Adversary Village - New Generation of PEAS
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Polop, Carlos
Local privilege escalation techniques are far beyond checking the Windows/Kernel version, looking for unquoted service paths or checking SUID binaries. Moreover, a local privilege escalation could make a huge difference when trying to comprise a domain. Several tools have been created to find possible privilege escalation paths, but most of the tools for Red Team and Pentesting just check for a few possible ways, so pentesters need to use several tools and do some manual recon to check for everything. PEASS is a compilation of a bash script for Linux/MacOS/*nix and a .Net project and a batch script for Windows that I have created some time ago which aims to check and highlight every possible privescpath so professionals don’t need to execute several different tools for this purpose and can very easily find vulnerabilities. During this talk I would like to present PEASS-ng. The architecture of these scripts has evolved and improved so much that I would like to present how they work at the moment and how the difficulty to collaborate with the project has been reduced significantly. Moreover, I would also like to present the 2 new PEAS that haven't been present anywhere yet: BotPEAS and WebPEAS (the latest one will be released the day of the talk). During the talk I will also present my local privilege escalation resources (-unix/privilege-escalation ,-local-privilege-escalation) so the attended will be able to continue learning about the topic after the talk.
 So first of all, thank you very much for having me here today. I'm very excited to be here at Defcon in the adversary village. And I hope you like this presentation, which is called New Generation of Peace. We are going to discuss a little bit about this piece and why is there a new generation. My name is Carlos Pólleb. I work as senior security engineer at Merle. I have some certifications. I play CDF and all these stuff. So if you want to know something else about me, just take my link in. And you can also contact me via Twitter or even email for the more traditional stuff. So in this talk, we are going to talk a little bit about the peace suite, what it is, why is it useful, why is there a new generation. Then I'm going to very briefly introduce Hactress and how can it be useful in combination with the peace suite. And then we are going to see some demos about Limpies, Mac Peace, and Wimpies. At the end, we are going to very briefly see what is a both piece, the last being edited just one or two months ago. And then I want to talk a little bit about the to-do in order to indicate the community how you can help to the peace suite if you like it. So, suite piece. The name peace comes from previous escalation, not some script sheet. But basically, this suite is a combination of scripts that will allow you to enumerate the most common hosts. And I'm talking about Windows, Linux, Unix in general, and even Mac in order to find easy ways to escalate privilege. So before the peace suite, there were already a few scripts that performed these actions. But I liked them, but I didn't feel very comfortable with them because there were a lot of data that was mostly useless, and I didn't want to lose my time reading this data and figuring out if you can use it in any way or not. And because they didn't have enough text, or at least they didn't have the text I wanted to enumerate. So that's the reason I started this suite. So in peace, you are going to find very comprehensive scripts for enumerate hosts and see how hard they are and how you can escalate privilege. You are not going to find endless data lists, so you are going to know where you need to focus in order to find these vulnerabilities you are looking for. They have more text than any other tool, at least. I tried this, and this is because I mostly had probably one new check per week, so that's a very, very cool way to update the scripts. As we have said before, the peace can be executed for Linux, MacOS, mostly any Unix flavor, and also Windows, which is great. Anything is the only privilege escalation enumeration tool that can be executed in this amount of different operative systems. But I think the fact that most people love about the peace is that the output is colorate. This means that you are going to find, for example, the color red where something is suspicious, or the color green where something is well configured. And this is very useful in order to know where you need to focus or where you should focus in order to try to find vulnerabilities. Last of the characteristics is the monitoring decision. So we will talk about this later, because actually, you cannot use any monetization at the moment. But my idea with these peace new generation scripts is that you are going to be able to execute the peace in a host as frequently as you want, and be able to compare different results in order to see how good you are doing hardening your systems. As I have said, this is not available yet, but I hope this will be soon. Well, the more help the community gives me, the sooner this will be prepared. But before going into depth with peace, I want to show you what is Hactress, because this is going to be highly useful when using these tools. So I'm going to open this link. And you can see that Hactress is basically a book group, a book with a lot of cool tricks of hacking. But now I want us to focus on the previous escalation checklist for Linux and Windows. And in a few weeks, I hope I will create one specifically for Mac, where you can basically see some checklist of things that you should search on each computer in order to try to find vulnerabilities and improve the security or exploit the vulnerabilities, depending if you are in a routine or in a routine. Also, Hactress is pretty useful, because when you execute these tools, you are going to see probably some links to some parts of the book. And this is because if you don't understand the tech that the script is performing, you can access this URL. And you are going to have the theory about the tech. What, why is being performed, and what use will it take for, and how can you exploit a vulnerability phone in that section, if any. You have it for Linux, for MacOS in the future. I'm just starting. And for Windows. And to give you a very brief example, for example, let's say that you find some