ,(############################(../(((((((((." -Color Green
244. Write-Color "  (((((((((/,  ,####################(/..((((((((((." -Color Green
245. Write-Color "        (((((((((/,.  ,*//////*,. ./(((((((((((." -Color Green
246. Write-Color "           (((((((((((((((((((((((((((/" -Color Green
247. Write-Color "          by CarlosPolop & RandolphConley" -Color Green
248.  
249. ######################## VARIABLES ########################
250.  
251. # Manually added Regex search strings from https://github.com/carlospolop/PEASS-ng/blob/master/build_lists/sensitive_files.yaml
252.  
253. # Set these values to true to add them to the regex search by default
254. $password = $true
255. $username = $true
256. $webAuth = $true
257.  
258. $regexSearch = @{}
259.  
260. if ($password) {
261.   $regexSearch.add("Simple Passwords1", "pass.*[=:].+")
262.   $regexSearch.add("Simple Passwords2", "pwd.*[=:].+")
263.   $regexSearch.add("Apr1 MD5", '$apr1$[a-zA-Z0-9_/.]{8}$[a-zA-Z0-9_/.]{22}')
264.   $regexSearch.add("Apache SHA", "{SHA}[0-9a-zA-Z/_=]{10,}")
265.   $regexSearch.add("Blowfish", '$2[abxyz]?$[0-9]{2}$[a-zA-Z0-9_/.]*')
266.   $regexSearch.add("Drupal", '$S$[a-zA-Z0-9_/.]{52}')
267.   $regexSearch.add("Joomlavbulletin", "[0-9a-zA-Z]{32}:[a-zA-Z0-9_]{16,32}")
268.   $regexSearch.add("Linux MD5", '$1$[a-zA-Z0-9_/.]{8}$[a-zA-Z0-9_/.]{22}')
269.   $regexSearch.add("phpbb3", '$H$[a-zA-Z0-9_/.]{31}')
270.   $regexSearch.add("sha512crypt", '$6$[a-zA-Z0-9_/.]{16}$[a-zA-Z0-9_/.]{86}')
271.   $regexSearch.add("Wordpress", '$P$[a-zA-Z0-9_/.]{31}')
272.   $regexSearch.add("md5", "(^|[^a-zA-Z0-9])[a-fA-F0-9]{32}([^a-zA-Z0-9]|$)")
273.   $regexSearch.add("sha1", "(^|[^a-zA-Z0-9])[a-fA-F0-9]{40}([^a-zA-Z0-9]|$)")
274.   $regexSearch.add("sha256", "(^|[^a-zA-Z0-9])[a-fA-F0-9]{64}([^a-zA-Z0-9]|$)")
275.   $regexSearch.add("sha512", "(^|[^a-zA-Z0-9])[a-fA-F0-9]{128}([^a-zA-Z0-9]|$)")  
276.   # This does not work correctly
277.   #$regexSearch.add("Base32", "(?:[A-Z2-7]{8})*(?:[A-Z2-7]{2}={6}|[A-Z2-7]{4}={4}|[A-Z2-7]{5}={3}|[A-Z2-7]{7}=)?")
278.   $regexSearch.add("Base64", "(eyJ|YTo|Tzo|PD[89]|aHR0cHM6L|aHR0cDo|rO0)[a-zA-Z0-9+/]+={0,2}")
279.  
280. }
281. if ($username) {
282.   $regexSearch.add("Usernames1", "username[=:].+")
283.   $regexSearch.add("Usernames2", "user[=:].+")
284.   $regexSearch.add("Usernames3", "login[=:].+")
285.   $regexSearch.add("Emails", "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+.[A-Za-z]{2,6}")
286.   $regexSearch.add("Net user add", "net user .+ /add")
287. }
288.  
289. if ($FullCheck) {
290.   $regexSearch.add("Artifactory API Token", "AKC[a-zA-Z0-9]{10,}")
291.   $regexSearch.add("Artifactory Password", "AP[0-9ABCDEF][a-zA-Z0-9]{8,}")
292.   $regexSearch.add("Adafruit API Key", "([a-z0-9_-]{32})")
293.   $regexSearch.add("Adafruit API Key", "([a-z0-9_-]{32})")
294.   $regexSearch.add("Adobe Client Id (Oauth Web)", "(adobe[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-f0-9]{32})['""]")
295.   $regexSearch.add("Abode Client Secret", "(p8e-)[a-z0-9]{32}")
296.   $regexSearch.add("Age Secret Key", "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}")
297.   $regexSearch.add("Airtable API Key", "([a-z0-9]{17})")
298.   $regexSearch.add("Alchemi API Key", "(alchemi[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9-]{32})['""]")
299.   $regexSearch.add("Artifactory API Key & Password", "[""']AKC[a-zA-Z0-9]{10,}[""']|[""']AP[0-9ABCDEF][a-zA-Z0-9]{8,}[""']")
300.   $regexSearch.add("Atlassian API Key", "(atlassian[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{24})['""]")
301.   $regexSearch.add("Binance API Key", "(binance[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9]{64})['""]")
302.   $regexSearch.add("Bitbucket Client Id", "((bitbucket[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{32})['""])")
303.   $regexSearch.add("Bitbucket Client Secret", "((bitbucket[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9_-]{64})['""])")
304.   $regexSearch.add("BitcoinAverage API Key", "(bitcoin.?average[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9]{43})['""]")
305.   $regexSearch.add("Bitquery API Key", "(bitquery[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([A-Za-z0-9]{32})['""]")
306.   $regexSearch.add("Bittrex Access Key and Access Key", "([a-z0-9]{32})")
307.   $regexSearch.add("Birise API Key", "(bitrise[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9_-]{86})['""]")
308.   $regexSearch.add("Block API Key", "(block[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4})['""]")
309.   $regexSearch.add("Blockchain API Key", "mainnet[a-zA-Z0-9]{32}|testnet[a-zA-Z0-9]{32}|ipfs[a-zA-Z0-9]{32}")
310.   $regexSearch.add("Blockfrost API Key", "(blockchain[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[0-9a-f]{12})['""]")
311.   $regexSearch.add("Box API Key", "(box[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9]{32})['""]")
312.   $regexSearch.add("Bravenewcoin API Key", "(bravenewcoin[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{50})['""]")
313.   $regexSearch.add("Clearbit API Key", "sk_[a-z0-9]{32}")
314.   $regexSearch.add("Clojars API Key", "(CLOJARS_)[a-zA-Z0-9]{60}")
315.   $regexSearch.add("Coinbase Access Token", "([a-z0-9_-]{64})")
316.   $regexSearch.add("Coinlayer API Key", "(coinlayer[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{32})['""]")
317.   $regexSearch.add("Coinlib API Key", "(coinlib[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{16})['""]")
318.   $regexSearch.add("Confluent Access Token & Secret Key", "([a-z0-9]{16})")
319.   $regexSearch.add("Contentful delivery API Key", "(contentful[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9=_-]{43})['""]")
320.   $regexSearch.add("Covalent API Key", "ckey_[a-z0-9]{27}")
321.   $regexSearch.add("Charity Search API Key", "(charity.?search[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{32})['""]")
322.   $regexSearch.add("Databricks API Key", "dapi[a-h0-9]{32}")
323.   $regexSearch.add("DDownload API Key", "(ddownload[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{22})['""]")
324.   $regexSearch.add("Defined Networking API token", "(dnkey-[a-z0-9=_-]{26}-[a-z0-9=_-]{52})")
325.   $regexSearch.add("Discord API Key, Client ID & Client Secret", "((discord[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-h0-9]{64}|[0-9]{18}|[a-z0-9=_-]{32})['""])")
326.   $regexSearch.add("Droneci Access Token", "([a-z0-9]{32})")
327.   $regexSearch.add("Dropbox API Key", "sl.[a-zA-Z0-9_-]{136}")
328.   $regexSearch.add("Doppler API Key", "(dp.pt.)[a-zA-Z0-9]{43}")
329.   $regexSearch.add("Dropbox API secret/key, short & long lived API Key", "(dropbox[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{15}|sl.[a-z0-9=_-]{135}|[a-z0-9]{11}(AAAAAAAAAA)[a-z0-9_=-]{43})['""]")
330.   $regexSearch.add("Duffel API Key", "duffel_(test|live)_[a-zA-Z0-9_-]{43}")
331.   $regexSearch.add("Dynatrace API Key", "dt0c01.[a-zA-Z0-9]{24}.[a-z0-9]{64}")
332.   $regexSearch.add("EasyPost API Key", "EZAK[a-zA-Z0-9]{54}")
333.   $regexSearch.add("EasyPost test API Key", "EZTK[a-zA-Z0-9]{54}")
334.   $regexSearch.add("Etherscan API Key", "(etherscan[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([A-Z0-9]{34})['""]")
335.   $regexSearch.add("Etsy Access Token", "([a-z0-9]{24})")
336.   $regexSearch.add("Facebook Access Token", "EAACEdEose0cBA[0-9A-Za-z]+")
337.   $regexSearch.add("Fastly API Key", "(fastly[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9=_-]{32})['""]")
338.   $regexSearch.add("Finicity API Key & Client Secret", "(finicity[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-f0-9]{32}|[a-z0-9]{20})['""]")
339.   $regexSearch.add("Flickr Access Token", "([a-z0-9]{32})")
340.   $regexSearch.add("Flutterweave Keys", "FLWPUBK_TEST-[a-hA-H0-9]{32}-X|FLWSECK_TEST-[a-hA-H0-9]{32}-X|FLWSECK_TEST[a-hA-H0-9]{12}")
341.   $regexSearch.add("Frame.io API Key", "fio-u-[a-zA-Z0-9_=-]{64}")
342.   $regexSearch.add("Freshbooks Access Token", "([a-z0-9]{64})")
343.   $regexSearch.add("Github", "github(.{0,20})?['""][0-9a-zA-Z]{35,40}")
344.   $regexSearch.add("Github App Token", "(ghu|ghs)_[0-9a-zA-Z]{36}")
