Add winpeas privilege escalation checks from: SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies and WSDL

.github/workflows/CI-master_tests.yml

@@ -212,14 +212,15 @@ jobs:
 
     steps:
       # Download repo
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v2
         with:
           ref: ${{ github.head_ref }}
       
       # Setup go
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v2
         with:
-          go-version: '1.23'
+          go-version: 1.17.0-rc1
+          stable: false
       - run: go version
       
       # Build linpeas

linPEAS/builder/linpeas_parts/7_software_information/Ssh.sh

@@ -29,7 +29,7 @@ fi
 
 peass{SSH}
 
-grep "PermitRootLogin \|ChallengeResponseAuthentication \|PasswordAuthentication \|UsePAM \|Port\|PermitEmptyPasswords\|PubkeyAuthentication\|ListenAddress\|ForwardAgent\|AllowAgentForwarding\|AuthorizedKeysFile" /etc/ssh/sshd_config 2>/dev/null | grep -v "#" | sed -${E} "s,PermitRootLogin.*es|PermitEmptyPasswords.*es|ChallengeResponseAuthentication.*es|FordwardAgent.*es,${SED_RED},"
+grep "PermitRootLogin \|ChallengeResponseAuthentication \|PasswordAuthentication \|UsePAM \|Port\|PermitEmptyPasswords\|PubkeyAuthentication\|ListenAddress\|ForwardAgent\|AllowAgentForwarding\|AuthorizedKeysFiles" /etc/ssh/sshd_config 2>/dev/null | grep -v "#" | sed -${E} "s,PermitRootLogin.*es|PermitEmptyPasswords.*es|ChallengeResponseAuthentication.*es|FordwardAgent.*es,${SED_RED},"
 
 if ! [ "$SEARCH_IN_FOLDER" ]; then
   if [ "$TIMEOUT" ]; then

linPEAS/builder/linpeas_parts/linpeas_base/0_variables_base.sh

@@ -371,7 +371,7 @@ echo ""
 printf ${BLUE}"Linux Privesc Checklist: ${YELLOW}https://book.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html\n"$NC
 echo " LEGEND:" | sed "s,LEGEND,${C}[1;4m&${C}[0m,"
 echo "  RED/YELLOW: 95% a PE vector" | sed "s,RED/YELLOW,${SED_RED_YELLOW},"
-echo "  RED: You should take a look into it" | sed "s,RED,${SED_RED},"
+echo "  RED: You should take a look to it" | sed "s,RED,${SED_RED},"
 echo "  LightCyan: Users with console" | sed "s,LightCyan,${SED_LIGHT_CYAN},"
 echo "  Blue: Users without console & mounted devs" | sed "s,Blue,${SED_BLUE},"
 echo "  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) " | sed "s,Green,${SED_GREEN},"
@@ -514,4 +514,4 @@ else
     HOMESEARCH="$HOME $HOMESEARCH"
   fi
 fi
-GREPHOMESEARCH=$(echo "$HOMESEARCH" | sed 's/ *$//g' | tr " " "|") #Remove ending spaces before putting "|"
+GREPHOMESEARCH=$(echo "$HOMESEARCH" | sed 's/ *$//g' | tr " " "|") #Remove ending spaces before putting "|"

winPEAS/winPEASbat/winPEAS.bat

@@ -405,7 +405,7 @@ CALL :T_Progress 1
 
 :BasicUserInfo
 CALL :ColorLine "%E%32m[*]%E%97m BASIC USER INFO
-ECHO.   [i] Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege
+ECHO.   [i] Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebbugPrivilege
 ECHO.   [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups
 ECHO.
 CALL :ColorLine " %E%33m[+]%E%97m CURRENT USER"

winPEAS/winPEASexe/README.md

@@ -76,6 +76,7 @@ The goal of this project is to search for possible **Privilege Escalation Paths*
 
 New in this version:
 - Detect potential GPO abuse by flagging writable SYSVOL paths for GPOs applied to the current host and by highlighting membership in the "Group Policy Creator Owners" group.
+- Detect SOAPwn-style .NET HTTP client proxies by flagging high-privilege services/processes that embed SoapHttpClientProtocol or ServiceDescriptionImporter indicators.
 