vulnerability which is related to access tokens. And you don't know what access tokens in a Windows environment you can just come here and have a description about what is the access token, how to enumerate them, how can they be in abuse, and everything. Basically, this is pretty useful to know why are the P's performing the techs they are doing, and how can you exploit them if you find any vulnerability. Also, you have here the URL. This is free for everyone. You can just access the book and use it as a piece. So let's continue. Now we are going to start with the demos. We are going to perform our Linux with Limpies. And then I demo with MacPies. So here I have a pretty vulnerable and very updated Debian machine that we are going to execute Limpies just to see the vulnerabilities that it is finding. So I have already accessed this machine via SSH. So I'm logged in. I'm on my user user, and I'm in this very outdated Debian machine. I have also already uploaded Limpies. So we are just going to execute it. First of all, take a look at the options because Limpies and WIPPs have several options that may be useful. For example, in Limpies, you can find the dash A. This means to perform all techs. And this is because there are some techs that are very, very slow or that are very noisy, that by default they aren't executed. But if you are playing a CTF or you don't care about being noisy or about the time, I completely recommend you to execute dash A because more techs are going to be executed. So you have the Superfax option. And you also have some options that will allow you to perform network return just using Limpies, which is kind of cool because just with Limpies you will be able to enumerate the machine, but also to enumerate the network if you don't want to upload any other tools. So let's execute Limpies. We are just going to run it without dash A. We are just going to run Limpies in a normal version. So here we can see that Limpies start with a very, very, very beautiful banner. Here we can find version. We can find legend. This means what the legend can, what the color means, which is kind of awesome because here we can see that the red-yellow indicates a 90%, 95% chance of previous installation vector. Red means that we'll just take a look at it. And green basically means well-configured things or common things that you really shouldn't care about because this was found in other machines. We have some basic information, same information about the tools that are available to enumerate the network. And then we start enumerating the system. So here we can find system information. We can see just in red that the kernel is pretty real. The pseudo version is also a little bit old, so probably they are vulnerable. We can see a little more information about the systems. If you're in for environment, you may be able to find some passwords here. We enumerate also some Linux protections, like is a Linux enabled? Is this a virtual machine? Actually, this is. So we have here just some information about the container if this was a container, but we are an inside a container. So nothing interesting here. Devices, available software. It's good to know if you have some compiler available to compile possible kernel exploits. Then we start taking a look to processes that may be vulnerable to scalability, binary process permissions, ground jobs. And here we can find the first highly probable privileged escalation vector that LIMP has found. So for example here, this user is able to write in a path that is being used in a Chrome that is then being executed by root without indicating the path. So for example, if we create a file called override.sh with a river cell in this folder, this is going to be executed by root, and we are going to obtain a river cell executed by root. Here we can see the LIMP is enumerating more information. Also, network is always important to know where you are in a network. And with other networks, new networks, you can access and enumerate them. Here we have just an enumerated local network. And we are even checking if we can sniff traffic using GCP. Then we are enumerating some user information. And here we can see that there are a bunch of ways to escalate privilege by executing different binaries with pseudo. More information about the users, software information. This is pretty interesting. And it's one of the main themes of LIMP and WIMP. And it's one of the main new topics in the new generation scripts. So we are going to talk about them later. But basically here, we are just looking for sensitive files for files that may be containing sensitive information related to some specific software. For example, some Tomcat configuration files that may have passwords inside of it. You can see that we are looking for a bunch of them, actually. We'll talk about this later. So we are going to continue till the last section, which is interesting files. These files, the files that are here are here just because they have some interesting fact that will make LIMPs to enumerate them. For example, here we can find all the QID files. Some of them has been vulnerable in the history so we have here some information about in which systems this QID binaries are vulnerable. And also the QID binaries that are unknown, but LIMPs are going to be executed in order to perform a few checks to see if we can abuse these files to execute arbitrary commands and escalate privilege. Same thing for SGAID files. Again, if you don't know what these files are, you can follow this link and you will find all the information. Taking misconfigurations, well, we are taking more misconfigurations. We can write a few files and folders here that we can abuse to escalate privilege. So this is very cool. We thought about a lot of files. So basically here, you are going to see that, well, LIMPs is looking for a lot of information that may give you sensitive information. Or the power to escalate privilege. Always take a look to everything because you can find something interesting. So this is LIMPs. Now we are going to continue with a Mac piece demo. But there is something important that you need to know. First of all, there is no Mac piece script because Mac piece is actually inside of LIMPs. If you execute LIMPs inside a Mac host, Mac piece is going to be executed. And I have created this script this way because the code that both scripts, both flavors of the script serves is like 