ghostpack / seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

Seatbelt

---

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

@andrewchiles' HostEnum.ps1 script and @tifkin_'s Get-HostProfile.ps1 provided inspiration for many of the artifacts to collect.

@harmj0y and @tifkin_ are the primary authors of this implementation.

Seatbelt is licensed under the BSD 3-Clause license.

Table of Contents

• Seatbelt
  • Table of Contents
  • Command Line Usage
  • Command Groups
    • system
    • user
    • misc
    • Additional Command Groups
  • Command Arguments
  • Output
  • Remote Enumeration
  • Building Your Own Modules
  • Compile Instructions
  • Acknowledgments

Command Line Usage

                        %&&@@@&&                                                                                  
                        &&&&&&&%%%,                       #&&@@@@@@%%%%%%###############%                         
                        &%&   %&%%                        &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%%
%%%%%%%%%%%######%%%#%%####%  &%%**#                      @////(((&%%%%%%######################(((((((((((((((((((
#%#%%%%%%%#######%#%%#######  %&%,,,,,,,,,,,,,,,,         @////(((&%%%%%#%#####################(((((((((((((((((((
#%#%%%%%%#####%%#%#%%#######  %%%,,,,,,  ,,.   ,,         @////(((&%%%%%%%######################(#(((#(#((((((((((
#####%%%####################  &%%......  ...   ..         @////(((&%%%%%%%###############%######((#(#(####((((((((
#######%##########%#########  %%%......  ...   ..         @////(((&%%%%%#########################(#(#######((#####
###%##%%####################  &%%...............          @////(((&%%%%%%%%##############%#######(#########((#####
#####%######################  %%%..                       @////(((&%%%%%%%################                        
                        &%&   %%%%%      Seatbelt         %////(((&%%%%%%%%#############*                         
                        &%%&&&%%%%%        v1.2.1         ,(((&%%%%%%%%%%%%%%%%%,                                 
                         #%%%%##,                                                                                 


Available commands (+ means remote usage is supported):

