From 5cab04cf53e329ab4aa694cddc46a0241c23044e Mon Sep 17 00:00:00 2001 From: HackTricks PEASS Autoimprover Date: Tue, 30 Jun 2026 06:16:02 +0000 Subject: [PATCH] autoimprover: simplify winpeas checks --- winPEAS/winPEASexe/README.md | 4 ++ .../InstalledPackageInventory.cs | 46 +++++++++++-------- .../Info/NetworkInfo/HackTricksHostChecker.cs | 11 ++++- 3 files changed, 41 insertions(+), 20 deletions(-) diff --git a/winPEAS/winPEASexe/README.md b/winPEAS/winPEASexe/README.md index 80f2adc..234e6ff 100755 --- a/winPEAS/winPEASexe/README.md +++ b/winPEAS/winPEASexe/README.md @@ -66,6 +66,7 @@ winpeas.exe domain #enumerate also domain information winpeas.exe wait #wait for user input between tests winpeas.exe debug #display additional debug information winpeas.exe log #log output to out.txt instead of standard output +winpeas.exe -vulnpackages #send installed package names/versions to the optional HackTricks online lookup to flag vulnerable packages winpeas.exe -linpeas=http://127.0.0.1/linpeas.sh #Execute also additional linpeas check (runs linpeas.sh in default WSL distribution) with custom linpeas.sh URL (if not provided, the default URL is: https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/linPEAS/linpeas.sh) winpeas.exe -lolbas #Execute also additional LOLBAS search check ``` @@ -176,6 +177,7 @@ Once you have installed and activated it you need to: - **Applications Information** - [x] Current Active Window - [x] Installed software + - [x] Optional online installed-package vulnerability lookup via HackTricks (`-vulnpackages` or `all`) - [x] AutoRuns - [x] Scheduled tasks - [x] Device drivers @@ -189,6 +191,8 @@ Once you have installed and activated it you need to: - [x] Firewall rules - [x] DNS Cache (limit 70) - [x] Internet Settings + - [x] Internet connectivity probes + - [x] Optional external hostname resolution check - **Cloud Metadata Enumeration** - [x] AWS Metadata diff --git a/winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/InstalledPackageInventory.cs b/winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/InstalledPackageInventory.cs index d357645..7e1f43c 100644 --- a/winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/InstalledPackageInventory.cs +++ b/winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/InstalledPackageInventory.cs @@ -1,7 +1,6 @@ using Microsoft.Win32; using System; using System.Collections.Generic; -using System.Linq; namespace winPEAS.Info.ApplicationInfo { @@ -57,32 +56,18 @@ namespace winPEAS.Info.ApplicationInfo continue; } - var name = CleanValue(appKey.GetValue("DisplayName")); - var version = CleanValue(appKey.GetValue("DisplayVersion")); - if (string.IsNullOrWhiteSpace(name) || string.IsNullOrWhiteSpace(version)) + var package = CreatePackage(appKey); + if (package == null) { continue; } - var key = $"{name}\0{version}"; + var key = $"{package["name"]}\0{package["version"]}"; if (!seen.Add(key)) { continue; } - var package = new Dictionary - { - { "name", name }, - { "version", version }, - { "manager", "windows-registry" } - }; - - var publisher = CleanValue(appKey.GetValue("Publisher")); - if (!string.IsNullOrWhiteSpace(publisher)) - { - package["publisher"] = publisher; - } - packages.Add(package); } } @@ -94,6 +79,31 @@ namespace winPEAS.Info.ApplicationInfo } } + private static Dictionary CreatePackage(RegistryKey appKey) + { + var name = CleanValue(appKey.GetValue("DisplayName")); + var version = CleanValue(appKey.GetValue("DisplayVersion")); + if (string.IsNullOrWhiteSpace(name) || string.IsNullOrWhiteSpace(version)) + { + return null; + } + + var package = new Dictionary + { + { "name", name }, + { "version", version }, + { "manager", "windows-registry" } + }; + + var publisher = CleanValue(appKey.GetValue("Publisher")); + if (!string.IsNullOrWhiteSpace(publisher)) + { + package["publisher"] = publisher; + } + + return package; + } + private static string CleanValue(object value) { return Convert.ToString(value)?.Trim().Replace("\r", " ").Replace("\n", " "); diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/HackTricksHostChecker.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/HackTricksHostChecker.cs index b9bbd4d..67adebc 100644 --- a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/HackTricksHostChecker.cs +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/HackTricksHostChecker.cs @@ -67,7 +67,7 @@ namespace winPEAS.Info.NetworkInfo public static HostCheckerResult GetResult() { - Start(includeHostname: !Checks.Checks.DontCheckHostname, includePackages: Checks.Checks.CheckOnlineVulnPackages); + EnsureStarted(Checks.Checks.CheckOnlineVulnPackages); try { return lookupTask.GetAwaiter().GetResult(); @@ -80,7 +80,7 @@ namespace winPEAS.Info.NetworkInfo public static PackageVulnerabilitySummary GetPackageVulnerabilities(int maxLines) { - Start(includeHostname: !Checks.Checks.DontCheckHostname, includePackages: true); + EnsureStarted(includePackages: true); var result = GetResult(); if (!string.IsNullOrEmpty(result.Error)) { @@ -157,6 +157,13 @@ namespace winPEAS.Info.NetworkInfo return summary; } + private static void EnsureStarted(bool includePackages) + { + Start( + includeHostname: !Checks.Checks.DontCheckHostname, + includePackages: includePackages); + } + private static HostCheckerResult ExecuteLookup(bool includeHostname, bool includePackages) { var result = new HostCheckerResult();