90%. So almost every part of the code is served. So I just generate some specific parts for the Mac version in order to run these parts in a Mac computer instead of the regular LIMPs. But as you can see here, just execute LIMPs in a Mac OS system and the Mac piece version will be automatically executed. So this is very cool because you only need to know how one script works in order to execute it in Linux, in Mac OS, and potentially any flavor of Unix. So my current host is a Mac. So I have already executed the LIMPs version in my Mac. Actually, I have executed it from file, but I have executed it from memory. I have just downloaded it from GitHub and piped it into a SHL. So this way the script is never going to touch the disk. Yeah, here we can see that. I have already executed it because as my host has a lot of more files than a virtual machine, this could take instead of taking just one minute, this could take around five minutes to minutes, and it doesn't want to keep you waited. So here we can see that the banner is much more ugly. I really definitely need to improve that, but it's not on my priority list. Again, here we can see some basic information. We can see some system info, and we can mostly see the same information from LIMPs in MacPs. The difference is like underneath, there are different binaries being executed to obtain the same information. But it's pretty cool, because you just need to execute one, it is going to be intelligent enough to distinguish between Mac or Linux, and just the correct version is going to be executed well. As I have said, you are going to find most of the same information as before, so we can pass this output. You can just test it in your own. Okay, okay. So LIMPs, we can start. Also, there are other more stealthy ways to execute LIMPs. A bunch of them are mentioned in the RUIDME, even ways to bypass antiviruses. So check this out, because it's going to be very cool for you to learn how you can execute LIMPs, probably just using NetCAD and CooL, or even without that, using bus pipes. So, yeah, that's all for LIMPs. Okay, so let's continue with LIMPs. So obviously, the Windows version of the script. Okay, so here I have a Windows virtual machine where we are going to execute LIMPs. Obviously, LIMPs is using a completely different script that LIMPs. Actually, there are two different projects for LIMPs. One is the BATS version, and the other one is the XC version. The BATS version is less maintained than the X version, and is mostly created for all Windows machines. So the most maintained version of LIMPs is going to be the X one, and it's the one you recommend you to execute if you can. Obviously, there are some requirements, like the.NET version, but mostly you are going to, in nowadays, Windows, you are going to be able to execute it, so I definitely recommend you to execute this version. So here, also, we have a quick start, and we also have a few ways to execute LIMPs from memory, or execute LIMPs while doing some kind of stealthy things in order to avoid antivirus to detect that we are executing the binary. I recommend you to take a look at it, because it is pretty interesting. LIMPs also have some interesting parameters. For example, LIMPs allows you to execute LIMPs, and this is very cool, because if you find in a Windows, the Windows subsystem for Linux, you can execute LIMPs, because it is a BAS script, so if you just indicate to LIMPs the URL where it can find LIMPs, it is going to download and execute it from memory, I think. Also, you don't even need to host your version of LIMPs, you can just indicate the URL for LIMPs inside GitHub. Oh, well, you have also more health information, basic information. Where are my colors when you execute LIMPs without doing anything in a new Windows host? You are not going to see any color, you need to execute this first in order to indicate the registry that, hey, I want you to interpret the colors that are going to be displayed. Just run this, you don't need to be root or anything, and the colors will magically appear. Well, you need to start another PowerShell cell. Okay, so I have already run LIMPs in this host. We can see that we have another very beautiful banner, we have some information about the creators, and we start with LIMPs, we start seeing some system information. We have integrated Watson inside LIMPs, so this is pretty cool because it will just run with LIMPs. Here we can find that we are numerating the hotfixes, that has been applied to this virtual machine in this case, information about environment variables, information about ODE, web labs, WDigest. Again, if you don't know what, for example, if you don't know what is WDigest, you can just access this URL inside Hottricks, and you will learn what is this and why is this important. Same LSA protection, protection of guards. So the main difference between Windows and LIMPs, apart from the obvious one, is that you are not going to find these red-yellow colors in LIMPs, that you will find them in LIMPs, and this is because maybe in LIMPs it's more complicated to be so sure that something is going to give you a previous escalation path, so I haven't implemented those yet, but I may do that in the future. Well, as you can see in LIMPs, it's numerating a lot of things, interesting events. Now we have some user information. In red, you can find interesting things for attackers. So here you can find the user administrator, home-side folders, something interesting about WIMPs is that it's checking every path that appears. So for example, if this path was reachable by our current user, this will appear on red and will tell you, hey, you can write this binary, maybe you can escalate privilege because this is being executed. As you can see here, obviously you cannot escalate privilege over writing WIMPs because this is a binary of the user we are using, but maybe if this was being runed by another user which is an administrator and you can write the binary, you may be able to escalate privilege. Same for services information. Actually, here you can see an example of what I have been talking about, and it's that this service, this binary of this service is reachable by everyone, so here you have a privilege escalation path. Also WIMPs is checking for no quotes and space in the beam path of the services, so you may be able to abuse this misconfiguration also to escalate privilege. More information about