345.   $regexSearch.add("Github OAuth Access Token", "gho_[0-9a-zA-Z]{36}")
346.   $regexSearch.add("Github Personal Access Token", "ghp_[0-9a-zA-Z]{36}")
347.   $regexSearch.add("Github Refresh Token", "ghr_[0-9a-zA-Z]{76}")
348.   $regexSearch.add("GitHub Fine-Grained Personal Access Token", "github_pat_[0-9a-zA-Z_]{82}")
349.   $regexSearch.add("Gitlab Personal Access Token", "glpat-[0-9a-zA-Z-]{20}")
350.   $regexSearch.add("GitLab Pipeline Trigger Token", "glptt-[0-9a-f]{40}")
351.   $regexSearch.add("GitLab Runner Registration Token", "GR1348941[0-9a-zA-Z_-]{20}")
352.   $regexSearch.add("Gitter Access Token", "([a-z0-9_-]{40})")
353.   $regexSearch.add("GoCardless API Key", "live_[a-zA-Z0-9_=-]{40}")
354.   $regexSearch.add("GoFile API Key", "(gofile[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9]{32})['""]")
355.   $regexSearch.add("Google API Key", "AIza[0-9A-Za-z_-]{35}")
356.   $regexSearch.add("Google Cloud Platform API Key", "(google|gcp|youtube|drive|yt)(.{0,20})?['""][AIza[0-9a-z_-]{35}]['""]")
357.   $regexSearch.add("Google Drive Oauth", "[0-9]+-[0-9A-Za-z_]{32}.apps.googleusercontent.com")
358.   $regexSearch.add("Google Oauth Access Token", "ya29.[0-9A-Za-z_-]+")
359.   $regexSearch.add("Google (GCP) Service-account", """type.+:.+""service_account")
360.   $regexSearch.add("Grafana API Key", "eyJrIjoi[a-z0-9_=-]{72,92}")
361.   $regexSearch.add("Grafana cloud api token", "glc_[A-Za-z0-9+/]{32,}={0,2}")
362.   $regexSearch.add("Grafana service account token", "(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})")
363.   $regexSearch.add("Hashicorp Terraform user/org API Key", "[a-z0-9]{14}.atlasv1.[a-z0-9_=-]{60,70}")
364.   $regexSearch.add("Heroku API Key", "[hH][eE][rR][oO][kK][uU].{0,30}[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}")
365.   $regexSearch.add("Hubspot API Key", "['""][a-h0-9]{8}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{12}['""]")
366.   $regexSearch.add("Instatus API Key", "(instatus[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{32})['""]")
367.   $regexSearch.add("Intercom API Key & Client Secret/ID", "(intercom[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9=_]{60}|[a-h0-9]{8}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{12})['""]")
368.   $regexSearch.add("Ionic API Key", "(ionic[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""](ion_[a-z0-9]{42})['""]")
369.   $regexSearch.add("JSON Web Token", "(ey[0-9a-z]{30,34}.ey[0-9a-z/_-]{30,}.[0-9a-zA-Z/_-]{10,}={0,2})")
370.   $regexSearch.add("Kraken Access Token", "([a-z0-9/=_+-]{80,90})")
371.   $regexSearch.add("Kucoin Access Token", "([a-f0-9]{24})")
372.   $regexSearch.add("Kucoin Secret Key", "([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})")
373.   $regexSearch.add("Launchdarkly Access Token", "([a-z0-9=_-]{40})")
374.   $regexSearch.add("Linear API Key", "(lin_api_[a-zA-Z0-9]{40})")
375.   $regexSearch.add("Linear Client Secret/ID", "((linear[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-f0-9]{32})['""])")
376.   $regexSearch.add("LinkedIn Client ID", "linkedin(.{0,20})?['""][0-9a-z]{12}['""]")
377.   $regexSearch.add("LinkedIn Secret Key", "linkedin(.{0,20})?['""][0-9a-z]{16}['""]")
378.   $regexSearch.add("Lob API Key", "((lob[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]((live|test)_[a-f0-9]{35})['""])|((lob[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]((test|live)_pub_[a-f0-9]{31})['""])")
379.   $regexSearch.add("Lob Publishable API Key", "((test|live)_pub_[a-f0-9]{31})")
380.   $regexSearch.add("MailboxValidator", "(mailbox.?validator[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([A-Z0-9]{20})['""]")
381.   $regexSearch.add("Mailchimp API Key", "[0-9a-f]{32}-us[0-9]{1,2}")
382.   $regexSearch.add("Mailgun API Key", "key-[0-9a-zA-Z]{32}'")
383.   $regexSearch.add("Mailgun Public Validation Key", "pubkey-[a-f0-9]{32}")
384.   $regexSearch.add("Mailgun Webhook signing key", "[a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8}")
385.   $regexSearch.add("Mapbox API Key", "(pk.[a-z0-9]{60}.[a-z0-9]{22})")
386.   $regexSearch.add("Mattermost Access Token", "([a-z0-9]{26})")
387.   $regexSearch.add("MessageBird API Key & API client ID", "(messagebird[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{25}|[a-h0-9]{8}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{12})['""]")
388.   $regexSearch.add("Microsoft Teams Webhook", "https://[a-z0-9]+.webhook.office.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}")
389.   $regexSearch.add("MojoAuth API Key", "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}")
390.   $regexSearch.add("Netlify Access Token", "([a-z0-9=_-]{40,46})")
391.   $regexSearch.add("New Relic User API Key, User API ID & Ingest Browser API Key", "(NRAK-[A-Z0-9]{27})|((newrelic[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([A-Z0-9]{64})['""])|(NRJS-[a-f0-9]{19})")
392.   $regexSearch.add("Nownodes", "(nownodes[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([A-Za-z0-9]{32})['""]")
393.   $regexSearch.add("Npm Access Token", "(npm_[a-zA-Z0-9]{36})")
394.   $regexSearch.add("Nytimes Access Token", "([a-z0-9=_-]{32})")
395.   $regexSearch.add("Okta Access Token", "([a-z0-9=_-]{42})")
396.   $regexSearch.add("OpenAI API Token", "sk-[A-Za-z0-9]{48}")
397.   $regexSearch.add("ORB Intelligence Access Key", "['""][a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}['""]")
398.   $regexSearch.add("Pastebin API Key", "(pastebin[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{32})['""]")
399.   $regexSearch.add("PayPal Braintree Access Token", 'access_token$production$[0-9a-z]{16}$[0-9a-f]{32}')
400.   $regexSearch.add("Picatic API Key", "sk_live_[0-9a-z]{32}")
401.   $regexSearch.add("Pinata API Key", "(pinata[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{64})['""]")
402.   $regexSearch.add("Planetscale API Key", "pscale_tkn_[a-zA-Z0-9_.-]{43}")
403.   $regexSearch.add("PlanetScale OAuth token", "(pscale_oauth_[a-zA-Z0-9_.-]{32,64})")
404.   $regexSearch.add("Planetscale Password", "pscale_pw_[a-zA-Z0-9_.-]{43}")
405.   $regexSearch.add("Plaid API Token", "(access-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})")
406.   $regexSearch.add("Plaid Client ID", "([a-z0-9]{24})")
407.   $regexSearch.add("Plaid Secret key", "([a-z0-9]{30})")
408.   $regexSearch.add("Prefect API token", "(pnu_[a-z0-9]{36})")
409.   $regexSearch.add("Postman API Key", "PMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}")
410.   $regexSearch.add("Private Keys", "-----BEGIN PRIVATE KEY-----|-----BEGIN RSA PRIVATE KEY-----|-----BEGIN OPENSSH PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----|-----BEGIN DSA PRIVATE KEY-----|-----BEGIN EC PRIVATE KEY-----")
411.   $regexSearch.add("Pulumi API Key", "pul-[a-f0-9]{40}")
412.   $regexSearch.add("PyPI upload token", "pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}")
413.   $regexSearch.add("Quip API Key", "(quip[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-zA-Z0-9]{15}=|[0-9]{10}|[a-zA-Z0-9/+]{43}=)['""]")
414.   $regexSearch.add("RapidAPI Access Token", "([a-z0-9_-]{50})")
415.   $regexSearch.add("Rubygem API Key", "rubygems_[a-f0-9]{48}")
416.   $regexSearch.add("Readme API token", "rdme_[a-z0-9]{70}")
417.   $regexSearch.add("Sendbird Access ID", "([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})")
418.   $regexSearch.add("Sendbird Access Token", "([a-f0-9]{40})")
419.   $regexSearch.add("Sendgrid API Key", "SG.[a-zA-Z0-9_.-]{66}")
420.   $regexSearch.add("Sendinblue API Key", "xkeysib-[a-f0-9]{64}-[a-zA-Z0-9]{16}")
421.   $regexSearch.add("Sentry Access Token", "([a-f0-9]{64})")
422.   $regexSearch.add("Shippo API Key, Access Token, Custom Access Token, Private App Access Token & Shared Secret", "shippo_(live|test)_[a-f0-9]{40}|shpat_[a-fA-F0-9]{32}|shpca_[a-fA-F0-9]{32}|shppa_[a-fA-F0-9]{32}|shpss_[a-fA-F0-9]{32}")
423.   $regexSearch.add("Sidekiq Secret", "([a-f0-9]{8}:[a-f0-9]{8})")
424.   $regexSearch.add("Sidekiq Sensitive URL", "([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)")
425.   $regexSearch.add("Slack Token", "xox[baprs]-([0-9a-zA-Z]{10,48})?")