 
 It should take only a **few seconds** to execute almost all the checks and **some seconds/minutes during the lasts checks searching for known filenames** that could contain passwords (the time depened on the number of files in your home folder). By default only **some** filenames that could contain credentials are searched, you can use the **searchall** parameter to search all the list (this could will add some minutes).

winPEAS/winPEASexe/winPEAS/Checks/Checks.cs

@@ -88,6 +88,7 @@ namespace winPEAS.Checks
                 new SystemCheck("userinfo", new UserInfo()),
                 new SystemCheck("processinfo", new ProcessInfo()),
                 new SystemCheck("servicesinfo", new ServicesInfo()),
+                new SystemCheck("soapclientinfo", new SoapClientInfo()),
                 new SystemCheck("applicationsinfo", new ApplicationsInfo()),
                 new SystemCheck("networkinfo", new NetworkInfo()),
                 new SystemCheck("activedirectoryinfo", new ActiveDirectoryInfo()),

winPEAS/winPEASexe/winPEAS/Checks/SoapClientInfo.cs

@@ -0,0 +1,88 @@
+using System;
+using System.Collections.Generic;
+using winPEAS.Helpers;
+using winPEAS.Info.ApplicationInfo;
+
+namespace winPEAS.Checks
+{
+    internal class SoapClientInfo : ISystemCheck
+    {
+        public void PrintInfo(bool isDebug)
+        {
+            Beaprint.GreatPrint(".NET SOAP Client Proxies (SOAPwn)");
+
+            CheckRunner.Run(PrintSoapClientFindings, isDebug);
+        }
+
+        private static void PrintSoapClientFindings()
+        {
+            try
+            {
+                Beaprint.MainPrint("Potential SOAPwn / HttpWebClientProtocol abuse surfaces");
+                Beaprint.LinkPrint(
+                    "https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/",
+                    "Look for .NET services that let attackers control SoapHttpClientProtocol URLs or WSDL imports to coerce NTLM or drop files.");
+
+                List<SoapClientProxyFinding> findings = SoapClientProxyAnalyzer.CollectFindings();
+                if (findings.Count == 0)
+                {
+                    Beaprint.NotFoundPrint();
+                    return;
+                }
+
+                foreach (SoapClientProxyFinding finding in findings)
+                {
+                    string severity = finding.BinaryIndicators.Contains("ServiceDescriptionImporter")
+                        ? "Dynamic WSDL import"
+                        : "SOAP proxy usage";
+
+                    Beaprint.BadPrint($"    [{severity}] {finding.BinaryPath}");
+
+                    foreach (SoapClientProxyInstance instance in finding.Instances)
+                    {
+                        string instanceInfo = $"        -> {instance.SourceType}: {instance.Name}";
+                        if (!string.IsNullOrEmpty(instance.Account))
+                        {
+                            instanceInfo += $" ({instance.Account})";
+                        }
+                        if (!string.IsNullOrEmpty(instance.Extra))
+                        {
+                            instanceInfo += $" | {instance.Extra}";
+                        }
+
+                        Beaprint.GrayPrint(instanceInfo);
+                    }
+
+                    if (finding.BinaryIndicators.Count > 0)
+                    {
+                        Beaprint.BadPrint("        Binary indicators: " + string.Join(", ", finding.BinaryIndicators));
+                    }
+
+                    if (finding.ConfigIndicators.Count > 0)
+                    {
+                        string configLabel = string.IsNullOrEmpty(finding.ConfigPath)
+                            ? "Config indicators"
+                            : $"Config indicators ({finding.ConfigPath})";
+                        Beaprint.BadPrint("        " + configLabel + ": " + string.Join(", ", finding.ConfigIndicators));
+                    }
+
+                    if (finding.BinaryScanFailed)
+                    {
+                        Beaprint.GrayPrint("        (Binary scan skipped due to access/size limits)");
+                    }
+
+                    if (finding.ConfigScanFailed)
+                    {
+                        Beaprint.GrayPrint("        (Unable to read config file)");
+                    }
+
+                    Beaprint.PrintLineSeparator();
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException(ex.Message);
+            }
+        }
+    }
+}