applications, how to run, same. You may find some places that you can write and your binary is going to be executed with higher privilege, so that's pretty awesome. And I want to show you a few more things. Network information, again, is very important to know where you are inside an internal network, if you're inside an internal network, or anyway, with other networks you can access that you weren't able to access before. And also it's important to check the ports. I don't have, well, UDP, the ports that are listening just in localhost because maybe these services are vulnerable and you can, well, escalate privilege, are using those. We found some, well, the NLTLM has of our current user, I think. User, yeah. We found the unattended file, this may have credentials of the administrator user. And this is pretty awesome because you can see here this section, the file analysis section, and we are also looking for a lot of files that may be storing sensitive information. So before the piece new generation, every time I wanted to search for a file that may be containing sensitive information, I needed to ask, add a specific tech to LIMPIS and then a specific tech to LIMPIS. This was pretty awful because, well, it was kind of hard and it took several minutes. With the new generation scripts, we have this build list, inside this build list folder, we have this sensitive file, Jamal, where you can find all the sensitive potential files that can store sensitive information. This is pretty awesome because, for example, FileFigia, Pjamal is specifying to search the folder with the name FileFigia and inside this folder to search the file called SiteManager.xml and if it is found, print in red, all the lines that contain some of those reg access. So this is pretty awesome because LIMPIS and WIMPIS are automatically created using this Jamal, so both of them are going to search all these files and if they found them while executing, they are going to print them to you. This is very awesome because now, in order to just add a new tech, if I want to, if I discover a new file that maybe contains sensitive information, I can just add it to this Jamal and this is going to, and the new LIMPIS and WIMPIS are going to automatically be built and are going to be searching for the new sensitive file. So this is very easy to maintain and also is very easy for the community to help me add new files that maybe store sensitive information. Actually, you have here a few examples well explained, so if you want to just contribute to this script because you know about this file that maybe contains credentials that aren't included yet, just take a look at the example, including in Jamal, create a pull request to master and the new versions are going to be automatically built, so it's just awesome. As I have said before, WIMPIS has another flavor which is the BATS one, which is meant for all machines. Actually, the syntax is a little bit more complicated because BATS is not very flexible. Anyway, if you need to use it at any point, you can find it here and also take a look to this explanation of how to understand the permissions because you will need it in order to find the paths to escalate privilege because here you are not going to find colors or because BATS is not very, very, very flexible. So we are ending this presentation. We are going to continue with BATS. I created this like one or two months ago, I think. This is a very, very simple script. This is basically monitoring new CBS and the ones that are related to privilege escalation are going to be indicated in this group of telegram. In this group, we also discussed about HAT3's piece and latest news in cybersecurity. So it's free for everyone. Feel free to join it. Also, you can find BATPIS in GitHub. You can find it here. Actually, this BAT allowed you to create your own BAT and monitor the CBS you are interested in. So basically, you can modify this Jamal and set your own keywords and then put your slab web hood or your telegram token. The bot will send you all the new CBS that are this color that contains the keywords that you have specified here. In this case, we are just looking for things related to privilege escalation or docker container escape. Okay. So, yeah, feel free to join the group if you please. Finally, about the to-do. So we now have in this new generation, we have the capability of creating JSONs from the raw output and you can find the script to generate these JSONs in the parser folder. So you can basically execute the piece parser, give the path to the output of one piece script and generate the JSON. I'm looking forward to someone that from that JSON can generate a beautiful PDF HTML report. That would be awesome. Also, I want to develop web piece, which is going to be the centralized agent that will allow you to automatically execute lean piece or win piece and compare the results and even add new features. So I'm really looking for someone with experience in front end and or back end. So if you want to help me develop a web piece in order to allow to perform this constant monitorization, just contact me. And finally, obviously, win piece and lean piece are very big scripts but can be bigger. So if you know about new techs or if you want to help updating the list that they are using, just contact me because this is a huge project that needs a few help. The help of anybody that can, any help that you can bring me. So I hope you have enjoyed this talk. Thank you very much. I hope you are enjoying DevCon. And now I will be in the Discord channel if you have any questions. Thank you for your time again.