426.   $regexSearch.add("Slack Webhook", "https://hooks.slack.com/services/T[a-zA-Z0-9_]{10}/B[a-zA-Z0-9_]{10}/[a-zA-Z0-9_]{24}")
427.   $regexSearch.add("Smarksheel API Key", "(smartsheet[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{26})['""]")
428.   $regexSearch.add("Square Access Token", "sqOatp-[0-9A-Za-z_-]{22}")
429.   $regexSearch.add("Square API Key", "EAAAE[a-zA-Z0-9_-]{59}")
430.   $regexSearch.add("Square Oauth Secret", "sq0csp-[ 0-9A-Za-z_-]{43}")
431.   $regexSearch.add("Stytch API Key", "secret-.*-[a-zA-Z0-9_=-]{36}")
432.   $regexSearch.add("Stripe Access Token & API Key", "(sk|pk)_(test|live)_[0-9a-z]{10,32}|k_live_[0-9a-zA-Z]{24}")
433.   $regexSearch.add("SumoLogic Access ID", "([a-z0-9]{14})")
434.   $regexSearch.add("SumoLogic Access Token", "([a-z0-9]{64})")
435.   $regexSearch.add("Telegram Bot API Token", "[0-9]+:AA[0-9A-Za-z-_]{33}")
436.   $regexSearch.add("Travis CI Access Token", "([a-z0-9]{22})")
437.   $regexSearch.add("Trello API Key", "(trello[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([0-9a-z]{32})['""]")
438.   $regexSearch.add("Twilio API Key", "SK[0-9a-fA-F]{32}")
439.   $regexSearch.add("Twitch API Key", "(twitch[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{30})['""]")
440.   $regexSearch.add("Twitter Client ID", "[tT][wW][iI][tT][tT][eE][rR](.{0,20})?['""][0-9a-z]{18,25}")
441.   $regexSearch.add("Twitter Bearer Token", "(A{22}[a-zA-Z0-9%]{80,100})")
442.   $regexSearch.add("Twitter Oauth", "[tT][wW][iI][tT][tT][eE][rR].{0,30}['""s][0-9a-zA-Z]{35,44}['""s]")
443.   $regexSearch.add("Twitter Secret Key", "[tT][wW][iI][tT][tT][eE][rR](.{0,20})?['""][0-9a-z]{35,44}")
444.   $regexSearch.add("Typeform API Key", "tfp_[a-z0-9_.=-]{59}")
445.   $regexSearch.add("URLScan API Key", "['""][a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}['""]")
446.   $regexSearch.add("Vault Token", "[sb].[a-zA-Z0-9]{24}")
447.   $regexSearch.add("Yandex Access Token", "(t1.[A-Z0-9a-z_-]+[=]{0,2}.[A-Z0-9a-z_-]{86}[=]{0,2})")
448.   $regexSearch.add("Yandex API Key", "(AQVN[A-Za-z0-9_-]{35,38})")
449.   $regexSearch.add("Yandex AWS Access Token", "(YC[a-zA-Z0-9_-]{38})")
450.   $regexSearch.add("Web3 API Key", "(web3[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([A-Za-z0-9_=-]+.[A-Za-z0-9_=-]+.?[A-Za-z0-9_.+/=-]*)['""]")
451.   $regexSearch.add("Zendesk Secret Key", "([a-z0-9]{40})")
452.   $regexSearch.add("Generic API Key", "((key|api|token|secret|password)[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([0-9a-zA-Z_=-]{8,64})['""]")
453. }
454.  
455. if ($webAuth) {
456.   $regexSearch.add("Authorization Basic", "basic [a-zA-Z0-9_:.=-]+")
457.   $regexSearch.add("Authorization Bearer", "bearer [a-zA-Z0-9_.=-]+")
458.   $regexSearch.add("Alibaba Access Key ID", "(LTAI)[a-z0-9]{20}")
459.   $regexSearch.add("Alibaba Secret Key", "(alibaba[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{30})['""]")
460.   $regexSearch.add("Asana Client ID", "((asana[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([0-9]{16})['""])|((asana[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""]([a-z0-9]{32})['""])")
461.   $regexSearch.add("AWS Client ID", "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}")
462.   $regexSearch.add("AWS MWS Key", "amzn.mws.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
463.   $regexSearch.add("AWS Secret Key", "aws(.{0,20})?['""][0-9a-zA-Z/+]{40}['""]")
464.   $regexSearch.add("AWS AppSync GraphQL Key", "da2-[a-z0-9]{26}")
465.   $regexSearch.add("Basic Auth Credentials", "://[a-zA-Z0-9]+:[a-zA-Z0-9]+@[a-zA-Z0-9]+.[a-zA-Z]+")
466.   $regexSearch.add("Beamer Client Secret", "(beamer[a-z0-9_ .,-]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}['""](b_[a-z0-9=_-]{44})['""]")
467.   $regexSearch.add("Cloudinary Basic Auth", "cloudinary://[0-9]{15}:[0-9A-Za-z]+@[a-z]+")
468.   $regexSearch.add("Facebook Client ID", "([fF][aA][cC][eE][bB][oO][oO][kK]|[fF][bB])(.{0,20})?['""][0-9]{13,17}")
469.   $regexSearch.add("Facebook Oauth", "[fF][aA][cC][eE][bB][oO][oO][kK].*['|""][0-9a-f]{32}['|""]")
470.   $regexSearch.add("Facebook Secret Key", "([fF][aA][cC][eE][bB][oO][oO][kK]|[fF][bB])(.{0,20})?['""][0-9a-f]{32}")
471.   $regexSearch.add("Jenkins Creds", "<[a-zA-Z]*>{[a-zA-Z0-9=+/]*}<")
472.   $regexSearch.add("Generic Secret", "[sS][eE][cC][rR][eE][tT].*['""][0-9a-zA-Z]{32,45}['""]")
473.   $regexSearch.add("Basic Auth", "//(.+):(.+)@")
474.   $regexSearch.add("PHP Passwords", "(pwd|passwd|password|PASSWD|PASSWORD|dbuser|dbpass|pass').*[=:].+|define ?('(w*pass|w*pwd|w*user|w*datab)")
475.   $regexSearch.add("Config Secrets (Passwd / Credentials)", "passwd.*|creden.*|^kind:[^a-zA-Z0-9_]?Secret|[^a-zA-Z0-9_]env:|secret:|secretName:|^kind:[^a-zA-Z0-9_]?EncryptionConfiguration|--encryption-provider-config")
476.   $regexSearch.add("Generiac API tokens search", "(access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key| amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret| api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret| application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket| aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password| bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key| bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver| cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret| client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password| cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|conn.login| connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test| datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password| digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd| docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid| dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password| env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_ .,<-]{0,25}(=|>|:=|||:|<=|=>|:).{0,5}['""]([0-9a-zA-Z_=-]{8,64})['""]")
477. }
478.  
479. if($FullCheck){$Excel = $true}
480.  
481. $regexSearch.add("IPs", "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)")
482. $Drives = Get-PSDrive | Where-Object { $_.Root -like "*:" }
483. $fileExtensions = @("*.xml", "*.txt", "*.conf", "*.config", "*.cfg", "*.ini", ".y*ml", "*.log", "*.bak", "*.xls", "*.xlsx", "*.xlsm")
484.  
485.  
486. ######################## INTRODUCTION ########################
487. $stopwatch = [system.diagnostics.stopwatch]::StartNew()
488.  
489. if ($FullCheck) {
490.   Write-Host "**Full Check Enabled. This will significantly increase false positives in registry / folder check for Usernames / Passwords.**"
491. }
492. # Introduction    
493. Write-Host -BackgroundColor Red -ForegroundColor White  "ADVISORY: WinPEAS - Windows local Privilege Escalation Awesome Script"
494. Write-Host -BackgroundColor Red -ForegroundColor White "WinPEAS should be used for authorized penetration testing and/or educational purposes only"
495. Write-Host -BackgroundColor Red -ForegroundColor White "Any misuse of this software will not be the responsibility of the author or of any other collaborator"
496. Write-Host -BackgroundColor Red -ForegroundColor White "Use it at your own networks and/or with the network owner's explicit permission"
497.  
498.  
499. # Color Scheme Introduction
500. Write-Host -ForegroundColor red  "Indicates special privilege over an object or misconfiguration"
501. Write-Host -ForegroundColor green  "Indicates protection is enabled or something is well configured"
502. Write-Host -ForegroundColor cyan  "Indicates active users"
503. Write-Host -ForegroundColor Gray  "Indicates disabled users"
504. Write-Host -ForegroundColor yellow  "Indicates links"
505. Write-Host -ForegroundColor Blue "Indicates title"
506.  
507.  
508. Write-Host "You can find a Windows local PE Checklist here: https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation" -ForegroundColor Yellow
509. #write-host  "Creating Dynamic lists, this could take a while, please wait..."
510. #write-host  "Loading sensitive_files yaml definitions file..."
511. #write-host  "Loading regexes yaml definitions file..."
512.  
513.  
514. ######################## SYSTEM INFORMATION ########################
515.  
516. Write-Host ""
517. if ($TimeStamp) { TimeElapsed }
518. Write-Host "====================================||SYSTEM INFORMATION ||===================================="
519. "The following information is curated. To get a full list of system information, run the cmdlet get-computerinfo"
520.  
521. #System Info from get-computer info
522. systeminfo.exe
523.  
524.  
525. #Hotfixes installed sorted by date
526. Write-Host ""
527. if ($TimeStamp) { TimeElapsed }
528. Write-Host -ForegroundColor Blue "=========|| WINDOWS HOTFIXES"
529. Write-Host "=| Check if windows is vulnerable with Watson https://github.com/rasta-mouse/Watson" -ForegroundColor Yellow
530. Write-Host "Possible exploits (https://github.com/codingo/OSCP-2/blob/master/Windows/WinPrivCheck.bat)" -ForegroundColor Yellow
531. $Hotfix = Get-HotFix | Sort-Object -Descending -Property InstalledOn -ErrorAction SilentlyContinue | Select-Object HotfixID, Description, InstalledBy, InstalledOn
532. $Hotfix | Format-Table -AutoSize
533.  
534.  
535. #Show all unique updates installed
536. Write-Host ""
537. if ($TimeStamp) { TimeElapsed }
538. Write-Host -ForegroundColor Blue "=========|| ALL UPDATES INSTALLED"
539.  
540.  
541. # 0, and 5 are not used for history
542. # See https://msdn.microsoft.com/en-us/library/windows/desktop/aa387095(v=vs.85).aspx
543. # Source: https://stackoverflow.com/questions/41626129/how-do-i-get-the-update-history-from-windows-update-in-powershell?utm_medium=organic&utm_source=google_rich_qa&utm_campaign=google_rich_qa
544.  
545. $session = (New-Object -ComObject 'Microsoft.Update.Session')
546. # Query the latest 50 updates starting with the first record
547. $history = $session.QueryHistory("", 0, 1000) | Select-Object ResultCode, Date, Title
548.  
549. #create an array for unique HotFixes
550. $HotfixUnique = @()
551. #$HotfixUnique += ($history[0].title | Select-String -AllMatches -Pattern 'KB(d{4,6})').Matches.Value
552.  
553. $HotFixReturnNum = @()
554. #$HotFixReturnNum += 0
555.  
556. for ($i = 0; $i -lt $history.Count; $i++) {
557.   $check = returnHotFixID -title $history[$i].Title
558.   if ($HotfixUnique -like $check) {
559.     #Do Nothing
560.   }
561.   else {
562.     $HotfixUnique += $check
563.     $HotFixReturnNum += $i
564.   }
565. }
566. $FinalHotfixList = @()
567.  