    + AMSIProviders          - Providers registered for AMSI
    + AntiVirus              - Registered antivirus (via WMI)
    + AppLocker              - AppLocker settings, if installed
      ARPTable               - Lists the current ARP table and adapter information (equivalent to arp -a)
      AuditPolicies          - Enumerates classic and advanced audit policy settings
    + AuditPolicyRegistry    - Audit settings via the registry
    + AutoRuns               - Auto run executables/scripts/programs
      azuread                - Return AzureAD info
      Certificates           - Finds user and machine personal certificate files
      CertificateThumbprints - Finds thumbprints for all certificate store certs on the system
    + ChromiumBookmarks      - Parses any found Chrome/Edge/Brave/Opera bookmark files
    + ChromiumHistory        - Parses any found Chrome/Edge/Brave/Opera history files
    + ChromiumPresence       - Checks if interesting Chrome/Edge/Brave/Opera files exist
    + CloudCredentials       - AWS/Google/Azure/Bluemix cloud credential files
    + CloudSyncProviders     - All configured Office 365 endpoints (tenants and teamsites) which are synchronised by OneDrive.
      CredEnum               - Enumerates the current user's saved credentials using CredEnumerate()
    + CredGuard              - CredentialGuard configuration
      dir                    - Lists files/folders. By default, lists users' downloads, documents, and desktop folders (arguments == [directory] [maxDepth] [regex] [boolIgnoreErrors]
    + DNSCache               - DNS cache entries (via WMI)
    + DotNet                 - DotNet versions
    + DpapiMasterKeys        - List DPAPI master keys
      EnvironmentPath        - Current environment %PATH$ folders and SDDL information
    + EnvironmentVariables   - Current environment variables
    + ExplicitLogonEvents    - Explicit Logon events (Event ID 4648) from the security event log. Default of 7 days, argument == last X days.
      ExplorerMRUs           - Explorer most recently used files (last 7 days, argument == last X days)
    + ExplorerRunCommands    - Recent Explorer "run" commands
      FileInfo               - Information about a file (version information, timestamps, basic PE info, etc. argument(s) == file path(s)
    + FileZilla              - FileZilla configuration files
    + FirefoxHistory         - Parses any found FireFox history files
    + FirefoxPresence        - Checks if interesting Firefox files exist
    + Hotfixes               - Installed hotfixes (via WMI)
      IdleTime               - Returns the number of seconds since the current user's last input.
    + IEFavorites            - Internet Explorer favorites
      IETabs                 - Open Internet Explorer tabs
    + IEUrls                 - Internet Explorer typed URLs (last 7 days, argument == last X days)
    + InstalledProducts      - Installed products via the registry
      InterestingFiles       - "Interesting" files matching various patterns in the user's folder. Note: takes non-trivial time.
    + InterestingProcesses   - "Interesting" processes - defensive products and admin tools
      InternetSettings       - Internet settings including proxy configs and zones configuration
    + KeePass                - Finds KeePass configuration files
    + LAPS                   - LAPS settings, if installed
    + LastShutdown           - Returns the DateTime of the last system shutdown (via the registry).
      LocalGPOs              - Local Group Policy settings applied to the machine/local users
    + LocalGroups            - Non-empty local groups, "-full" displays all groups (argument == computername to enumerate)
    + LocalUsers             - Local users, whether they're active/disabled, and pwd last set (argument == computername to enumerate)
    + LogonEvents            - Logon events (Event ID 4624) from the security event log. Default of 10 days, argument == last X days.
    + LogonSessions          - Windows logon sessions
      LOLBAS                 - Locates Living Off The Land Binaries and Scripts (LOLBAS) on the system. Note: takes non-trivial time.
    + LSASettings            - LSA settings (including auth packages)
    + MappedDrives           - Users' mapped drives (via WMI)
      McAfeeConfigs          - Finds McAfee configuration files
      McAfeeSiteList         - Decrypt any found McAfee SiteList.xml configuration files.
      MicrosoftUpdates       - All Microsoft updates (via COM)
      MTPuTTY                - MTPuTTY configuration files
      NamedPipes             - Named pipe names, any readable ACL information and associated process information.
    + NetworkProfiles        - Windows network profiles
    + NetworkShares          - Network shares exposed by the machine (via WMI)
    + NTLMSettings           - NTLM authentication settings
      OfficeMRUs             - Office most recently used file list (last 7 days)
      OneNote                - List OneNote backup files
    + OptionalFeatures       - List Optional Features/Roles (via WMI)
      OracleSQLDeveloper     - Finds Oracle SQLDeveloper connections.xml files
    + OSInfo                 - Basic OS info (i.e. architecture, OS version, etc.)
    + OutlookDownloads       - List files downloaded by Outlook
    + PoweredOnEvents        - Reboot and sleep schedule based on the System event log EIDs 1, 12, 13, 42, and 6008. Default of 7 days, argument == last X days.
    + PowerShell             - PowerShell versions and security settings
    + PowerShellEvents       - PowerShell script block logs (4104) with sensitive data.
    + PowerShellHistory      - Searches PowerShell console history files for sensitive regex matches.
      Printers               - Installed Printers (via WMI)
    + ProcessCreationEvents  - Process creation logs (4688) with sensitive data.
      Processes              - Running processes with file info company names that don't contain 'Microsoft', "-full" enumerates all processes
    + ProcessOwners          - Running non-session 0 process list with owners. For remote use.
    + PSSessionSettings      - Enumerates PS Session Settings from the registry
    + PuttyHostKeys          - Saved Putty SSH host keys
    + PuttySessions          - Saved Putty configuration (interesting fields) and SSH host keys
      RDCManFiles            - Windows Remote Desktop Connection Manager settings files
    + RDPSavedConnections    - Saved RDP connections stored in the registry
    + RDPSessions            - Current incoming RDP sessions (argument == computername to enumerate)
    + RDPsettings            - Remote Desktop Server/Client Settings
      RecycleBin             - Items in the Recycle Bin deleted in the last 30 days - only works from a user context!
      reg                    - Registry key values (HKLM\Software by default) argument == [Path] [intDepth] [Regex] [boolIgnoreErrors]
      RPCMappedEndpoints     - Current RPC endpoints mapped
    + SCCM                   - System Center Configuration Manager (SCCM) settings, if applicable
    + ScheduledTasks         - Scheduled tasks (via WMI) that aren't authored by 'Microsoft', "-full" dumps all Scheduled tasks
      SearchIndex            - Query results from the Windows Search Index, default term of 'passsword'. (argument(s) == <search path> <pattern1,pattern2,...>
      SecPackageCreds        - Obtains credentials from security packages
    + SecureBoot             - Secure Boot configuration
      SecurityPackages       - Enumerates the security packages currently available using EnumerateSecurityPackagesA()
      Services               - Services with file info company names that don't contain 'Microsoft', "-full" dumps all processes
    + SlackDownloads         - Parses any found 'slack-downloads' files
    + SlackPresence          - Checks if interesting Slack files exist
    + SlackWorkspaces        - Parses any found 'slack-workspaces' files
    + SuperPutty             - SuperPutty configuration files
    + Sysmon                 - Sysmon configuration from the registry
    + SysmonEvents           - Sysmon process creation logs (1) with sensitive data.
      TcpConnections         - Current TCP connections and their associated processes and services
      TokenGroups            - The current token's local and domain groups
      TokenPrivileges        - Currently enabled token privileges (e.g. SeDebugPrivilege/etc.)
    + UAC                    - UAC system policies via the registry
      UdpConnections         - Current UDP connections and associated processes and services
      UserRightAssignments   - Configured User Right Assignments (e.g. SeDenyNetworkLogonRight, SeShutdownPrivilege, etc.) argument == computername to enumerate
      WifiProfile            - Enumerates the saved Wifi profiles and extract the ssid, authentication type, cleartext key/passphrase (when possible)
    + WindowsAutoLogon       - Registry autologon information
      WindowsCredentialFiles - Windows credential DPAPI blobs
    + WindowsDefender        - Windows Defender settings (including exclusion locations)
    + WindowsEventForwarding - Windows Event Forwarding (WEF) settings via the registry
    + WindowsFirewall        - Non-standard firewall rules, "-full" dumps all (arguments == allow/deny/tcp/udp/in/out/domain/private/public)
      WindowsVault           - Credentials saved in the Windows Vault (i.e. logins from Internet Explorer and Edge).
    + WMI                    - Runs a specified WMI query
      WMIEventConsumer       - Lists WMI Event Consumers
      WMIEventFilter         - Lists WMI Event Filters
      WMIFilterBinding       - Lists WMI Filter to Consumer Bindings
    + WSUS                   - Windows Server Update Services (WSUS) settings, if applicable