 So first of all, thank you very much for having me here today.  I'm very excited to be here at Defcon in the adversary village.  And I hope you like this presentation, which  is called New Generation of Peace.  We are going to discuss a little bit about this piece  and why is there a new generation.  My name is Carlos Pólleb.  I work as senior security engineer at Merle.  I have some certifications.  I play CDF and all these stuff.  So if you want to know something else about me,  just take my link in.  And you can also contact me via Twitter or even email  for the more traditional stuff.  So in this talk, we are going to talk a little bit  about the peace suite, what it is, why is it useful,  why is there a new generation.  Then I'm going to very briefly introduce Hactress  and how can it be useful in combination with the peace suite.  And then we are going to see some demos about Limpies,  Mac Peace, and Wimpies.  At the end, we are going to very briefly  see what is a both piece, the last being  edited just one or two months ago.  And then I want to talk a little bit about the to-do  in order to indicate the community how you can help  to the peace suite if you like it.  So, suite piece.  The name peace comes from previous escalation,  not some script sheet.  But basically, this suite is a combination of scripts  that will allow you to enumerate the most common hosts.  And I'm talking about Windows, Linux, Unix in general,  and even Mac in order to find easy ways  to escalate privilege.  So before the peace suite, there were already  a few scripts that performed these actions.  But I liked them, but I didn't feel very comfortable with them  because there were a lot of data that was mostly useless,  and I didn't want to lose my time reading this data  and figuring out if you can use it in any way or not.  And because they didn't have enough text,  or at least they didn't have the text I wanted to enumerate.  So that's the reason I started this suite.  So in peace, you are going to find very comprehensive scripts  for enumerate hosts and see how hard they are  and how you can escalate privilege.  You are not going to find endless data lists,  so you are going to know where you need to focus in order  to find these vulnerabilities you are looking for.  They have more text than any other tool, at least.  I tried this, and this is because I mostly  had probably one new check per week, so that's a very, very  cool way to update the scripts.  As we have said before, the peace  can be executed for Linux, MacOS, mostly any Unix flavor,  and also Windows, which is great.  Anything is the only privilege escalation enumeration  tool that can be executed in this amount  of different operative systems.  But I think the fact that most people love about the peace  is that the output is colorate.  This means that you are going to find, for example, the color  red where something is suspicious,  or the color green where something is well configured.  And this is very useful in order to know where  you need to focus or where you should focus in order  to try to find vulnerabilities.  Last of the characteristics is the monitoring decision.  So we will talk about this later, because actually, you  cannot use any monetization at the moment.  But my idea with these peace new generation scripts  is that you are going to be able to execute the peace in a host  as frequently as you want, and be able to compare  different results in order to see how good you are doing  hardening your systems.  As I have said, this is not available yet,  but I hope this will be soon.  Well, the more help the community gives me,  the sooner this will be prepared.  But before going into depth with peace,  I want to show you what is Hactress,  because this is going to be highly useful when  using these tools.  So I'm going to open this link.  And you can see that Hactress is basically a book group,  a book with a lot of cool tricks of hacking.  But now I want us to focus on the previous escalation  checklist for Linux and Windows.  And in a few weeks, I hope I will create one specifically  for Mac, where you can basically see  some checklist of things that you should search on each computer  in order to try to find vulnerabilities  and improve the security or exploit the vulnerabilities,  depending if you are in a routine or in a routine.  Also, Hactress is pretty useful, because when you execute  these tools, you are going to see probably some links  to some parts of the book.  And this is because if you don't understand the tech  that the script is performing, you can access this URL.  And you are going to have the theory about the tech.  What, why is being performed, and what use will it take for,  and how can you exploit a vulnerability phone  in that section, if any.  You have it for Linux, for MacOS in the future.  I'm just starting.  And for Windows.  And to give you a very brief example,  for example, let's say that you find some vulnerability which  is related to access tokens.  And you don't know what access tokens in a Windows environment  you can just come here and have a description about what  is the access token, how to enumerate them,  how can they be in abuse, and everything.  Basically, this is pretty useful to know  why are the P's performing the techs they are doing,  and how can you exploit them if you find any vulnerability.  Also, you have here the URL.  This is free for everyone.  You can just access the book and use it as a piece.  So let's continue.  Now we are going to start with the demos.  We are going to perform our Linux with Limpies.  And then I demo with MacPies.  So here I have a pretty vulnerable and very  updated Debian machine that we are going to execute Limpies  just to see the vulnerabilities that it is finding.  So I have already accessed this machine via SSH.  So I'm logged in.  I'm on my user user, and I'm in this very outdated Debian  machine.  I have also already uploaded Limpies.  So we are just going to execute it.  First of all, take a look at the options  because Limpies and WIPPs have several options that  may be useful.  For example, in Limpies, you can find the dash A.  This means to perform all techs.  And this is because there are some techs  that are very, very slow or that are very noisy,  that by default they aren't executed.  But if you are playing a CTF or you don't care about being  noisy or about the time, I completely recommend  you to execute dash A because more techs  are going to be executed.  So you have the Superfax option.  And you also have some options that  will allow you to perform network return just using Limpies,  which is kind of cool because just with Limpies  you will be able to enumerate the machine,  but also to enumerate the network  if you don't want to upload any other tools.  So let's execute Limpies.  We are just going to run it without dash A.  We are just going to run Limpies in a normal version.  So here we can see that Limpies start  with a very, very, very beautiful banner.  Here we can find version.  We can find legend.  This means what the legend can, what the color means,  which is kind of awesome because here we  can see that the red-yellow indicates  a 90%, 95% chance of previous installation vector.  