568. $hotfixreturnNum | ForEach-Object {
569.   $HotFixItem = $history[$_]
570.   $Result = $HotFixItem.ResultCode
571.   # https://learn.microsoft.com/en-us/windows/win32/api/wuapi/ne-wuapi-operationresultcode?redirectedfrom=MSDN
572.   switch ($Result) {
573.     1 {
574.       $Result = "Missing/Superseded"
575.     }
576.     2 {
577.       $Result = "Succeeded"
578.     }
579.     3 {
580.       $Result = "Succeeded With Errors"
581.     }
582.     4 {
583.       $Result = "Failed"
584.     }
585.     5 {
586.       $Result = "Canceled"
587.     }
588.   }
589.   $FinalHotfixList += [PSCustomObject]@{
590.     Result = $Result
591.     Date   = $HotFixItem.Date
592.     Title  = $HotFixItem.Title
593.   }    
594. }
595. $FinalHotfixList | Format-Table -AutoSize
596.  
597.  
598. Write-Host ""
599. if ($TimeStamp) { TimeElapsed }
600. Write-Host -ForegroundColor Blue "=========|| Drive Info"
601. # Load the System.Management assembly
602. Add-Type -AssemblyName System.Management
603.  
604. # Create a ManagementObjectSearcher to query Win32_LogicalDisk
605. $diskSearcher = New-Object System.Management.ManagementObjectSearcher("SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3")
606.  
607. # Get the system drives
608. $systemDrives = $diskSearcher.Get()
609.  
610. # Loop through each drive and display its information
611. foreach ($drive in $systemDrives) {
612.   $driveLetter = $drive.DeviceID
613.   $driveLabel = $drive.VolumeName
614.   $driveSize = [math]::Round($drive.Size / 1GB, 2)
615.   $driveFreeSpace = [math]::Round($drive.FreeSpace / 1GB, 2)
616.  
617.   Write-Output "Drive: $driveLetter"
618.   Write-Output "Label: $driveLabel"
619.   Write-Output "Size: $driveSize GB"
620.   Write-Output "Free Space: $driveFreeSpace GB"
621.   Write-Output ""
622. }
623.  
624.  
625. Write-Host ""
626. if ($TimeStamp) { TimeElapsed }
627. Write-Host -ForegroundColor Blue "=========|| Antivirus Detection (attemping to read exclusions as well)"
628. WMIC /Node:localhost /Namespace:rootSecurityCenter2 Path AntiVirusProduct Get displayName
629. Get-ChildItem 'registry::HKLMSOFTWAREMicrosoftWindows DefenderExclusions' -ErrorAction SilentlyContinue
630.  
631.  
632. Write-Host ""
633. if ($TimeStamp) { TimeElapsed }
634. Write-Host -ForegroundColor Blue "=========|| NET ACCOUNTS Info"
635. net accounts
636.  
637. ######################## REGISTRY SETTING CHECK ########################
638. Write-Host ""
639. if ($TimeStamp) { TimeElapsed }
640. Write-Host -ForegroundColor Blue "=========|| REGISTRY SETTINGS CHECK"
641.  
642.  
643. Write-Host ""
644. if ($TimeStamp) { TimeElapsed }
645. Write-Host -ForegroundColor Blue "=========|| Audit Log Settings"
646. #Check audit registry
647. if ((Test-Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemAudit).Property) {
648.   Get-Item -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemAudit
649. }
650. else {
651.   Write-Host "No Audit Log settings, no registry entry found."
652. }
653.  
654.  
655. Write-Host ""
656. if ($TimeStamp) { TimeElapsed }
657. Write-Host -ForegroundColor Blue "=========|| Windows Event Forward (WEF) registry"
658. if (Test-Path HKLM:SOFTWAREPoliciesMicrosoftWindowsEventLogEventForwardingSubscriptionManager) {
659.   Get-Item HKLM:SOFTWAREPoliciesMicrosoftWindowsEventLogEventForwardingSubscriptionManager
660. }
661. else {
662.   Write-Host "Logs are not being fowarded, no registry entry found."
663. }
664.  
665.  
666. Write-Host ""
667. if ($TimeStamp) { TimeElapsed }
668. Write-Host -ForegroundColor Blue "=========|| LAPS Check"
669. if (Test-Path 'C:Program FilesLAPSCSEAdmpwd.dll') { Write-Host "LAPS dll found on this machine at C:Program FilesLAPSCSE" -ForegroundColor Green }
670. elseif (Test-Path 'C:Program Files (x86)LAPSCSEAdmpwd.dll' ) { Write-Host "LAPS dll found on this machine at C:Program Files (x86)LAPSCSE" -ForegroundColor Green }
671. else { Write-Host "LAPS dlls not found on this machine" }
672. if ((Get-ItemProperty HKLM:SoftwarePoliciesMicrosoft ServicesAdmPwd -ErrorAction SilentlyContinue).AdmPwdEnabled -eq 1) { Write-Host "LAPS registry key found on this machine" -ForegroundColor Green }
673.  
674.  
675. Write-Host ""
676. if ($TimeStamp) { TimeElapsed }
677. Write-Host -ForegroundColor Blue "=========|| WDigest Check"
678. $WDigest = (Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlSecurityProvidersWDigest).UseLogonCredential
679. switch ($WDigest) {
680.   0 { Write-Host "Value 0 found. Plain-text Passwords are not stored in LSASS" }
681.   1 { Write-Host "Value 1 found. Plain-text Passwords may be stored in LSASS" -ForegroundColor red }
682.   Default { Write-Host "The system was unable to find the specified registry value: UesLogonCredential" }
683. }
684.  
685.  
686. Write-Host ""
687. if ($TimeStamp) { TimeElapsed }
688. Write-Host -ForegroundColor Blue "=========|| LSA Protection Check"
689. $RunAsPPL = (Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlLSA).RunAsPPL
690. $RunAsPPLBoot = (Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlLSA).RunAsPPLBoot
691. switch ($RunAsPPL) {
692.   2 { Write-Host "RunAsPPL: 2. Enabled without UEFI Lock" }
693.   1 { Write-Host "RunAsPPL: 1. Enabled with UEFI Lock" }
694.   0 { Write-Host "RunAsPPL: 0. LSA Protection Disabled. Try mimikatz." -ForegroundColor red }
695.   Default { "The system was unable to find the specified registry value: RunAsPPL / RunAsPPLBoot" }
696. }
697. if ($RunAsPPLBoot) { Write-Host "RunAsPPLBoot: $RunAsPPLBoot" }
698.  
699.  
700. Write-Host ""
701. if ($TimeStamp) { TimeElapsed }
702. Write-Host -ForegroundColor Blue "=========|| Credential Guard Check"
703. $LsaCfgFlags = (Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlLSA).LsaCfgFlags
704. switch ($LsaCfgFlags) {
705.   2 { Write-Host "LsaCfgFlags 2. Enabled without UEFI Lock" }
706.   1 { Write-Host "LsaCfgFlags 1. Enabled with UEFI Lock" }
707.   0 { Write-Host "LsaCfgFlags 0. LsaCfgFlags Disabled." -ForegroundColor red }
708.   Default { "The system was unable to find the specified registry value: LsaCfgFlags" }
709. }
710.  
711.  
712. Write-Host ""
713. if ($TimeStamp) { TimeElapsed }
714. Write-Host -ForegroundColor Blue "=========|| Cached WinLogon Credentials Check"
715. if (Test-Path "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon") {
716.   (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" -Name "CACHEDLOGONSCOUNT").CACHEDLOGONSCOUNT
717.   Write-Host "However, only the SYSTEM user can view the credentials here: HKEY_LOCAL_MACHINESECURITYCache"
718.   Write-Host "Or, using mimikatz lsadump::cache"
719. }
720.  
721. Write-Host ""
722. if ($TimeStamp) { TimeElapsed }
723. Write-Host -ForegroundColor Blue "=========|| Additonal Winlogon Credentials Check"
724.  
725. (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon").DefaultDomainName
726. (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon").DefaultUserName
727. (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon").DefaultPassword
728. (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon").AltDefaultDomainName
729. (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon").AltDefaultUserName
730. (Get-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon").AltDefaultPassword
731.  
732.  
733. Write-Host ""
734. if ($TimeStamp) { TimeElapsed }
735. Write-Host -ForegroundColor Blue "=========|| RDCMan Settings Check"
736.  
737. if (Test-Path "$env:USERPROFILEappdataLocalMicrosoftRemote Desktop Connection ManagerRDCMan.settings") {
738.   Write-Host "RDCMan Settings Found at: $($env:USERPROFILE)appdataLocalMicrosoftRemote Desktop Connection ManagerRDCMan.settings" -ForegroundColor Red
739. }
740. else { Write-Host "No RCDMan.Settings found." }
741.  
742.  
743. Write-Host ""
744. if ($TimeStamp) { TimeElapsed }
745. Write-Host -ForegroundColor Blue "=========|| RDP Saved Connections Check"
746.  
747. Write-Host "HK_Users"
748. New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS
749. Get-ChildItem HKU: -ErrorAction SilentlyContinue | ForEach-Object {
750.   # get the SID from output
751.   $HKUSID = $_.Name.Replace('HKEY_USERS', "")
752.   if (Test-Path "registry::HKEY_USERS$HKUSIDSoftwareMicrosoftTerminal Server ClientDefault") {
753.     Write-Host "Server Found: $((Get-ItemProperty "registry::HKEY_USERS$HKUSIDSoftwareMicrosoftTerminal Server ClientDefault" -Name MRU0).MRU0)"
754.   }
755.   else { Write-Host "Not found for $($_.Name)" }
756. }
757.  
758. Write-Host "HKCU"
759. if (Test-Path "registry::HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientDefault") {
760.   Write-Host "Server Found: $((Get-ItemProperty "registry::HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientDefault" -Name MRU0).MRU0)"
761. }
762. else { Write-Host "Terminal Server Client not found in HCKU" }
763.  
764. Write-Host ""
765. if ($TimeStamp) { TimeElapsed }
766. Write-Host -ForegroundColor Blue "=========|| Putty Stored Credentials Check"
767.  
768. if (Test-Path HKCU:SOFTWARESimonTathamPuTTYSessions) {
769.   Get-ChildItem HKCU:SOFTWARESimonTathamPuTTYSessions | ForEach-Object {
770.     $RegKeyName = Split-Path $_.Name -Leaf
771.     Write-Host "Key: $RegKeyName"
772.     @("HostName", "PortNumber", "UserName", "PublicKeyFile", "PortForwardings", "ConnectionSharing", "ProxyUsername", "ProxyPassword") | ForEach-Object {
773.       Write-Host "$_ :"
774.       Write-Host "$((Get-ItemProperty  HKCU:SOFTWARESimonTathamPuTTYSessions$RegKeyName).$_)"
775.     }
776.   }
777. }
778. else { Write-Host "No putty credentials found in HKCU:SOFTWARESimonTathamPuTTYSessions" }
779.  