Seatbelt has the following command groups: All, User, System, Slack, Chromium, Remote, Misc

    You can invoke command groups with         "Seatbelt.exe <group>"


    Or command groups except specific commands "Seatbelt.exe <group> -Command"

   "Seatbelt.exe -group=all" runs all commands

   "Seatbelt.exe -group=user" runs the following commands:

        azuread, Certificates, CertificateThumbprints, ChromiumPresence, CloudCredentials, 
        CloudSyncProviders, CredEnum, dir, DpapiMasterKeys, 
        ExplorerMRUs, ExplorerRunCommands, FileZilla, FirefoxPresence, 
        IdleTime, IEFavorites, IETabs, IEUrls, 
        KeePass, MappedDrives, MTPuTTY, OfficeMRUs, 
        OneNote, OracleSQLDeveloper, PowerShellHistory, PuttyHostKeys, 
        PuttySessions, RDCManFiles, RDPSavedConnections, SecPackageCreds, 
        SlackDownloads, SlackPresence, SlackWorkspaces, SuperPutty, 
        TokenGroups, WindowsCredentialFiles, WindowsVault

   "Seatbelt.exe -group=system" runs the following commands:

        AMSIProviders, AntiVirus, AppLocker, ARPTable, AuditPolicies, 
        AuditPolicyRegistry, AutoRuns, Certificates, CertificateThumbprints, 
        CredGuard, DNSCache, DotNet, EnvironmentPath, 
        EnvironmentVariables, Hotfixes, InterestingProcesses, InternetSettings, 
        LAPS, LastShutdown, LocalGPOs, LocalGroups, 
        LocalUsers, LogonSessions, LSASettings, McAfeeConfigs, 
        NamedPipes, NetworkProfiles, NetworkShares, NTLMSettings, 
        OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, 
        Processes, PSSessionSettings, RDPSessions, RDPsettings, 
        SCCM, SecureBoot, Services, Sysmon, 
        TcpConnections, TokenPrivileges, UAC, UdpConnections, 
        UserRightAssignments, WifiProfile, WindowsAutoLogon, WindowsDefender, 
        WindowsEventForwarding, WindowsFirewall, WMI, WMIEventConsumer, 
        WMIEventFilter, WMIFilterBinding, WSUS

   "Seatbelt.exe -group=slack" runs the following commands:

        SlackDownloads, SlackPresence, SlackWorkspaces

   "Seatbelt.exe -group=chromium" runs the following commands:

        ChromiumBookmarks, ChromiumHistory, ChromiumPresence

   "Seatbelt.exe -group=remote" runs the following commands:

        AMSIProviders, AntiVirus, AuditPolicyRegistry, ChromiumPresence, CloudCredentials, 
        DNSCache, DotNet, DpapiMasterKeys, EnvironmentVariables, 
        ExplicitLogonEvents, ExplorerRunCommands, FileZilla, Hotfixes, 
        InterestingProcesses, KeePass, LastShutdown, LocalGroups, 
        LocalUsers, LogonEvents, LogonSessions, LSASettings, 
        MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings, 
        OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, 
        ProcessOwners, PSSessionSettings, PuttyHostKeys, PuttySessions, 
        RDPSavedConnections, RDPSessions, RDPsettings, SecureBoot, 
        Sysmon, WindowsDefender, WindowsEventForwarding, WindowsFirewall
        

   "Seatbelt.exe -group=misc" runs the following commands:

        ChromiumBookmarks, ChromiumHistory, ExplicitLogonEvents, FileInfo, FirefoxHistory, 
        InstalledProducts, InterestingFiles, LogonEvents, LOLBAS, 
        McAfeeSiteList, MicrosoftUpdates, OutlookDownloads, PowerShellEvents, 
        Printers, ProcessCreationEvents, ProcessOwners, RecycleBin, 
        reg, RPCMappedEndpoints, ScheduledTasks, SearchIndex, 
        SecurityPackages, SysmonEvents


Examples:
    'Seatbelt.exe <Command> [Command2] ...' will run one or more specified checks only
    'Seatbelt.exe <Command> -full' will return complete results for a command without any filtering.
    'Seatbelt.exe "<Command> [argument]"' will pass an argument to a command that supports it (note the quotes).
    'Seatbelt.exe -group=all' will run ALL enumeration checks, can be combined with "-full".
    'Seatbelt.exe -group=all -AuditPolicies' will run all enumeration checks EXCEPT AuditPolicies, can be combined with "-full".
    'Seatbelt.exe <Command> -computername=COMPUTER.DOMAIN.COM [-username=DOMAIN\USER -password=PASSWORD]' will run an applicable check remotely
    'Seatbelt.exe -group=remote -computername=COMPUTER.DOMAIN.COM [-username=DOMAIN\USER -password=PASSWORD]' will run remote specific checks
    'Seatbelt.exe -group=system -outputfile="C:\Temp\out.txt"' will run system checks and output to a .txt file.
    'Seatbelt.exe -group=user -q -outputfile="C:\Temp\out.json"' will run in quiet mode with user checks and output to a .json file.