Red means that we'll just take a look at it.  And green basically means well-configured things  or common things that you really shouldn't care about  because this was found in other machines.  We have some basic information, same information  about the tools that are available to enumerate the network.  And then we start enumerating the system.  So here we can find system information.  We can see just in red that the kernel is pretty real.  The pseudo version is also a little bit old,  so probably they are vulnerable.  We can see a little more information about the systems.  If you're in for environment, you may  be able to find some passwords here.  We enumerate also some Linux protections,  like is a Linux enabled?  Is this a virtual machine?  Actually, this is.  So we have here just some information  about the container if this was a container,  but we are an inside a container.  So nothing interesting here.  Devices, available software.  It's good to know if you have some compiler  available to compile possible kernel exploits.  Then we start taking a look to processes  that may be vulnerable to scalability, binary process  permissions, ground jobs.  And here we can find the first highly probable  privileged escalation vector that LIMP has found.  So for example here, this user is  able to write in a path that is being used in a Chrome  that is then being executed by root  without indicating the path.  So for example, if we create a file called  override.sh with a river cell in this folder,  this is going to be executed by root,  and we are going to obtain a river cell executed by root.  Here we can see the LIMP is enumerating more information.  Also, network is always important to know where  you are in a network.  And with other networks, new networks,  you can access and enumerate them.  Here we have just an enumerated local network.  And we are even checking if we can sniff traffic using  GCP.  Then we are enumerating some user information.  And here we can see that there are a bunch of ways  to escalate privilege by executing different binaries  with pseudo.  More information about the users, software information.  This is pretty interesting.  And it's one of the main themes of LIMP and WIMP.  And it's one of the main new topics  in the new generation scripts.  So we are going to talk about them later.  But basically here, we are just looking for sensitive files  for files that may be containing sensitive information  related to some specific software.  For example, some Tomcat configuration files  that may have passwords inside of it.  You can see that we are looking for a bunch of them,  actually.  We'll talk about this later.  So we are going to continue till the last section, which  is interesting files.  These files, the files that are here  are here just because they have some interesting fact that  will make LIMPs to enumerate them.  For example, here we can find all the QID files.  Some of them has been vulnerable in the history  so we have here some information about in which systems  this QID binaries are vulnerable.  And also the QID binaries that are unknown,  but LIMPs are going to be executed in order  to perform a few checks to see if we can abuse these files  to execute arbitrary commands and escalate privilege.  Same thing for SGAID files.  Again, if you don't know what these files are,  you can follow this link and you will find all the information.  Taking misconfigurations, well, we are taking more misconfigurations.  We can write a few files and folders here  that we can abuse to escalate privilege.  So this is very cool.  We thought about a lot of files.  So basically here, you are going to see that, well,  LIMPs is looking for a lot of information  that may give you sensitive information.  Or the power to escalate privilege.  Always take a look to everything  because you can find something interesting.  So this is LIMPs.  Now we are going to continue with a Mac piece demo.  But there is something important that you need to know.  First of all, there is no Mac piece script  because Mac piece is actually inside of LIMPs.  If you execute LIMPs inside a Mac host,  Mac piece is going to be executed.  And I have created this script this way  because the code that both scripts,  both flavors of the script serves is like 90%.  So almost every part of the code is served.  So I just generate some specific parts for the Mac version  in order to run these parts in a Mac computer  instead of the regular LIMPs.  But as you can see here, just execute LIMPs in a Mac OS system  and the Mac piece version will be automatically executed.  So this is very cool because you only need to know  how one script works in order to execute it in Linux,  in Mac OS, and potentially any flavor of Unix.  So my current host is a Mac.  So I have already executed the LIMPs version in my Mac.  Actually, I have executed it from file,  but I have executed it from memory.  I have just downloaded it from GitHub and piped it into a SHL.  So this way the script is never going to touch the disk.  Yeah, here we can see that.  I have already executed it because as my host  has a lot of more files than a virtual machine,  this could take instead of taking just one minute,  this could take around five minutes to minutes,  and it doesn't want to keep you waited.  So here we can see that the banner is much more ugly.  I really definitely need to improve that,  but it's not on my priority list.  Again, here we can see some basic information.  We can see some system info,  and we can mostly see the same information from LIMPs in MacPs.  The difference is like underneath,  there are different binaries being executed to obtain the same information.  But it's pretty cool, because you just need to execute one,  it is going to be intelligent enough to distinguish between Mac or Linux,  and just the correct version is going to be executed well.  As I have said, you are going to find most of the same information as before,  so we can pass this output.  You can just test it in your own.  Okay, okay.  So LIMPs, we can start.  Also, there are other more stealthy ways to execute LIMPs.  A bunch of them are mentioned in the RUIDME,  even ways to bypass antiviruses.  So check this out, because it's going to be very cool for you  to learn how you can execute LIMPs,  probably just using NetCAD and CooL,  or even without that, using bus pipes.  So, yeah, that's all for LIMPs.  