diff --git a/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs b/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs index 94853fe..0aaf745 100644 --- a/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs +++ b/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs @@ -88,6 +88,7 @@ namespace winPEAS.Checks PrintLocalGroupPolicy, PrintPotentialGPOAbuse, AppLockerHelper.PrintAppLockerPolicy, + PrintPrintNightmarePointAndPrint, PrintPrintersWMIInfo, PrintNamedPipes, PrintNamedPipeAbuseCandidates, @@ -836,6 +837,39 @@ namespace winPEAS.Checks } } + private static void PrintPrintNightmarePointAndPrint() + { + Beaprint.MainPrint("PrintNightmare PointAndPrint Policies"); + Beaprint.LinkPrint("https://itm4n.github.io/printnightmare-exploitation/", "Check PointAndPrint policy hardening"); + + try + { + string key = @"Software\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint"; + var restrict = RegistryHelper.GetDwordValue("HKLM", key, "RestrictDriverInstallationToAdministrators"); + var noWarn = RegistryHelper.GetDwordValue("HKLM", key, "NoWarningNoElevationOnInstall"); + var updatePrompt = RegistryHelper.GetDwordValue("HKLM", key, "UpdatePromptSettings"); + + if (restrict == null && noWarn == null && updatePrompt == null) + { + Beaprint.NotFoundPrint(); + return; + } + + Beaprint.NoColorPrint($" RestrictDriverInstallationToAdministrators: {restrict}\n" + + $" NoWarningNoElevationOnInstall: {noWarn}\n" + + $" UpdatePromptSettings: {updatePrompt}"); + + if (restrict == 0 && noWarn == 1 && updatePrompt == 2) + { + Beaprint.BadPrint(" [!] Potentially vulnerable to PrintNightmare misconfiguration"); + } + } + catch (Exception ex) + { + Beaprint.PrintException(ex.Message); + } + } + private static void PrintPrintersWMIInfo() { Beaprint.MainPrint("Enumerating Printers (WMI)"); diff --git a/winPEAS/winPEASps1/winPEAS.ps1 b/winPEAS/winPEASps1/winPEAS.ps1 index efd3268..c0a4c8c 100644 --- a/winPEAS/winPEASps1/winPEAS.ps1 +++ b/winPEAS/winPEASps1/winPEAS.ps1 @@ -821,6 +821,31 @@ $Hotfix = Get-HotFix | Sort-Object -Descending -Property InstalledOn -ErrorActio $Hotfix | Format-Table -AutoSize +# PrintNightmare PointAndPrint policy checks +Write-Host "" +if ($TimeStamp) { TimeElapsed } +Write-Host -ForegroundColor Blue "=========|| PRINTNIGHTMARE POINTANDPRINT POLICY" +$pnKey = "HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" +if (Test-Path $pnKey) { + $pn = Get-ItemProperty -Path $pnKey -ErrorAction SilentlyContinue + $restrict = $pn.RestrictDriverInstallationToAdministrators + $noWarn = $pn.NoWarningNoElevationOnInstall + $updatePrompt = $pn.UpdatePromptSettings + + Write-Host "RestrictDriverInstallationToAdministrators: $restrict" + Write-Host "NoWarningNoElevationOnInstall: $noWarn" + Write-Host "UpdatePromptSettings: $updatePrompt" + + if (($restrict -eq 0) -and ($noWarn -eq 1) -and ($updatePrompt -eq 2)) { + Write-Host "Potentially vulnerable to PrintNightmare misconfiguration" -ForegroundColor Red + } else { + Write-Host "PointAndPrint policy is not in the known risky configuration" -ForegroundColor Green + } +} else { + Write-Host "PointAndPrint policy key not found" -ForegroundColor Gray +} + + #Show all unique updates installed Write-Host "" if ($TimeStamp) { TimeElapsed }