Note: searches that target users will run for the current user if not-elevated and for ALL users if elevated.

Command Groups

Note: many commands do some type of filtering by default. Supplying the -full argument prevents filtering output. Also, the command group all will run all current checks.

For example, the following command will run ALL checks and returns ALL output:

Seatbelt.exe -group=all -full

system

Runs checks that mine interesting data about the system.

Executed with: Seatbelt.exe -group=system

Command	Description
AMSIProviders	Providers registered for AMSI
AntiVirus	Registered antivirus (via WMI)
AppLocker	AppLocker settings, if installed
ARPTable	Lists the current ARP table and adapter information(equivalent to arp -a)
AuditPolicies	Enumerates classic and advanced audit policy settings
AuditPolicyRegistry	Audit settings via the registry
AutoRuns	Auto run executables/scripts/programs
Certificates	User and machine personal certificate files
CertificateThumbprints	Thumbprints for all certificate store certs on the system
CredGuard	CredentialGuard configuration
DNSCache	DNS cache entries (via WMI)
DotNet	DotNet versions
EnvironmentPath	Current environment %PATH$ folders and SDDL information
EnvironmentVariables	Current user environment variables
Hotfixes	Installed hotfixes (via WMI)
InterestingProcesses	"Interesting" processes - defensive products and admin tools
InternetSettings	Internet settings including proxy configs
LAPS	LAPS settings, if installed
LastShutdown	Returns the DateTime of the last system shutdown (via the registry)
LocalGPOs	Local Group Policy settings applied to the machine/local users
LocalGroups	Non-empty local groups, "full" displays all groups (argument == computername to enumerate)
LocalUsers	Local users, whether they're active/disabled, and pwd last set (argument == computername to enumerate)
LogonSessions	Logon events (Event ID 4624) from the security event log. Default of 10 days, argument == last X days.
LSASettings	LSA settings (including auth packages)
McAfeeConfigs	Finds McAfee configuration files
NamedPipes	Named pipe names and any readable ACL information
NetworkProfiles	Windows network profiles
NetworkShares	Network shares exposed by the machine (via WMI)
NTLMSettings	NTLM authentication settings
OptionalFeatures	TODO
OSInfo	Basic OS info (i.e. architecture, OS version, etc.)
PoweredOnEvents	Reboot and sleep schedule based on the System event log EIDs 1, 12, 13, 42, and 6008. Default of 7 days, argument == last X days.
PowerShell	PowerShell versions and security settings
Processes	Running processes with file info company names that don't contain 'Microsoft', "full" enumerates all processes
PSSessionSettings	Enumerates PS Session Settings from the registry
RDPSessions	Current incoming RDP sessions (argument == computername to enumerate)
RDPsettings	Remote Desktop Server/Client Settings
SCCM	System Center Configuration Manager (SCCM) settings, if applicable
Services	Services with file info company names that don't contain 'Microsoft', "full" dumps all processes
Sysmon	Sysmon configuration from the registry
TcpConnections	Current TCP connections and their associated processes and services
TokenPrivileges	Currently enabled token privileges (e.g. SeDebugPrivilege/etc.)
UAC	UAC system policies via the registry
UdpConnections	Current UDP connections and associated processes and services
UserRightAssignments	Configured User Right Assignments (e.g. SeDenyNetworkLogonRight, SeShutdownPrivilege, etc.) argument == computername to enumerate
WifiProfile	TODO
WindowsAutoLogon	Registry autologon information
WindowsDefender	Windows Defender settings (including exclusion locations)
WindowsEventForwarding	Windows Event Forwarding (WEF) settings via the registry
WindowsFirewall	Non-standard firewall rules, "full" dumps all (arguments == allow/deny/tcp/udp/in/out/domain/private/public)
WMIEventConsumer	Lists WMI Event Consumers
WMIEventFilter	Lists WMI Event Filters
WMIFilterBinding	Lists WMI Filter to Consumer Bindings
WSUS	Windows Server Update Services (WSUS) settings, if applicable

user

Runs checks that mine interesting data about the currently logged on user (if not elevated) or ALL users (if elevated).