780.  
781. Write-Host ""
782. if ($TimeStamp) { TimeElapsed }
783. Write-Host -ForegroundColor Blue "=========|| SSH Key Checks"
784. Write-Host ""
785. if ($TimeStamp) { TimeElapsed }
786. Write-Host -ForegroundColor Blue "=========|| If found:"
787. Write-Host "https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/" -ForegroundColor Yellow
788. Write-Host ""
789. if ($TimeStamp) { TimeElapsed }
790. Write-Host -ForegroundColor Blue "=========|| Checking Putty SSH KNOWN HOSTS"
791. if (Test-Path HKCU:SoftwareSimonTathamPuTTYSshHostKeys) {
792.   Write-Host "$((Get-Item -Path HKCU:SoftwareSimonTathamPuTTYSshHostKeys).Property)"
793. }
794. else { Write-Host "No putty ssh keys found" }
795.  
796. Write-Host ""
797. if ($TimeStamp) { TimeElapsed }
798. Write-Host -ForegroundColor Blue "=========|| Checking for OpenSSH Keys"
799. if (Test-Path HKCU:SoftwareOpenSSHAgentKeys) { Write-Host "OpenSSH keys found. Try this for decryption: https://github.com/ropnop/windows_sshagent_extract" -ForegroundColor Yellow }
800. else { Write-Host "No OpenSSH Keys found." }
801.  
802.  
803. Write-Host ""
804. if ($TimeStamp) { TimeElapsed }
805. Write-Host -ForegroundColor Blue "=========|| Checking for WinVNC Passwords"
806. if ( Test-Path "HKCU:SoftwareORLWinVNC3Password") { Write-Host " WinVNC found at HKCU:SoftwareORLWinVNC3Password" }else { Write-Host "No WinVNC found." }
807.  
808.  
809. Write-Host ""
810. if ($TimeStamp) { TimeElapsed }
811. Write-Host -ForegroundColor Blue "=========|| Checking for SNMP Passwords"
812. if ( Test-Path "HKLM:SYSTEMCurrentControlSetServicesSNMP" ) { Write-Host "SNMP Key found at HKLM:SYSTEMCurrentControlSetServicesSNMP" }else { Write-Host "No SNMP found." }
813.  
814.  
815. Write-Host ""
816. if ($TimeStamp) { TimeElapsed }
817. Write-Host -ForegroundColor Blue "=========|| Checking for TightVNC Passwords"
818. if ( Test-Path "HKCU:SoftwareTightVNCServer") { Write-Host "TightVNC key found at HKCU:SoftwareTightVNCServer" }else { Write-Host "No TightVNC found." }
819.  
820.  
821. Write-Host ""
822. if ($TimeStamp) { TimeElapsed }
823. Write-Host -ForegroundColor Blue "=========|| UAC Settings"
824. if ((Get-ItemProperty HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem).EnableLUA -eq 1) {
825.   Write-Host "EnableLUA is equal to 1. Part or all of the UAC components are on."
826.   Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#basic-uac-bypass-full-file-system-access" -ForegroundColor Yellow
827. }
828. else { Write-Host "EnableLUA value not equal to 1" }
829.  
830.  
831. Write-Host ""
832. if ($TimeStamp) { TimeElapsed }
833. Write-Host -ForegroundColor Blue "=========|| Recently Run Commands (WIN+R)"
834.  
835. Get-ChildItem HKU: -ErrorAction SilentlyContinue | ForEach-Object {
836.   # get the SID from output
837.   $HKUSID = $_.Name.Replace('HKEY_USERS', "")
838.   $property = (Get-Item "HKU:$_SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU" -ErrorAction SilentlyContinue).Property
839.   $HKUSID | ForEach-Object {
840.     if (Test-Path "HKU:$_SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU") {
841.       Write-Host -ForegroundColor Blue "=========||HKU Recently Run Commands"
842.       foreach ($p in $property) {
843.         Write-Host "$((Get-Item "HKU:$_SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU"-ErrorAction SilentlyContinue).getValue($p))"
844.       }
845.     }
846.   }
847. }
848.  
849. Write-Host ""
850. if ($TimeStamp) { TimeElapsed }
851. Write-Host -ForegroundColor Blue "=========||HKCU Recently Run Commands"
852. $property = (Get-Item "HKCU:SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU" -ErrorAction SilentlyContinue).Property
853. foreach ($p in $property) {
854.   Write-Host "$((Get-Item "HKCU:SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU"-ErrorAction SilentlyContinue).getValue($p))"
855. }
856.  
857. Write-Host ""
858. if ($TimeStamp) { TimeElapsed }
859. Write-Host -ForegroundColor Blue "=========|| Always Install Elevated Check"
860.  
861. Write-Host "Checking Windows Installer Registry (will populate if the key exists)"
862. if ((Get-ItemProperty HKLM:SOFTWAREPoliciesMicrosoftWindowsInstaller -ErrorAction SilentlyContinue).AlwaysInstallElevated -eq 1) {
863.   Write-Host "HKLM:SOFTWAREPoliciesMicrosoftWindowsInstaller).AlwaysInstallElevated = 1" -ForegroundColor red
864.   Write-Host "Try msfvenom msi package to escalate" -ForegroundColor red
865.   Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#metasploit-payloads" -ForegroundColor Yellow
866. }
867.  
868. if ((Get-ItemProperty HKCU:SOFTWAREPoliciesMicrosoftWindowsInstaller -ErrorAction SilentlyContinue).AlwaysInstallElevated -eq 1) {
869.   Write-Host "HKCU:SOFTWAREPoliciesMicrosoftWindowsInstaller).AlwaysInstallElevated = 1" -ForegroundColor red
870.   Write-Host "Try msfvenom msi package to escalate" -ForegroundColor red
871.   Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#metasploit-payloads" -ForegroundColor Yellow
872. }
873.  
874.  
875. Write-Host ""
876. if ($TimeStamp) { TimeElapsed }
877. Write-Host -ForegroundColor Blue "=========|| PowerShell Info"
878.  
879. (Get-ItemProperty registry::HKEY_LOCAL_MACHINESOFTWAREMicrosoftPowerShell1PowerShellEngine).PowerShellVersion | ForEach-Object {
880.   Write-Host "PowerShell $_ available"
881. }
882. (Get-ItemProperty registry::HKEY_LOCAL_MACHINESOFTWAREMicrosoftPowerShell3PowerShellEngine).PowerShellVersion | ForEach-Object {
883.   Write-Host  "PowerShell $_ available"
884. }
885.  
886.  
887. Write-Host ""
888. if ($TimeStamp) { TimeElapsed }
889. Write-Host -ForegroundColor Blue "=========|| PowerShell Registry Transcript Check"
890.  
891. if (Test-Path HKCU:SoftwarePoliciesMicrosoftWindowsPowerShellTranscription) {
892.   Get-Item HKCU:SoftwarePoliciesMicrosoftWindowsPowerShellTranscription
893. }
894. if (Test-Path HKLM:SoftwarePoliciesMicrosoftWindowsPowerShellTranscription) {
895.   Get-Item HKLM:SoftwarePoliciesMicrosoftWindowsPowerShellTranscription
896. }
897. if (Test-Path HKCU:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellTranscription) {
898.   Get-Item HKCU:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellTranscription
899. }
900. if (Test-Path HKLM:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellTranscription) {
901.   Get-Item HKLM:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellTranscription
902. }
903.  
904.  
905. Write-Host ""
906. if ($TimeStamp) { TimeElapsed }
907. Write-Host -ForegroundColor Blue "=========|| PowerShell Module Log Check"
908. if (Test-Path HKCU:SoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging) {
909.   Get-Item HKCU:SoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging
910. }
911. if (Test-Path HKLM:SoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging) {
912.   Get-Item HKLM:SoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging
913. }
914. if (Test-Path HKCU:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging) {
915.   Get-Item HKCU:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging
916. }
917. if (Test-Path HKLM:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging) {
918.   Get-Item HKLM:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging
919. }
920.  
921.  
922. Write-Host ""
923. if ($TimeStamp) { TimeElapsed }
924. Write-Host -ForegroundColor Blue "=========|| PowerShell Script Block Log Check"
925.  
926. if ( Test-Path HKCU:SoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging) {
927.   Get-Item HKCU:SoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging
928. }
929. if ( Test-Path HKLM:SoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging) {
930.   Get-Item HKLM:SoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging
931. }
932. if ( Test-Path HKCU:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging) {
933.   Get-Item HKCU:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging
934. }
935. if ( Test-Path HKLM:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging) {
936.   Get-Item HKLM:Wow6432NodeSoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging
937. }
938.  
939.  
940. Write-Host ""
941. if ($TimeStamp) { TimeElapsed }
942. Write-Host -ForegroundColor Blue "=========|| WSUS check for http and UseWAServer = 1, if true, might be vulnerable to exploit"
943. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#wsus" -ForegroundColor Yellow
944. if (Test-Path HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate) {
945.   Get-Item HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
946. }
947. if ((Get-ItemProperty HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU -Name "USEWUServer" -ErrorAction SilentlyContinue).UseWUServer) {
948.   (Get-ItemProperty HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU -Name "USEWUServer").UseWUServer
949. }
950.  
951.  
952. Write-Host ""
953. if ($TimeStamp) { TimeElapsed }
954. Write-Host -ForegroundColor Blue "=========|| Internet Settings HKCU / HKLM"
955.  
956. $property = (Get-Item "HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings" -ErrorAction SilentlyContinue).Property
957. foreach ($p in $property) {
958.   Write-Host "$p - $((Get-Item "HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings"-ErrorAction SilentlyContinue).getValue($p))"
959. }
960.  
961. $property = (Get-Item "HKLM:SoftwareMicrosoftWindowsCurrentVersionInternet Settings" -ErrorAction SilentlyContinue).Property
962. foreach ($p in $property) {
963.   Write-Host "$p - $((Get-Item "HKLM:SoftwareMicrosoftWindowsCurrentVersionInternet Settings"-ErrorAction SilentlyContinue).getValue($p))"
964. }
965.  
966.  
967.  
968. ######################## PROCESS INFORMATION ########################
969. Write-Host ""
970. if ($TimeStamp) { TimeElapsed }
971. Write-Host -ForegroundColor Blue "=========|| RUNNING PROCESSES"
972.  
973.  
974. Write-Host ""
975. if ($TimeStamp) { TimeElapsed }
976. Write-Host -ForegroundColor Blue "=========|| Checking user permissions on running processes"
977. Get-Process | Select-Object Path -Unique | ForEach-Object { Start-ACLCheck -Target $_.path }
978.  