Okay, so let's continue with LIMPs.  So obviously, the Windows version of the script.  Okay, so here I have a Windows virtual machine  where we are going to execute LIMPs.  Obviously, LIMPs is using a completely different script that LIMPs.  Actually, there are two different projects for LIMPs.  One is the BATS version, and the other one is the XC version.  The BATS version is less maintained than the X version,  and is mostly created for all Windows machines.  So the most maintained version of LIMPs is going to be the X one,  and it's the one you recommend you to execute if you can.  Obviously, there are some requirements, like the.NET version,  but mostly you are going to, in nowadays, Windows,  you are going to be able to execute it,  so I definitely recommend you to execute this version.  So here, also, we have a quick start,  and we also have a few ways to execute LIMPs from memory,  or execute LIMPs while doing some kind of stealthy things  in order to avoid antivirus to detect that we are executing the binary.  I recommend you to take a look at it, because it is pretty interesting.  LIMPs also have some interesting parameters.  For example, LIMPs allows you to execute LIMPs,  and this is very cool, because if you find in a Windows,  the Windows subsystem for Linux, you can execute LIMPs,  because it is a BAS script, so if you just indicate to LIMPs  the URL where it can find LIMPs,  it is going to download and execute it from memory, I think.  Also, you don't even need to host your version of LIMPs,  you can just indicate the URL for LIMPs inside GitHub.  Oh, well, you have also more health information, basic information.  Where are my colors when you execute LIMPs  without doing anything in a new Windows host?  You are not going to see any color, you need to execute this first  in order to indicate the registry that, hey, I want you to interpret  the colors that are going to be displayed.  Just run this, you don't need to be root or anything,  and the colors will magically appear.  Well, you need to start another PowerShell cell.  Okay, so I have already run LIMPs in this host.  We can see that we have another very beautiful banner,  we have some information about the creators,  and we start with LIMPs, we start seeing some system information.  We have integrated Watson inside LIMPs,  so this is pretty cool because it will just run with LIMPs.  Here we can find that we are numerating the hotfixes,  that has been applied to this virtual machine in this case,  information about environment variables,  information about ODE, web labs, WDigest.  Again, if you don't know what, for example,  if you don't know what is WDigest,  you can just access this URL inside Hottricks,  and you will learn what is this and why is this important.  Same LSA protection, protection of guards.  So the main difference between Windows and LIMPs,  apart from the obvious one, is that you are not going to find  these red-yellow colors in LIMPs,  that you will find them in LIMPs,  and this is because maybe in LIMPs it's more complicated  to be so sure that something is going to give you  a previous escalation path, so I haven't implemented those yet,  but I may do that in the future.  Well, as you can see in LIMPs, it's numerating a lot of things,  interesting events.  Now we have some user information.  In red, you can find interesting things for attackers.  So here you can find the user administrator,  home-side folders, something interesting about WIMPs  is that it's checking every path that appears.  So for example, if this path was reachable by our current user,  this will appear on red and will tell you,  hey, you can write this binary,  maybe you can escalate privilege because this is being executed.  As you can see here, obviously you cannot escalate privilege  over writing WIMPs because this is a binary of the user  we are using, but maybe if this was being runed by another user  which is an administrator and you can write the binary,  you may be able to escalate privilege.  Same for services information.  Actually, here you can see an example of what I have been talking about,  and it's that this service, this binary of this service  is reachable by everyone, so here you have a privilege escalation path.  Also WIMPs is checking for no quotes and space  in the beam path of the services,  so you may be able to abuse this misconfiguration also to escalate privilege.  More information about applications, how to run, same.  You may find some places that you can write  and your binary is going to be executed with higher privilege,  so that's pretty awesome.  And I want to show you a few more things.  Network information, again, is very important to know  where you are inside an internal network,  if you're inside an internal network,  or anyway, with other networks you can access  that you weren't able to access before.  And also it's important to check the ports.  I don't have, well, UDP, the ports that are listening just in localhost  because maybe these services are vulnerable  and you can, well, escalate privilege, are using those.  We found some, well, the NLTLM has of our current user, I think.  User, yeah.  We found the unattended file, this may have credentials of the administrator user.  And this is pretty awesome because you can see here this section,  the file analysis section,  and we are also looking for a lot of files  that may be storing sensitive information.  So before the piece new generation,  every time I wanted to search for a file  that may be containing sensitive information,  I needed to ask, add a specific tech to LIMPIS  and then a specific tech to LIMPIS.  This was pretty awful because, well, it was kind of hard  and it took several minutes.  With the new generation scripts,  we have this build list, inside this build list folder,  we have this sensitive file, Jamal, where you can find  all the sensitive potential files  that can store sensitive information.  This is pretty awesome because, for example,  FileFigia,  Pjamal is specifying to search the folder with the name FileFigia  and inside this folder to search the file called SiteManager.xml  and if it is found, print in red,  all the lines that contain some of those reg access.  So this is pretty awesome because LIMPIS and WIMPIS  are automatically created using this Jamal,  so both of them are going to search all these files  and if they found them while executing,  they are going to print them to you.  