Executed with: Seatbelt.exe -group=user

Command	Description
Certificates	User and machine personal certificate files
CertificateThumbprints	Thumbprints for all certificate store certs on the system
ChromiumPresence	Checks if interesting Chrome/Edge/Brave/Opera files exist
CloudCredentials	AWS/Google/Azure cloud credential files
CloudSyncProviders	TODO
CredEnum	Enumerates the current user's saved credentials using CredEnumerate()
dir	Lists files/folders. By default, lists users' downloads, documents, and desktop folders (arguments == <directory> <depth> <regex>
DpapiMasterKeys	List DPAPI master keys
Dsregcmd	TODO
ExplorerMRUs	Explorer most recently used files (last 7 days, argument == last X days)
ExplorerRunCommands	Recent Explorer "run" commands
FileZilla	FileZilla configuration files
FirefoxPresence	Checks if interesting Firefox files exist
IdleTime	Returns the number of seconds since the current user's last input.
IEFavorites	Internet Explorer favorites
IETabs	Open Internet Explorer tabs
IEUrls	Internet Explorer typed URLs (last 7 days, argument == last X days)
KeePass	TODO
MappedDrives	Users' mapped drives (via WMI)
OfficeMRUs	Office most recently used file list (last 7 days)
OneNote	TODO
OracleSQLDeveloper	TODO
PowerShellHistory	Iterates through every local user and attempts to read their PowerShell console history if successful will print it
PuttyHostKeys	Saved Putty SSH host keys
PuttySessions	Saved Putty configuration (interesting fields) and SSH host keys
RDCManFiles	Windows Remote Desktop Connection Manager settings files
RDPSavedConnections	Saved RDP connections stored in the registry
SecPackageCreds	Obtains credentials from security packages
SlackDownloads	Parses any found 'slack-downloads' files
SlackPresence	Checks if interesting Slack files exist
SlackWorkspaces	Parses any found 'slack-workspaces' files
SuperPutty	SuperPutty configuration files
TokenGroups	The current token's local and domain groups
WindowsCredentialFiles	Windows credential DPAPI blobs
WindowsVault	Credentials saved in the Windows Vault (i.e. logins from Internet Explorer and Edge).

misc

Runs all miscellaneous checks.

Executed with: Seatbelt.exe -group=misc

Command	Description
ChromiumBookmarks	Parses any found Chrome/Edge/Brave/Opera bookmark files
ChromiumHistory	Parses any found Chrome/Edge/Brave/Opera history files
ExplicitLogonEvents	Explicit Logon events (Event ID 4648) from the security event log. Default of 7 days, argument == last X days.
FileInfo	Information about a file (version information, timestamps, basic PE info, etc. argument(s) == file path(s)
FirefoxHistory	Parses any found FireFox history files
InstalledProducts	Installed products via the registry
InterestingFiles	"Interesting" files matching various patterns in the user's folder. Note: takes non-trivial time.
LogonEvents	Logon events (Event ID 4624) from the security event log. Default of 10 days, argument == last X days.
LOLBAS	Locates Living Off The Land Binaries and Scripts (LOLBAS) on the system. Note: takes non-trivial time.
McAfeeSiteList	Decrypt any found McAfee SiteList.xml configuration files.
MicrosoftUpdates	All Microsoft updates (via COM)
OutlookDownloads	List files downloaded by Outlook
PowerShellEvents	PowerShell script block logs (4104) with sensitive data.
Printers	Installed Printers (via WMI)
ProcessCreationEvents	Process creation logs (4688) with sensitive data.
ProcessOwners	Running non-session 0 process list with owners. For remote use.
RecycleBin	Items in the Recycle Bin deleted in the last 30 days - only works from a user context!
reg	Registry key values (HKLM\Software by default) argument == [Path] [intDepth] [Regex] [boolIgnoreErrors]
RPCMappedEndpoints	Current RPC endpoints mapped
ScheduledTasks	Scheduled tasks (via WMI) that aren't authored by 'Microsoft', "full" dumps all Scheduled tasks
SearchIndex	Query results from the Windows Search Index, default term of 'passsword'. (argument(s) == <search path> <pattern1,pattern2,...>
SecurityPackages	Enumerates the security packages currently available using EnumerateSecurityPackagesA()
SysmonEvents	Sysmon process creation logs (1) with sensitive data.

Additional Command Groups

Executed with: Seatbelt.exe -group=GROUPNAME

Alias	Description
Slack	Runs modules that start with "Slack*"
Chromium	Runs modules that start with "Chromium*"
Remote	Runs the following modules (for use against a remote system): AMSIProviders, AntiVirus, AuditPolicyRegistry, ChromiumPresence, CloudCredentials, DNSCache, DotNet, DpapiMasterKeys, EnvironmentVariables, ExplicitLogonEvents, ExplorerRunCommands, FileZilla, Hotfixes, InterestingProcesses, KeePass, LastShutdown, LocalGroups, LocalUsers, LogonEvents, LogonSessions, LSASettings, MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings, OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, ProcessOwners, PSSessionSettings, PuttyHostKeys, PuttySessions, RDPSavedConnections, RDPSessions, RDPsettings, Sysmon, WindowsDefender, WindowsEventForwarding, WindowsFirewall

Command Arguments

Command that accept arguments have it noted in their description. To pass an argument to a command, enclose the command an arguments in double quotes.

For example, the following command returns 4624 logon events for the last 30 days:

Seatbelt.exe "LogonEvents 30"

The following command queries a registry three levels deep, returning only keys/valueNames/values that match the regex .*defini.*, and ignoring any errors that occur.

Seatbelt.exe "reg \"HKLM\SOFTWARE\Microsoft\Windows Defender\" 3 .*defini.* true"

Output

Seatbelt can redirect its output to a file with the -outputfile="C:\Path\file.txt" argument. If the file path ends in .json, the output will be structured json.

For example, the following command will output the results of system checks to a txt file:

Seatbelt.exe -group=system -outputfile="C:\Temp\system.txt"

Remote Enumeration

Commands noted with a + in the help menu can be run remotely against another system. This is performed over WMI via queries for WMI classes and WMI's StdRegProv for registry enumeration.