979.  
980. #TODO, vulnerable system process running that we have access to.
981. Write-Host ""
982. if ($TimeStamp) { TimeElapsed }
983. Write-Host -ForegroundColor Blue "=========|| System processes"
984. Start-Process tasklist -ArgumentList '/v /fi "username eq system"' -Wait -NoNewWindow
985.  
986.  
987. ######################## SERVICES ########################
988. Write-Host ""
989. if ($TimeStamp) { TimeElapsed }
990. Write-Host -ForegroundColor Blue "=========|| SERVICE path vulnerable check"
991. Write-Host "Checking for vulnerable service .exe"
992. # Gathers all services running and stopped, based on .exe and shows the AccessControlList
993. $UniqueServices = @{}
994. Get-WmiObject Win32_Service | Where-Object { $_.PathName -like '*.exe*' } | ForEach-Object {
995.   $Path = ($_.PathName -split '(?<=.exeb)')[0].Trim('"')
996.   $UniqueServices[$Path] = $_.Name
997. }
998. foreach ( $h in ($UniqueServices | Select-Object -Unique).GetEnumerator()) {
999.   Start-ACLCheck -Target $h.Name -ServiceName $h.Value
1000. }
1001.  
1002.  
1003. ######################## UNQUOTED SERVICE PATH CHECK ############
1004. Write-Host ""
1005. if ($TimeStamp) { TimeElapsed }
1006. Write-Host -ForegroundColor Blue "=========|| Checking for Unquoted Service Paths"
1007. # All credit to Ivan-Sincek
1008. # https://github.com/ivan-sincek/unquoted-service-paths/blob/master/src/unquoted_service_paths_mini.ps1
1009.  
1010. UnquotedServicePathCheck
1011.  
1012.  
1013. ######################## REGISTRY SERVICE CONFIGURATION CHECK ###
1014. Write-Host ""
1015. if ($TimeStamp) { TimeElapsed }
1016. Write-Host -ForegroundColor Blue "=========|| Checking Service Registry Permissions"
1017. Write-Host "This will take some time."
1018.  
1019. Get-ChildItem 'HKLM:SystemCurrentControlSetservices' | ForEach-Object {
1020.   $target = $_.Name.Replace("HKEY_LOCAL_MACHINE", "hklm:")
1021.   Start-aclcheck -Target $target
1022. }
1023.  
1024.  
1025. ######################## SCHEDULED TASKS ########################
1026. Write-Host ""
1027. if ($TimeStamp) { TimeElapsed }
1028. Write-Host -ForegroundColor Blue "=========|| SCHEDULED TASKS vulnerable check"
1029. #Scheduled tasks audit
1030.  
1031. Write-Host ""
1032. if ($TimeStamp) { TimeElapsed }
1033. Write-Host -ForegroundColor Blue "=========|| Testing access to c:windowssystem32tasks"
1034. if (Get-ChildItem "c:windowssystem32tasks" -ErrorAction SilentlyContinue) {
1035.   Write-Host "Access confirmed, may need futher investigation"
1036.   Get-ChildItem "c:windowssystem32tasks"
1037. }
1038. else {
1039.   Write-Host "No admin access to scheduled tasks folder."
1040.   Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "Microsoft*" } | ForEach-Object {
1041.      $Acti
1042.     if ($Actions -ne $null) {
1043.       foreach ($a in $actions) {
1044.         if ($a -like "%windir%*") { $a = $a.replace("%windir%", $Env:windir) }
1045.         elseif ($a -like "%SystemRoot%*") { $a = $a.replace("%SystemRoot%", $Env:windir) }
1046.         elseif ($a -like "%localappdata%*") { $a = $a.replace("%localappdata%", "$env:UserProfileappdatalocal") }
1047.         elseif ($a -like "%appdata%*") { $a = $a.replace("%localappdata%", $env:Appdata) }
1048.         $a = $a.Replace('"', '')
1049.         Start-ACLCheck -Target $a
1050.         Write-Host "`n"
1051.         Write-Host "TaskName: $($_.TaskName)"
1052.         Write-Host "-------------"
1053.         [pscustomobject]@{
1054.           LastResult = $(($_ | Get-ScheduledTaskInfo).LastTaskResult)
1055.           NextRun    = $(($_ | Get-ScheduledTaskInfo).NextRunTime)
1056.           Status     = $_.State
1057.           Command    = $_.Actions.execute
1058.           Arguments  = $_.Actions.Arguments
1059.         } | Write-Host
1060.       }
1061.     }
1062.   }
1063. }
1064.  
1065.  
1066. ######################## STARTUP APPLIICATIONS #########################
1067. Write-Host ""
1068. if ($TimeStamp) { TimeElapsed }
1069. Write-Host -ForegroundColor Blue "=========|| STARTUP APPLICATIONS Vulnerable Check"
1070. "Check if you can modify any binary that is going to be executed by admin or if you can impersonate a not found binary"
1071. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#run-at-startup" -ForegroundColor Yellow
1072.  
1073. @("C:Documents and SettingsAll UsersStart MenuProgramsStartup",
1074.   "C:Documents and Settings$env:UsernameStart MenuProgramsStartup",
1075.   "$env:ProgramDataMicrosoftWindowsStart MenuProgramsStartup",
1076.   "$env:AppdataMicrosoftWindowsStart MenuProgramsStartup") | ForEach-Object {
1077.   if (Test-Path $_) {
1078.     # CheckACL of each top folder then each sub folder/file
1079.     Start-ACLCheck $_
1080.     Get-ChildItem -Recurse -Force -Path $_ | ForEach-Object {
1081.       $SubItem = $_.FullName
1082.       if (Test-Path $SubItem) {
1083.         Start-ACLCheck -Target $SubItem
1084.       }
1085.     }
1086.   }
1087. }
1088. Write-Host ""
1089. if ($TimeStamp) { TimeElapsed }
1090. Write-Host -ForegroundColor Blue "=========|| STARTUP APPS Registry Check"
1091.  
1092. @("registry::HKLMSoftwareMicrosoftWindowsCurrentVersionRun",
1093.   "registry::HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce",
1094.   "registry::HKCUSoftwareMicrosoftWindowsCurrentVersionRun",
1095.   "registry::HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce") | ForEach-Object {
1096.   # CheckACL of each Property Value found
1097.   $ROPath = $_
1098.   (Get-Item $_) | ForEach-Object {
1099.     $ROProperty = $_.property
1100.     $ROProperty | ForEach-Object {
1101.       Start-ACLCheck ((Get-ItemProperty -Path $ROPath).$_ -split '(?<=.exeb)')[0].Trim('"')
1102.     }
1103.   }
1104. }
1105.  
1106. #schtasks /query /fo TABLE /nh | findstr /v /i "disable deshab informa"
1107.  
1108.  
1109. ######################## INSTALLED APPLICATIONS ########################
1110. Write-Host ""
1111. if ($TimeStamp) { TimeElapsed }
1112. Write-Host -ForegroundColor Blue "=========|| INSTALLED APPLICATIONS"
1113. Write-Host "Generating list of installed applications"
1114.  
1115. Get-CimInstance -class win32_Product | Select-Object Name, Version |
1116. ForEach-Object {
1117.   Write-Host $("{0} : {1}" -f $_.Name, $_.Version)  
1118. }
1119.  
1120.  
1121. Write-Host ""
1122. if ($TimeStamp) { TimeElapsed }
1123. Write-Host -ForegroundColor Blue "=========|| LOOKING FOR BASH.EXE"
1124. Get-ChildItem C:WindowsWinSxS -Filter "amd64_microsoft-windows-lxss-bash*" | ForEach-Object {
1125.   Write-Host $((Get-ChildItem $_.FullName -Recurse -Filter "*bash.exe*").FullName)
1126. }
1127. @("bash.exe", "wsl.exe") | ForEach-Object { Write-Host $((Get-ChildItem C:WindowsSystem32 -Filter $_).FullName) }
1128.  
1129.  
1130. Write-Host ""
1131. if ($TimeStamp) { TimeElapsed }
1132. Write-Host -ForegroundColor Blue "=========|| LOOKING FOR SCCM CLIENT"
1133. $result = Get-WmiObject -Namespace "rootccmclientSDK" -Class CCM_Application -Property * -ErrorAction SilentlyContinue | Select-Object Name, SoftwareVersion
1134. if ($result) { $result }
1135. elseif (Test-Path 'C:WindowsCCMSCClient.exe') { Write-Host "SCCM Client found at C:WindowsCCMSCClient.exe" -ForegroundColor Cyan }
1136. else { Write-Host "Not Installed." }
1137.  
1138.  
1139. ######################## NETWORK INFORMATION ########################
1140. Write-Host ""
1141. if ($TimeStamp) { TimeElapsed }
1142. Write-Host -ForegroundColor Blue "=========|| NETWORK INFORMATION"
1143.  
1144. Write-Host ""
1145. if ($TimeStamp) { TimeElapsed }
1146. Write-Host -ForegroundColor Blue "=========|| HOSTS FILE"
1147.  
1148. Write-Host "Get content of etchosts file"
1149. Get-Content "c:windowssystem32driversetchosts"
1150.  
1151. Write-Host ""
1152. if ($TimeStamp) { TimeElapsed }
1153. Write-Host -ForegroundColor Blue "=========|| IP INFORMATION"
1154.  
1155. # Get all v4 and v6 addresses
1156. Write-Host ""
1157. if ($TimeStamp) { TimeElapsed }
1158. Write-Host -ForegroundColor Blue "=========|| Ipconfig ALL"
1159. Start-Process ipconfig.exe -ArgumentList "/all" -Wait -NoNewWindow
1160.  
1161.  
1162. Write-Host ""
1163. if ($TimeStamp) { TimeElapsed }
1164. Write-Host -ForegroundColor Blue "=========|| DNS Cache"
1165. ipconfig /displaydns | Select-String "Record" | ForEach-Object { Write-Host $('{0}' -f $_) }
1166.  
1167. Write-Host ""
1168. if ($TimeStamp) { TimeElapsed }
1169. Write-Host -ForegroundColor Blue "=========|| LISTENING PORTS"
1170.  
1171. # running netstat as powershell is too slow to print to console
1172. Start-Process NETSTAT.EXE -ArgumentList "-ano" -Wait -NoNewWindow
1173.  
1174.  
1175. Write-Host ""
1176. if ($TimeStamp) { TimeElapsed }
1177. Write-Host -ForegroundColor Blue "=========|| ARP Table"
1178.  