winPEAS/winPEASexe/winPEAS/Helpers/MyUtils.cs

@@ -24,36 +24,51 @@ namespace winPEAS.Helpers
         ////////////////////////////////////
         /////// MISC - Files & Paths ///////
         ////////////////////////////////////
-        public static bool CheckIfDotNet(string path)
+        public static bool CheckIfDotNet(string path, bool ignoreCompanyName = false)
         {
             bool isDotNet = false;
-            FileVersionInfo myFileVersionInfo = FileVersionInfo.GetVersionInfo(path);
-            string companyName = myFileVersionInfo.CompanyName;
-            if ((string.IsNullOrEmpty(companyName)) ||
-                (!Regex.IsMatch(companyName, @"^Microsoft.*", RegexOptions.IgnoreCase)))
+            string companyName = string.Empty;
+
+            try
             {
-                try
+                FileVersionInfo myFileVersionInfo = FileVersionInfo.GetVersionInfo(path);
+                companyName = myFileVersionInfo.CompanyName;
+            }
+            catch
+            {
+                // Unable to read version information, continue with assembly inspection
+            }
+
+            bool shouldInspectAssembly = ignoreCompanyName ||
+                (string.IsNullOrEmpty(companyName)) ||
+                (!Regex.IsMatch(companyName, @"^Microsoft.*", RegexOptions.IgnoreCase));
+
+            if (!shouldInspectAssembly)
+            {
+                return false;
+            }
+
+            try
+            {
+                AssemblyName.GetAssemblyName(path);
+                isDotNet = true;
+            }
+            catch (System.IO.FileNotFoundException)
+            {
+                // System.Console.WriteLine("The file cannot be found.");
+            }
+            catch (System.BadImageFormatException exception)
+            {
+                if (Regex.IsMatch(exception.Message,
+                    ".*This assembly is built by a runtime newer than the currently loaded runtime and cannot be loaded.*",
+                    RegexOptions.IgnoreCase))
                 {
-                    AssemblyName myAssemblyName = AssemblyName.GetAssemblyName(path);
                     isDotNet = true;
                 }
-                catch (System.IO.FileNotFoundException)
-                {
-                    // System.Console.WriteLine("The file cannot be found.");
-                }
-                catch (System.BadImageFormatException exception)
-                {
-                    if (Regex.IsMatch(exception.Message,
-                        ".*This assembly is built by a runtime newer than the currently loaded runtime and cannot be loaded.*",
-                        RegexOptions.IgnoreCase))
-                    {
-                        isDotNet = true;
-                    }
-                }
-                catch
-                {
-                    // System.Console.WriteLine("The assembly has already been loaded.");
-                }
+            }
+            catch
+            {
+                // System.Console.WriteLine("The assembly has already been loaded.");
             }
 
             return isDotNet;

winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/SoapClientProxyAnalyzer.cs