To enumerate a remote system, supply -computername=COMPUTER.DOMAIN.COM - an alternate username and password can be specified with -username=DOMAIN\USER -password=PASSWORD

For example, the following command runs remote-focused checks against a remote system:

Seatbelt.exe -group=remote -computername=192.168.230.209 -username=THESHIRE\sam -password="yum \"po-ta-toes\""

Building Your Own Modules

Seatbelt's structure is completely modular, allowing for additional command modules to be dropped into the file structure and loaded up dynamically.

There is a commented command module template at .\Seatbelt\Commands\Template.cs for reference. Once built, drop the module in the logical file location, include it in the project in the Visual Studio Solution Explorer, and compile.

Compile Instructions

We are not planning on releasing binaries for Seatbelt, so you will have to compile yourself.

Seatbelt has been built against .NET 3.5 and 4.0 with C# 8.0 features and is compatible with Visual Studio Community Edition. Simply open up the project .sln, choose "release", and build. To change the target .NET framework version, modify the project's settings and rebuild the project.

Acknowledgments

Seatbelt incorporates various collection items, code C# snippets, and bits of PoCs found throughout research for its capabilities. These ideas, snippets, and authors are highlighted in the appropriate locations in the source code, and include:

• @andrewchiles' HostEnum.ps1 script and @tifkin_'s Get-HostProfile.ps1 provided inspiration for many of the artifacts to collect.
• Boboes' code concerning NetLocalGroupGetMembers
• ambyte's code for converting a mapped drive letter to a network path
• Igor Korkhov's code to retrieve current token group information
• RobSiklos' snippet to determine if a host is a virtual machine
• JGU's snippet on file/folder ACL right comparison
• Rod Stephens' pattern for recursive file enumeration
• SwDevMan81's snippet for enumerating current token privileges
• Jared Atkinson's PowerShell work on Kerberos ticket caches
• darkmatter08's Kerberos C# snippet
• Numerous PInvoke.net samples <3
• Jared Hill's awesome CodeProject to use Local Security Authority to Enumerate User Sessions
• Fred's code on querying the ARP cache
• ShuggyCoUk's snippet on querying the TCP connection table
• yizhang82's example of using reflection to interact with COM objects through C#
• @djhohnstein's SharpWeb project
• @djhohnstein's EventLogParser project
• @cmaddalena's SharpCloud project, BSD 3-Clause
• @_RastaMouse's Watson project, GPL License
• @_RastaMouse's Work on AppLocker enumeration
• @peewpw's Invoke-WCMDump project, GPL License
• TrustedSec's HoneyBadger project, BSD 3-Clause
• CENTRAL Solutions's Audit User Rights Assignment Project, No license
• Collection ideas inspired from @ukstufus's Reconerator
• Office MRU locations and timestamp parsing information from Dustin Hurlbut's paper Microsoft Office 2007, 2010 - Registry Artifacts
• The Windows Commands list, used for sensitive regex construction
• Ryan Ries' code for enumeration mapped RPC endpoints
• Chris Haas' post on EnumerateSecurityPackages()
• darkoperator's work on the HoneyBadger project
• @airzero24's work on WMI Registry enumeration
• Alexandru's answer on RegistryKey.OpenBaseKey alternatives
• Tomas Vera's post on JavaScriptSerializer
• Marc Gravell's note on recursively listing files/folders
• @mattifestation's Sysmon rule parser
• Some inspiration from spolnik's Simple.CredentialsManager project, Apache 2 license
• This post on Credential Guard settings
• This thread on network profile information
• Mark McKinnon's post on decoding the DateCreated and DateLastConnected SSID values
• This Specops post on group policy caching
• sa_ddam213's StackOverflow post on enumerating items in the Recycle Bin
• Kirill Osenkov's code for managed assembly detection
• The Mono project for the SecBuffer/SecBufferDesc classes
• Elad Shamir and his Internal-Monologue project, Vincent Le Toux for his DetectPasswordViaNTLMInFlow project, and Lee Christensen for this GetNTLMChallenge project. All of these served as inspiration int he SecPackageCreds command.
• @leftp and @eksperience's Gopher project for inspiration for the FileZilla and SuperPutty commands
• @funoverip for the original McAfee SiteList.xml decryption code

We've tried to do our due diligence for citations, but if we've left someone/something out, please let us know!

seatbelt's Issues

OSInfo Exception

Describe the bug
An exception is being thrown during the OSInfo command:

====== OSInfo ======

ERROR:   [!] Terminating exception running command 'OSInfo': System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
   at Seatbelt.Runtime.GetEnvironmentVariable(String variableName)
   at Seatbelt.Commands.Windows.OSInfoCommand.<Execute>d__10.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs. Occurred during remote collection. Other commands that used the registry worked fine, but this one didn't for whatever reason.