1179. # Arp table info
1180. Start-Process arp -ArgumentList "-A" -Wait -NoNewWindow
1181.  
1182. Write-Host ""
1183. if ($TimeStamp) { TimeElapsed }
1184. Write-Host -ForegroundColor Blue "=========|| Routes"
1185.  
1186. # Route info
1187. Start-Process route -ArgumentList "print" -Wait -NoNewWindow
1188.  
1189. Write-Host ""
1190. if ($TimeStamp) { TimeElapsed }
1191. Write-Host -ForegroundColor Blue "=========|| Network Adapter info"
1192.  
1193. # Network Adapter info
1194. Get-NetAdapter | ForEach-Object {
1195.   Write-Host "----------"
1196.   Write-Host $_.Name
1197.   Write-Host $_.InterfaceDescription
1198.   Write-Host $_.ifIndex
1199.   Write-Host $_.Status
1200.   Write-Host $_.MacAddress
1201.   Write-Host "----------"
1202. }
1203.  
1204.  
1205. Write-Host ""
1206. if ($TimeStamp) { TimeElapsed }
1207. Write-Host -ForegroundColor Blue "=========|| Checking for WiFi passwords"
1208. # Select all wifi adapters, then pull the SSID along with the password
1209.  
1210. ((netsh.exe wlan show profiles) -match 's{2,}:s').replace("    All User Profile     : ", "") | ForEach-Object {
1211.   netsh wlan show profile name="$_" key=clear
1212. }
1213.  
1214.  
1215. Write-Host ""
1216. if ($TimeStamp) { TimeElapsed }
1217. Write-Host -ForegroundColor Blue "=========|| Enabled firewall rules - displaying command only - it can overwrite the display buffer"
1218. Write-Host -ForegroundColor Blue "=========|| show all rules with: netsh advfirewall firewall show rule dir=in name=all"
1219. # Route info
1220.  
1221. Write-Host ""
1222. if ($TimeStamp) { TimeElapsed }
1223. Write-Host -ForegroundColor Blue "=========|| SMB SHARES"
1224. Write-Host "Will enumerate SMB Shares and Access if any are available"
1225.  
1226. Get-SmbShare | Get-SmbShareAccess | ForEach-Object {
1227.   $SMBShareObject = $_
1228.   whoami.exe /groups /fo csv | ConvertFrom-Csv | Select-Object -ExpandProperty 'group name' | ForEach-Object {
1229.     if ($SMBShareObject.AccountName -like $_ -and ($SMBShareObject.AccessRight -like "Full" -or "Change") -and $SMBShareObject.AccessControlType -like "Allow" ) {
1230.       Write-Host -ForegroundColor red "$($SMBShareObject.AccountName) has $($SMBShareObject.AccessRight) to $($SMBShareObject.Name)"
1231.     }
1232.   }
1233. }
1234.  
1235.  
1236. ######################## USER INFO ########################
1237. Write-Host ""
1238. if ($TimeStamp) { TimeElapsed }
1239. Write-Host -ForegroundColor Blue "=========|| USER INFO"
1240. Write-Host "== || Generating List of all Administrators, Users and Backup Operators (if any exist)"
1241.  
1242. @("ADMINISTRATORS", "USERS") | ForEach-Object {
1243.   Write-Host $_
1244.   Write-Host "-------"
1245.   Start-Process net -ArgumentList "localgroup $_" -Wait -NoNewWindow
1246. }
1247. Write-Host "BACKUP OPERATORS"
1248. Write-Host "-------"
1249. Start-Process net -ArgumentList 'localgroup "Backup Operators"' -Wait -NoNewWindow
1250.  
1251.  
1252. Write-Host ""
1253. if ($TimeStamp) { TimeElapsed }
1254. Write-Host -ForegroundColor Blue "=========|| USER DIRECTORY ACCESS CHECK"
1255. Get-ChildItem C:Users* | ForEach-Object {
1256.   if (Get-ChildItem $_.FullName -ErrorAction SilentlyContinue) {
1257.     Write-Host -ForegroundColor red "Read Access to $($_.FullName)"
1258.   }
1259. }
1260.  
1261. #Whoami
1262. Write-Host ""
1263. if ($TimeStamp) { TimeElapsed }
1264. Write-Host -ForegroundColor Blue "=========|| WHOAMI INFO"
1265. Write-Host ""
1266. if ($TimeStamp) { TimeElapsed }
1267. Write-Host -ForegroundColor Blue "=========|| Check Token access here: https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens" -ForegroundColor yellow
1268. Write-Host -ForegroundColor Blue "=========|| Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebbugPrivilege"
1269. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#users-and-groups" -ForegroundColor Yellow
1270. Start-Process whoami.exe -ArgumentList "/all" -Wait -NoNewWindow
1271.  
1272.  
1273. Write-Host ""
1274. if ($TimeStamp) { TimeElapsed }
1275. Write-Host -ForegroundColor Blue "=========|| Cloud Credentials Check"
1276. $Users = (Get-ChildItem C:Users).Name
1277. $CCreds = @(".awscredentials",
1278.   "AppDataRoaminggcloudcredentials.db",
1279.   "AppDataRoaminggcloudlegacy_credentials",
1280.   "AppDataRoaminggcloudaccess_tokens.db",
1281.   ".azureaccessTokens.json",
1282.   ".azureazureProfile.json")
1283. foreach ($u in $users) {
1284.   $CCreds | ForEach-Object {
1285.     if (Test-Path "c:$u$_") { Write-Host "$_ found!" -ForegroundColor Red }
1286.   }
1287. }
1288.  
1289.  
1290. Write-Host ""
1291. if ($TimeStamp) { TimeElapsed }
1292. Write-Host -ForegroundColor Blue "=========|| APPcmd Check"
1293. if (Test-Path ("$Env:SystemRootSystem32inetsrvappcmd.exe")) {
1294.   Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#appcmd.exe" -ForegroundColor Yellow
1295.   Write-Host "$Env:SystemRootSystem32inetsrvappcmd.exe exists!" -ForegroundColor Red
1296. }
1297.  
1298.  
1299. Write-Host ""
1300. if ($TimeStamp) { TimeElapsed }
1301. Write-Host -ForegroundColor Blue "=========|| OpenVPN Credentials Check"
1302.  
1303. $keys = Get-ChildItem "HKCU:SoftwareOpenVPN-GUIconfigs" -ErrorAction SilentlyContinue
1304. if ($Keys) {
1305.   Add-Type -AssemblyName System.Security
1306.   $items = $keys | ForEach-Object { Get-ItemProperty $_.PsPath }
1307.   foreach ($item in $items) {
1308.     $encryptedbytes = $item.'auth-data'
1309.     $entropy = $item.'entropy'
1310.     $entropy = $entropy[0..(($entropy.Length) - 2)]
1311.  
1312.     $decryptedbytes = [System.Security.Cryptography.ProtectedData]::Unprotect(
1313.       $encryptedBytes,
1314.       $entropy,
1315.       [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
1316.  
1317.     Write-Host ([System.Text.Encoding]::Unicode.GetString($decryptedbytes))
1318.   }
1319. }
1320.  
1321.  
1322. Write-Host ""
1323. if ($TimeStamp) { TimeElapsed }
1324. Write-Host -ForegroundColor Blue "=========|| PowerShell History (Password Search Only)"
1325.  
1326. Write-Host "=|| PowerShell Console History"
1327. Write-Host "=|| To see all history, run this command: Get-Content (Get-PSReadlineOption).HistorySavePath"
1328. Write-Host $(Get-Content (Get-PSReadLineOption).HistorySavePath | Select-String pa)
1329.  
1330. Write-Host "=|| AppData PSReadline Console History "
1331. Write-Host "=|| To see all history, run this command: Get-Content $env:USERPROFILEAppDataRoamingMicrosoftWindowsPowerShellPSReadlineConsoleHost_history.txt"
1332. Write-Host $(Get-Content "$env:USERPROFILEAppDataRoamingMicrosoftWindowsPowerShellPSReadlineConsoleHost_history.txt" | Select-String pa)
1333.  
1334.  
1335. Write-Host "=|| PowesRhell default transrcipt history check "
1336. if (Test-Path $env:SystemDrivetranscripts) { "Default transcripts found at $($env:SystemDrive)transcripts" }
1337.  
1338.  
1339. # Enumerating Environment Variables
1340. Write-Host ""
1341. if ($TimeStamp) { TimeElapsed }
1342. Write-Host -ForegroundColor Blue "=========|| ENVIRONMENT VARIABLES "
1343. Write-Host "Maybe you can take advantage of modifying/creating a binary in some of the following locations"
1344. Write-Host "PATH variable entries permissions - place binary or DLL to execute instead of legitimate"
1345. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#dll-hijacking" -ForegroundColor Yellow
1346.  
1347. Get-ChildItem env: | Format-Table -Wrap
1348.  
1349.  
1350. Write-Host ""
1351. if ($TimeStamp) { TimeElapsed }
1352. Write-Host -ForegroundColor Blue "=========|| Sticky Notes Check"
1353. if (Test-Path "C:Users$env:USERNAMEAppDataLocalPackagesMicrosoft.MicrosoftStickyNotes*LocalStateplum.sqlite") {
1354.   Write-Host "Sticky Notes database found. Could have credentials in plain text: "
1355.   Write-Host "C:Users$env:USERNAMEAppDataLocalPackagesMicrosoft.MicrosoftStickyNotes*LocalStateplum.sqlite"
1356. }
1357.  
1358. # Check for Cached Credentials
1359. # https://community.idera.com/database-tools/powershell/powertips/b/tips/posts/getting-cached-credentials
1360. Write-Host ""
1361. if ($TimeStamp) { TimeElapsed }
1362. Write-Host -ForegroundColor Blue "=========|| Cached Credentials Check"
1363. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#windows-vault" -ForegroundColor Yellow
1364. cmdkey.exe /list
1365.  
1366.  
1367. Write-Host ""
1368. if ($TimeStamp) { TimeElapsed }
1369. Write-Host -ForegroundColor Blue "=========|| Checking for DPAPI RPC Master Keys"
1370. Write-Host "Use the Mimikatz 'dpapi::masterkey' module with appropriate arguments (/rpc) to decrypt"
1371. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#dpapi" -ForegroundColor Yellow
1372.  