@@ -0,0 +1,366 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Management;
+using System.Text;
+using winPEAS.Helpers;
+using winPEAS.Info.ProcessInfo;
+
+namespace winPEAS.Info.ApplicationInfo
+{
+    internal class SoapClientProxyInstance
+    {
+        public string SourceType { get; set; }
+        public string Name { get; set; }
+        public string Account { get; set; }
+        public string Extra { get; set; }
+    }
+
+    internal class SoapClientProxyFinding
+    {
+        public string BinaryPath { get; set; }
+        public List<SoapClientProxyInstance> Instances { get; } = new List<SoapClientProxyInstance>();
+        public HashSet<string> BinaryIndicators { get; } = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        public HashSet<string> ConfigIndicators { get; } = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        public string ConfigPath { get; set; }
+        public bool BinaryScanFailed { get; set; }
+        public bool ConfigScanFailed { get; set; }
+    }
+
+    internal static class SoapClientProxyAnalyzer
+    {
+        private class SoapClientProxyCandidate
+        {
+            public string BinaryPath { get; set; }
+            public string SourceType { get; set; }
+            public string Name { get; set; }
+            public string Account { get; set; }
+            public string Extra { get; set; }
+        }
+
+        private static readonly string[] BinaryIndicatorStrings = new[]
+        {
+            "SoapHttpClientProtocol",
+            "HttpWebClientProtocol",
+            "DiscoveryClientProtocol",
+            "HttpSimpleClientProtocol",
+            "HttpGetClientProtocol",
+            "HttpPostClientProtocol",
+            "ServiceDescriptionImporter",
+            "System.Web.Services.Description.ServiceDescriptionImporter",
+        };
+
+        private static readonly Dictionary<string, string> ConfigIndicatorMap = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+        {
+            { "soap:address", "soap:address element present" },
+            { "soap12:address", "soap12:address element present" },
+            { "?wsdl", "?wsdl reference" },
+            { "<wsdl:", "WSDL schema embedded in config" },
+            { "servicedescriptionimporter", "ServiceDescriptionImporter referenced in config" },
+            { "system.web.services.description", "System.Web.Services.Description namespace referenced" },
+            { "new-webserviceproxy", "PowerShell New-WebServiceProxy referenced" },
+            { "file://", "file:// scheme referenced" },
+        };
+
+        private const long MaxBinaryScanSize = 200 * 1024 * 1024; // 200MB
+        private static readonly object DotNetCacheLock = new object();
+        private static readonly Dictionary<string, bool> DotNetCache = new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
+
+        public static List<SoapClientProxyFinding> CollectFindings()
+        {
+            var findings = new Dictionary<string, SoapClientProxyFinding>(StringComparer.OrdinalIgnoreCase);
+
+            foreach (var candidate in EnumerateServiceCandidates().Concat(EnumerateProcessCandidates()))
+            {
+                if (string.IsNullOrEmpty(candidate.BinaryPath) || !File.Exists(candidate.BinaryPath))
+                {
+                    continue;
+                }
+
+                if (!findings.TryGetValue(candidate.BinaryPath, out var finding))
+                {
+                    finding = new SoapClientProxyFinding
+                    {
+                        BinaryPath = candidate.BinaryPath,
+                    };
+
+                    findings.Add(candidate.BinaryPath, finding);
+                }
+
+                finding.Instances.Add(new SoapClientProxyInstance
+                {
+                    SourceType = candidate.SourceType,
+                    Name = candidate.Name,
+                    Account = string.IsNullOrEmpty(candidate.Account) ? "Unknown" : candidate.Account,
+                    Extra = candidate.Extra ?? string.Empty,
+                });
+            }
+
+            foreach (var finding in findings.Values)
+            {
+                ScanBinaryIndicators(finding);
+                ScanConfigIndicators(finding);
+            }
+
+            return findings.Values
+                .Where(f => f.BinaryIndicators.Count > 0 || f.ConfigIndicators.Count > 0)
+                .OrderByDescending(f => f.BinaryIndicators.Contains("ServiceDescriptionImporter"))
+                .ThenBy(f => f.BinaryPath, StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+
+        private static IEnumerable<SoapClientProxyCandidate> EnumerateServiceCandidates()
+        {
+            try
+            {
+                using (var searcher = new ManagementObjectSearcher(@"root\\cimv2", "SELECT Name, DisplayName, PathName, StartName FROM Win32_Service"))
+                using (var services = searcher.Get())
+                {
+                    foreach (ManagementObject service in services)
+                    {
+                        string pathName = service["PathName"]?.ToString();
+                        string binaryPath = MyUtils.GetExecutableFromPath(pathName ?? string.Empty);
+                        if (string.IsNullOrEmpty(binaryPath) || !File.Exists(binaryPath))
+                            continue;
+
+                        if (!IsDotNetBinary(binaryPath))
+                            continue;
+
+                        yield return new SoapClientProxyCandidate
+                        {
+                            BinaryPath = binaryPath,
+                            SourceType = "Service",
+                            Name = service["Name"]?.ToString() ?? string.Empty,
+                            Account = service["StartName"]?.ToString() ?? string.Empty,
+                            Extra = service["DisplayName"]?.ToString() ?? string.Empty,
+                        };
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.GrayPrint("Error while enumerating services for SOAP client analysis: " + ex.Message);
+            }
+        }
+
+        private static IEnumerable<SoapClientProxyCandidate> EnumerateProcessCandidates()
+        {
+            var results = new List<SoapClientProxyCandidate>();
+            try
+            {
+                List<Dictionary<string, string>> processes = ProcessesInfo.GetProcInfo();
+                foreach (var proc in processes)
+                {
+                    string path = proc.ContainsKey("ExecutablePath") ? proc["ExecutablePath"] : string.Empty;
+                    if (string.IsNullOrEmpty(path) || !File.Exists(path))
+                        continue;
+
+                    if (!IsDotNetBinary(path))