This is very awesome because now, in order to just add a new tech,  if I want to, if I discover a new file  that maybe contains sensitive information,  I can just add it to this Jamal  and this is going to, and the new LIMPIS and WIMPIS  are going to automatically be built  and are going to be searching for the new sensitive file.  So this is very easy to maintain  and also is very easy for the community to help me add  new files that maybe store sensitive information.  Actually, you have here a few examples well explained,  so if you want to just contribute to this script  because you know about this file  that maybe contains credentials that aren't included yet,  just take a look at the example, including in Jamal,  create a pull request to master  and the new versions are going to be automatically built,  so it's just awesome.  As I have said before,  WIMPIS has another flavor which is the BATS one,  which is meant for all machines.  Actually, the syntax is a little bit more complicated  because BATS is not very flexible.  Anyway, if you need to use it at any point,  you can find it here and also take a look  to this explanation of how to understand the permissions  because you will need it in order to find the paths  to escalate privilege because here you are not going to find colors  or because BATS is not very, very, very flexible.  So we are ending this presentation.  We are going to continue with BATS.  I created this like one or two months ago, I think.  This is a very, very simple script.  This is basically monitoring new CBS  and the ones that are related to privilege escalation  are going to be indicated in this group of telegram.  In this group, we also discussed about HAT3's piece  and latest news in cybersecurity.  So it's free for everyone.  Feel free to join it.  Also, you can find BATPIS in GitHub.  You can find it here.  Actually, this BAT allowed you to create your own BAT  and monitor the CBS you are interested in.  So basically, you can modify this Jamal  and set your own keywords  and then put your slab web hood or your telegram token.  The bot will send you all the new CBS  that are this color that contains the keywords  that you have specified here.  In this case, we are just looking for things related to privilege escalation  or docker container escape.  Okay.  So, yeah, feel free to join the group if you please.  Finally, about the to-do.  So we now have in this new generation,  we have the capability of creating JSONs from the raw output  and you can find the script to generate these JSONs in the parser folder.  So you can basically execute the piece parser,  give the path to the output of one piece script  and generate the JSON.  I'm looking forward to someone that from that JSON  can generate a beautiful PDF HTML report.  That would be awesome.  Also, I want to develop web piece,  which is going to be the centralized agent  that will allow you to automatically execute  lean piece or win piece and compare the results  and even add new features.  So I'm really looking for someone with experience in front end and or back end.  So if you want to help me develop a web piece  in order to allow to perform this constant monitorization,  just contact me.  And finally, obviously, win piece and lean piece are very big scripts  but can be bigger.  So if you know about new techs  or if you want to help updating the list that they are using,  just contact me because this is a huge project that needs a few help.  The help of anybody that can, any help that you can bring me.  So I hope you have enjoyed this talk.  Thank you very much.  I hope you are enjoying DevCon.  And now I will be in the Discord channel if you have any questions.  Thank you for your time again.
DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_0_6827.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_6828_8111.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_8112_9575.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_9576_10235.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_10236_14411.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_14412_17579.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_17580_20027.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_20028_20111.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_20112_20939.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_20940_20999.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_21000_22955.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_22956_23087.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_23088_24179.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_24180_24995.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_24996_25055.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_25056_25343.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_25344_29135.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_29136_29375.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_29376_29675.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_29676_30131.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_30132_30407.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_30408_30623.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_30624_32123.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_32124_32411.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_32412_32567.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_32568_34163.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_34164_34259.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_34260_34883.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_34884_34955.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_34956_36683.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_36684_38603.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_38604_39191.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_39192_39323.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_39324_39671.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_39672_39779.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_39780_40247.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_40248_41255.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_41256_41495.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_41496_41639.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_41640_42527.png DEF_CON_29_Adversary_Village_-_Carlos_Polop_-_New__9_fJv_weLU0_42528_45620.png