To Reproduce
seatbelt.exe -q -group=remote -computername=COMPUTER

Expected behavior
The command to run and return OS information. If it can't, collect one piece of info, at least return a partial result (or print an error where the problem happened)

Observed behavior
An exception occurs and no command output is recieved

Errors during WindowsVault enumeration

Not sure is this is known issue but I see multiple errors when enumerating WindowsVault

ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented

Release

Please, could You release a x86 and x86-64 version? Thank You

WMI Error in the InterestingProcesses Command

Describe the bug
An exception is being thrown during the InterestingProcesses command:

ERROR:   [!] Terminating exception running command 'InterestingProcesses': System.Management.ManagementException: Not found 
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementObject.InvokeMethod(String methodName, ManagementBaseObject inParameters, InvokeMethodOptions options)
   at System.Management.ManagementObject.InvokeMethod(String methodName, Object[] args)
   at Seatbelt.Commands.Windows.InterestingProcessesCommand.<Execute>d__10.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs.
Looks like it may manifest itself on 2012 R2 machines. Might also occur after performing lateral movement to a host using WMI or WinRM.

Looks like it might be caused when obtaining the process owner (that's the only place a WMI method is invoked)

To Reproduce
Run Seatbelt's InterestingProcesses command.

Expected behavior
The command to run, displaying interesting process, or a notification saying that there aren't any or it's not possible to run this command.

Observed behavior
Some processes are output, but then the process listing is cut short due to an exception

ChromiumHistory: IO exception, history file likely in use

When running the ChromiumHistory command i get the following error:
ERROR: IO exception, history file likely in use (i.e. browser is likely running): The process cannot access the file ...

This line is where it fails:

Seatbelt/Seatbelt/Commands/Browser/ChromiumHistoryCommand.cs

Line 57 in fa0f2d9

using (var r = new StreamReader(userChromiumHistoryPath))

I've replaced it with the following lines, and it seems to have fixed it, i can now extract history while the browser is running (tested with Chrome, Edge and Brave, all latest versions):

using (var fs = new FileStream(userChromiumHistoryPath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
using (var r = new StreamReader(fs)){ ...

Link in Readme.md points to outdated Visual Studio Community Edition

The link in Readme.md below Compile Instructions points to Visual Studio Community Edition version 2015, this does not recognize the used version C# 8.0 in config. It will throw the error "CS1617 C# Invalid option for /langversion" as it only recognizes version 1 through 6.

I would recommend linking to https://visualstudio.microsoft.com/downloads/, this gives the option for Visual Studio 2019.

Non-nullable property 'Path' must contain a non-null value when exiting constructor.

Build started...
1>------ Build started: Project: Seatbelt, Configuration: Debug Any CPU ------
1>C:\Users\Lalit\Source\Repos\Seatbelt\Seatbelt\Commands\Misc\LOLBAS.cs(130,27,130,31): error CS8618: Non-nullable property 'Path' must contain a non-null value when exiting constructor. Consider declaring the property as nullable.
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

WriteVerbose($"Found: {query.Count()} LOLBAS");
WriteHost("\nTo see how to use the LOLBAS that were found go to https://lolbas-project.github.io/");
}

    internal class LolbasDTO : CommandDTOBase
    {

line 130: public string Path { get; set; }

PSSessionSettings null value exception

Describe the bug
When running the PSSessionSettings command, it failed with the following exception:

====== PSSessionSettings ======

  Name : Microsoft.PowerShell
    BUILTIN\Administrators                 AccessAllowed      

ERROR:   [!] Terminating exception running command 'PSSessionSettings': System.ArgumentNullException: Value cannot be null.
Parameter name: s
   at System.IO.StringReader..ctor(String s)
   at System.Xml.XmlDocument.LoadXml(String xml)
   at Windows.PSSessionSettingsCommand.<Execute>d__10.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

To Reproduce
I don't have access to a system where I can reproduce the first error . Occurred when running the PSSessionSettings command on a Windows 7 Enterprise system.

Expected behavior
The module to run and display this PS session settings or not display anything at all

Observed behavior
An exception was thrown

Localized names for well-known groups (e.g. "Administrators") aren't implemented

Windows has localized names for well-known groups in some locales (for example French or German).
The "Local Group Memberships" section does not implement those and therefore fails on such localized Windows versions.

Compile error on .NET 4.5

MSBuild complains when I try to compile latest version from git in .net 4.5:

  Commands\Misc\LOLBAS.cs(130,27): error CS8618: Non-nullable property 'Path' is uninitialized. Consider declaring the property as nullable. [D:\a\1\s\Seatbelt\Seatbelt.csproj]

Without the LOLBAS module it compiles fine. Probably not that hard to fix but I don't have a VS env and git setup nearby to test and create a PR. Thx for the work on this!

PowerShellHistory Exception

Describe the bug
PowerShellHistory was failing with the following error:

ERROR:   [!] Terminating exception running command 'PowerShellHistory': System.ArgumentOutOfRangeException: StartIndex cannot be less than zero.
Parameter name: startIndex
   at System.String.Substring(Int32 startIndex, Int32 length)
   at Windows.PowerShellHistoryCommand.<Execute>d__10.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

Not sure what was causing it and don't have the ConsoleHost_history.txt to troubleshoot

To Reproduce
Run Seatbelt.exe -q PowerShellHistory

Expected behavior
For the command to run and no errors be thrown

Observed behavior
An exception was thrown due to string parsing bugs

Environment.Exit() is bad

Describe the bug

Maybe not fair to call this a bug, but Seatbelt calls Environment.Exit() here:
https://github.com/GhostPack/Seatbelt/blob/master/Seatbelt/Runtime.cs#L77

When Seatbelt is being run via (or integrated into) a tool/implant like Covenant's Grunt that runs the assembly within the implant's process (i.e. no fork & run) - it will cause the whole implant to exit when this exception is caught.