+                        continue;
+
+                    string owner = proc.ContainsKey("Owner") ? proc["Owner"] : string.Empty;
+                    if (!IsInterestingProcessOwner(owner))
+                        continue;
+
+                    results.Add(new SoapClientProxyCandidate
+                    {
+                        BinaryPath = path,
+                        SourceType = "Process",
+                        Name = proc.ContainsKey("Name") ? proc["Name"] : string.Empty,
+                        Account = owner,
+                        Extra = proc.ContainsKey("ProcessID") ? $"PID {proc["ProcessID"]}" : string.Empty,
+                    });
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.GrayPrint("Error while enumerating processes for SOAP client analysis: " + ex.Message);
+            }
+
+            return results;
+        }
+
+        private static bool IsInterestingProcessOwner(string owner)
+        {
+            if (string.IsNullOrEmpty(owner))
+                return true;
+
+            string normalizedOwner = owner;
+            if (owner.Contains("\\"))
+            {
+                normalizedOwner = owner.Split('\\').Last();
+            }
+
+            return !normalizedOwner.Equals(Environment.UserName, StringComparison.OrdinalIgnoreCase);
+        }
+
+        private static bool IsDotNetBinary(string path)
+        {
+            lock (DotNetCacheLock)
+            {
+                if (DotNetCache.TryGetValue(path, out bool cached))
+                {
+                    return cached;
+                }
+
+                bool result = false;
+                try
+                {
+                    result = MyUtils.CheckIfDotNet(path, true);
+                }
+                catch
+                {
+                }
+
+                DotNetCache[path] = result;
+                return result;
+            }
+        }
+
+        private static void ScanBinaryIndicators(SoapClientProxyFinding finding)
+        {
+            try
+            {
+                FileInfo fi = new FileInfo(finding.BinaryPath);
+                if (!fi.Exists || fi.Length == 0)
+                    return;
+
+                if (fi.Length > MaxBinaryScanSize)
+                {
+                    finding.BinaryScanFailed = true;
+                    return;
+                }
+
+                foreach (var indicator in BinaryIndicatorStrings)
+                {
+                    if (FileContainsString(finding.BinaryPath, indicator))
+                    {
+                        finding.BinaryIndicators.Add(indicator);
+                    }
+                }
+            }
+            catch
+            {
+                finding.BinaryScanFailed = true;
+            }
+        }
+
+        private static void ScanConfigIndicators(SoapClientProxyFinding finding)
+        {
+            string configPath = GetConfigPath(finding.BinaryPath);
+            if (!string.IsNullOrEmpty(configPath) && File.Exists(configPath))
+            {
+                finding.ConfigPath = configPath;
+                try
+                {
+                    string content = File.ReadAllText(configPath);
+                    foreach (var kvp in ConfigIndicatorMap)
+                    {
+                        if (content.IndexOf(kvp.Key, StringComparison.OrdinalIgnoreCase) >= 0)
+                        {
+                            finding.ConfigIndicators.Add(kvp.Value);
+                        }
+                    }
+                }
+                catch
+                {
+                    finding.ConfigScanFailed = true;
+                }
+            }
+
+            string directory = Path.GetDirectoryName(finding.BinaryPath);
+            if (!string.IsNullOrEmpty(directory))
+            {
+                try
+                {
+                    var wsdlFiles = Directory.GetFiles(directory, "*.wsdl", SearchOption.TopDirectoryOnly);
+                    if (wsdlFiles.Length > 0)
+                    {
+                        finding.ConfigIndicators.Add($"Found {wsdlFiles.Length} WSDL file(s) next to binary");
+                    }
+                }
+                catch
+                {
+                    // ignore
+                }
+            }
+        }
+
+        private static string GetConfigPath(string binaryPath)
+        {
+            if (string.IsNullOrEmpty(binaryPath))
+                return string.Empty;
+
+            string candidate = binaryPath + ".config";
+            return File.Exists(candidate) ? candidate : string.Empty;
+        }
+
+        private static bool FileContainsString(string path, string value)
+        {
+            const int bufferSize = 64 * 1024;
+            byte[] pattern = Encoding.UTF8.GetBytes(value);
+            if (pattern.Length == 0)
+                return false;
+
+            try
+            {
+                using (var fs = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete))
+                {
+                    byte[] buffer = new byte[bufferSize + pattern.Length];
+                    int bufferLen = 0;
+                    int bytesRead;
+                    while ((bytesRead = fs.Read(buffer, bufferLen, bufferSize)) > 0)
+                    {
+                        int total = bufferLen + bytesRead;
+                        if (IndexOf(buffer, total, pattern) >= 0)
+                        {
+                            return true;
+                        }
+
+                        if (pattern.Length > 1)
+                        {
+                            bufferLen = Math.Min(pattern.Length - 1, total);
+                            Buffer.BlockCopy(buffer, total - bufferLen, buffer, 0, bufferLen);
+                        }
+                        else
+                        {
+                            bufferLen = 0;
+                        }
+                    }
+                }
+            }
+            catch
+            {
+                return false;
+            }
+
+            return false;
+        }
+
+        private static int IndexOf(byte[] buffer, int bufferLength, byte[] pattern)
+        {
+            int limit = bufferLength - pattern.Length;
+            if (limit < 0)
+                return -1;
+
+            for (int i = 0; i <= limit; i++)
+            {
+                bool match = true;
+                for (int j = 0; j < pattern.Length; j++)
+                {
+                    if (buffer[i + j] != pattern[j])
+                    {
+                        match = false;
+                        break;
+                    }
+                }
+
+                if (match)
+                    return i;
+            }
+
+            return -1;
+        }
+    }
+}