1373. $appdataRoaming = "C:Users$env:USERNAMEAppDataRoamingMicrosoft"
1374. $appdataLocal = "C:Users$env:USERNAMEAppDataLocalMicrosoft"
1375. if ( Test-Path "$appdataRoamingProtect") {
1376.   Write-Host "found: $appdataRoamingProtect"
1377.   Get-ChildItem -Path "$appdataRoamingProtect" -Force | ForEach-Object {
1378.     Write-Host $_.FullName
1379.   }
1380. }
1381. if ( Test-Path "$appdataLocalProtect") {
1382.   Write-Host "found: $appdataLocalProtect"
1383.   Get-ChildItem -Path "$appdataLocalProtect" -Force | ForEach-Object {
1384.     Write-Host $_.FullName
1385.   }
1386. }
1387.  
1388.  
1389. Write-Host ""
1390. if ($TimeStamp) { TimeElapsed }
1391. Write-Host -ForegroundColor Blue "=========|| Checking for DPAPI Cred Master Keys"
1392. Write-Host "Use the Mimikatz 'dpapi::cred' module with appropriate /masterkey to decrypt"
1393. Write-Host "You can also extract many DPAPI masterkeys from memory with the Mimikatz 'sekurlsa::dpapi' module"
1394. Write-Host "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#dpapi" -ForegroundColor Yellow
1395.  
1396. if ( Test-Path "$appdataRoamingCredentials") {
1397.   Get-ChildItem -Path "$appdataRoamingCredentials" -Force
1398. }
1399. if ( Test-Path "$appdataLocalCredentials") {
1400.   Get-ChildItem -Path "$appdataLocalCredentials" -Force
1401. }
1402.  
1403.  
1404. Write-Host ""
1405. if ($TimeStamp) { TimeElapsed }
1406. Write-Host -ForegroundColor Blue "=========|| Current Logged on Users"
1407. try { quser }catch { Write-Host "'quser' command not not present on system" }
1408.  
1409.  
1410. Write-Host ""
1411. if ($TimeStamp) { TimeElapsed }
1412. Write-Host -ForegroundColor Blue "=========|| Remote Sessions"
1413. try { qwinsta } catch { Write-Host "'qwinsta' command not present on system" }
1414.  
1415.  
1416. Write-Host ""
1417. if ($TimeStamp) { TimeElapsed }
1418. Write-Host -ForegroundColor Blue "=========|| Kerberos tickets (does require admin to interact)"
1419. try { klist } catch { Write-Host "No active sessions" }
1420.  
1421.  
1422. Write-Host ""
1423. if ($TimeStamp) { TimeElapsed }
1424. Write-Host -ForegroundColor Blue "=========|| Printing ClipBoard (if any)"
1425. Get-ClipBoardText
1426.  
1427. ######################## File/Credentials check ########################
1428. Write-Host ""
1429. if ($TimeStamp) { TimeElapsed }
1430. Write-Host -ForegroundColor Blue "=========|| Unattended Files Check"
1431. @("C:Windowssysprepsysprep.xml",
1432.   "C:Windowssysprepsysprep.inf",
1433.   "C:Windowssysprep.inf",
1434.   "C:WindowsPantherUnattended.xml",
1435.   "C:WindowsPantherUnattend.xml",
1436.   "C:WindowsPantherUnattendUnattend.xml",
1437.   "C:WindowsPantherUnattendUnattended.xml",
1438.   "C:WindowsSystem32Sysprepunattend.xml",
1439.   "C:WindowsSystem32Sysprepunattended.xml",
1440.   "C:unattend.txt",
1441.   "C:unattend.inf") | ForEach-Object {
1442.   if (Test-Path $_) {
1443.     Write-Host "$_ found."
1444.   }
1445. }
1446.  
1447.  
1448. ######################## GROUP POLICY RELATED CHECKS ########################
1449. Write-Host ""
1450. if ($TimeStamp) { TimeElapsed }
1451. Write-Host -ForegroundColor Blue "=========|| SAM / SYSTEM Backup Checks"
1452.  
1453. @(
1454.   "$Env:windirrepairSAM",
1455.   "$Env:windirSystem32configRegBackSAM",
1456.   "$Env:windirSystem32configSAM",
1457.   "$Env:windirrepairsystem",
1458.   "$Env:windirSystem32configSYSTEM",
1459.   "$Env:windirSystem32configRegBacksystem") | ForEach-Object {
1460.   if (Test-Path $_ -ErrorAction SilentlyContinue) {
1461.     Write-Host "$_ Found!" -ForegroundColor red
1462.   }
1463. }
1464.  
1465. Write-Host ""
1466. if ($TimeStamp) { TimeElapsed }
1467. Write-Host -ForegroundColor Blue "=========|| Group Policy Password Check"
1468.  
1469. $GroupPolicy = @("Groups.xml", "Services.xml", "Scheduledtasks.xml", "DataSources.xml", "Printers.xml", "Drives.xml")
1470. if (Test-Path "$env:SystemDriveMicrosoftGroup Policyhistory") {
1471.   Get-ChildItem -Recurse -Force "$env:SystemDriveMicrosoftGroup Policyhistory" -Include @GroupPolicy
1472. }
1473.  
1474. if (Test-Path "$env:SystemDriveDocuments and SettingsAll UsersApplication DataMicrosoftGroup Policyhistory" ) {
1475.   Get-ChildItem -Recurse -Force "$env:SystemDriveDocuments and SettingsAll UsersApplication DataMicrosoftGroup Policyhistory"
1476. }
1477.  
1478. Write-Host ""
1479. if ($TimeStamp) { TimeElapsed }
1480. Write-Host -ForegroundColor Blue "=========|| Recycle Bin TIP:"
1481. Write-Host "if credentials are found in the recycle bin, tool from nirsoft may assist: http://www.nirsoft.net/password_recovery_tools.html" -ForegroundColor Yellow
1482.  
1483. ######################## File/Folder Check ########################
1484.  
1485. Write-Host ""
1486. if ($TimeStamp) { TimeElapsed }
1487. Write-Host -ForegroundColor Blue "=========||  Password Check in Files/Folders"
1488.  
1489. # Looking through the entire computer for passwords
1490. # Also looks for MCaffee site list while looping through the drives.
1491. if ($TimeStamp) { TimeElapsed }
1492. Write-Host -ForegroundColor Blue "=========|| Password Check. Starting at root of each drive. This will take some time. Like, grab a coffee or tea kinda time."
1493. Write-Host -ForegroundColor Blue "=========|| Looking through each drive, searching for $fileExtensions"
1494. # Check if the Excel com object is installed, if so, look through files, if not, just notate if a file has "user" or "password in name"
1495. try { New-Object -ComObject Excel.Application | Out-Null; $ReadExcel = $true }catch {$ReadExcel = $false; if($Excel){
1496.   Write-Host -ForegroundColor Yellow "Host does not have Excel COM object, will still point out excel files when found."
1497. }}
1498. $Drives.Root | ForEach-Object {
1499.   $Drive = $_
1500.   Get-ChildItem $Drive -Recurse -Include $fileExtensions -ErrorAction SilentlyContinue -Force | ForEach-Object {
1501.     $path = $_
1502.     #Exclude files/folders with 'lang' in the name
1503.     if ($Path.FullName | select-string "(?i).*lang.*") {
1504.       #Write-Host "$($_.FullName) found!" -ForegroundColor red
1505.     }
1506.     if($Path.FullName | Select-String "(?i).:.*.*Pass.*"){
1507.       write-host -ForegroundColor Blue "$($path.FullName) contains the word 'pass'"
1508.     }
1509.     if($Path.FullName | Select-String ".:.*.*user.*" ){
1510.       Write-Host -ForegroundColor Blue "$($path.FullName) contains the word 'user' -excluding the 'users' directory"
1511.     }
1512.     # If path name ends with common excel extensions
1513.     elseif ($Path.FullName | Select-String ".*.xls",".*.xlsm",".*.xlsx") {
1514.       if ($ReadExcel -and $Excel) {
1515.         Search-Excel -Source $Path.FullName -SearchText "user"
1516.         Search-Excel -Source $Path.FullName -SearchText "pass"
1517.       }
1518.     }
1519.     else {
1520.       if ($path.Length -gt 0) {
1521.         # Write-Host -ForegroundColor Blue "Path name matches extension search: $path"
1522.       }
1523.       if ($path.FullName | Select-String "(?i).*SiteList.xml") {
1524.         Write-Host "Possible MCaffee Site List Found: $($_.FullName)"
1525.         Write-Host "Just going to leave this here: https://github.com/funoverip/mcafee-sitelist-pwd-decryption" -ForegroundColor Yellow
1526.       }
1527.       $regexSearch.keys | ForEach-Object {
1528.         $passwordFound = Get-Content $path.FullName -ErrorAction SilentlyContinue -Force | Select-String $regexSearch[$_] -Context 1, 1
1529.         if ($passwordFound) {
1530.           Write-Host "Possible Password found: $_" -ForegroundColor Yellow
1531.           Write-Host $Path.FullName
1532.           Write-Host -ForegroundColor Blue "$_ triggered"
1533.           Write-Host $passwordFound -ForegroundColor Red
1534.         }
1535.       }
1536.     }  
1537.   }
1538. }
1539.  
1540. ######################## Registry Password Check ########################
1541.  
1542. Write-Host -ForegroundColor Blue "=========|| Registry Password Check"
1543. # Looking through the entire registry for passwords
1544. Write-Host "This will take some time. Won't you have a pepsi?"
1545. $regPath = @("registry::HKEY_CURRENT_USER", "registry::HKEY_LOCAL_MACHINE")
1546. # Search for the string in registry values and properties
1547. foreach ($r in $regPath) {
1548. (Get-ChildItem -Path $r -Recurse -Force -ErrorAction SilentlyContinue) | ForEach-Object {
1549.     $property = $_.property
1550.     $Name = $_.Name
1551.     $property | ForEach-Object {
1552.       $Prop = $_
1553.       $regexSearch.keys | ForEach-Object {
1554.         $value = $regexSearch[$_]
1555.         if ($Prop | Where-Object { $_ -like $value }) {
1556.           Write-Host "Possible Password Found: $Name$Prop"
1557.           Write-Host "Key: $_" -ForegroundColor Red
1558.         }
1559.         $Prop | ForEach-Object {  
1560.           $propValue = (Get-ItemProperty "registry::$Name").$_
1561.           if ($propValue | Where-Object { $_ -like $Value }) {
1562.             Write-Host "Possible Password Found: $name$_ $propValue"
1563.           }
1564.         }
1565.       }
1566.     }
1567.   }
1568.   if ($TimeStamp) { TimeElapsed }
1569.   Write-Host "Finished $r"
1570. }