winPEAS/winPEASexe/winPEAS/winPEAS.csproj

@@ -1197,6 +1197,7 @@
     <Compile Include="Checks\NetworkInfo.cs" />
     <Compile Include="Checks\ProcessInfo.cs" />
     <Compile Include="Checks\ServicesInfo.cs" />
+    <Compile Include="Checks\SoapClientInfo.cs" />
     <Compile Include="Checks\SystemInfo.cs" />
     <Compile Include="Checks\UserInfo.cs" />
     <Compile Include="Checks\WindowsCreds.cs" />
@@ -1223,6 +1224,7 @@
     <Compile Include="Info\ApplicationInfo\ApplicationInfoHelper.cs" />
     <Compile Include="Info\ApplicationInfo\AutoRuns.cs" />
     <Compile Include="Info\ApplicationInfo\DeviceDrivers.cs" />
+    <Compile Include="Info\ApplicationInfo\SoapClientProxyAnalyzer.cs" />
     <Compile Include="Info\ApplicationInfo\InstalledApps.cs" />
     <Compile Include="Helpers\Beaprint.cs" />
     <Compile Include="Info\CloudInfo\AWSInfo.cs" />

winPEAS/winPEASps1/winPEAS.ps1

@@ -1650,7 +1650,7 @@ Write-Host -ForegroundColor Blue "=========|| WHOAMI INFO"
 Write-Host ""
 if ($TimeStamp) { TimeElapsed }
 Write-Host -ForegroundColor Blue "=========|| Check Token access here: https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#abusing-tokens" -ForegroundColor yellow
-Write-Host -ForegroundColor Blue "=========|| Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege"
+Write-Host -ForegroundColor Blue "=========|| Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebbugPrivilege"
 Write-Host "https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups" -ForegroundColor Yellow
 Start-Process whoami.exe -ArgumentList "/all" -Wait -NoNewWindow