It would be nicer to orchestrate a way of gracefully returning so we can drop out of the assembly without explicitly calling this exit method.

To Reproduce

1. Start a Grunt.
2. Run Seatbelt with some remote enumeration options that will fail, e.g: Seatbelt -group=remote -computername=something.local -username=DOMAIN\fake -password=DoesNotMatter.
3. Watch the Grunt exit.

Unhandled exception for extremely long file names

When running seatbelt.exe all on a machine it consistently errored out when encountering file names that were at the maximum permissible length in windows.

The following error was thrown

Unhandled Exception: System.IO.PathTooLongException: The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.
at System.IO.Path.SafeSetStackPointerValue(Char* buffer, Int32 index, Char value)
at System.IO.Path.NormalizePathFast(String path, Boolean fullCheck)
at System.IO.File.GetLastAccessTimeUtc(String path)
at Seatbelt.Program.ListInterestingFiles()
at Seatbelt.Program.Main(String[] args)

If the program can skip (and maybe count how many files are skipped) without crashing that would be desirable behavior. Alternately, handling the unusually long values and parsing them the same would be ideal.

Using the latest version of Seatbelt and compiled locally.

Related: def4ef3
#9

Thanks,

The arguments "all" and "full" cannot be combined

The README states that:

SeatBelt.exe all will run ALL enumeration checks, can be combined with full.

And the blog post states that:

SeatBelt.exe [system/user/all/CheckName] full will prevent any filtering and will return complete results.

However something seems wrong with the arguments parsing since neither Seatbelt.exe all full nor Seatbelt.exe full all work. Both generate the Check "all" not found! error.

Hotfixes command error

Expect behaviour

hotfixes command returns a list of applied hotfixes

Actual behaviour

The following error is returned. This has been tested against Windows 10 (local + remote), Windows Server 2003 (remote), Widows Server 2012r2 (remote)

====== Hotfixes ======

Enumerating Windows Hotfixes. For all Microsoft updates, use the 'MicrosoftUpdates' command.

ERROR: [!] Terminating exception running command 'Hotfixes': System.FormatException: String was not recognized as a valid DateTime.
at System.DateTimeParse.Parse(String s, DateTimeFormatInfo dtfi, DateTimeStyles styles)
at System.Convert.ToDateTime(String value)
at Seatbelt.Commands.Windows.HotfixCommand.d__10.MoveNext()
at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

Steps to reproduce

.\seatbelt.exe hotfixes

Thank you very much for this brilliant tools, by the way :D

License file states wrong project

The LICENSE file states Rubeus. Should be Seatbelt.

FEATURE REQ: Add checks for Oracle SQLDeveloper connections.xml

Hi there,

Would it be possible to incorporate support for the connections.xml file that Oracle SQLDeveloper will drop, containing hostnames and credentials? Often useful for onward lateral movement.

I believe it is stored in:
\Users[User]\AppData\Roaming\SQL Developer\System\

but also often under a subfolder such as:

(Win 7)
C:\Users\<username>\AppData\Roaming\SQL Developer\systemX.X.X.X.X\o.jdeveloper.db.connection.X.X.X.X.X.X.X\connections.xml
or
“C:\users\USER\AppData\Roaming\SQL Developer\system3.1.07.42\o.jdeveloper.db.connection.11.1.1.4.37.59.48”.

They can also be decrypted using something similar to this:
https://pypi.org/project/sqldeveloperpassworddecryptor/

If I figure out how to do it within the code, I'll do a PR, but thought I'd submit this issue so that others can see it also.

Unhandled Exception for == Interesting Files (All Users) ==

=== Interesting Files (All Users) ===

Unhandled Exception: System.IO.PathTooLongException: The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.
at System.IO.Path.SafeSetStackPointerValue(Char* buffer, Int32 index, Char value)
at System.IO.Path.NormalizePathFast(String path, Boolean fullCheck)
at System.IO.Path.GetDirectoryName(String path)
at System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
at System.IO.Directory.GetFiles(String path, String searchPattern, SearchOption searchOption)
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1362
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.ListInterestingFiles() in C:\git\Seatbelt\Seatbelt\Program.cs:line 5446
at Seatbelt.Program.Main(String[] args) in C:\git\Seatbelt\Seatbelt\Program.cs:line 5735

Powershell cmd exception

.\sb.exe powershell

                    %&&@@@&&
                    &&&&&&&%%%,                       #&&@@@@@@%%%%%%###############%
                    &%&   %&%%                        &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%%

%%%%%%%%%%%######%%%#%%####% &%%**# @////(((&%%%%%%######################(((((((((((((((((((
#%#%%%%%%%#######%#%%####### %&%,,,,,,,,,,,,,,,, @////(((&%%%%%#%#####################(((((((((((((((((((
#%#%%%%%%#####%%#%#%%####### %%%,,,,,, ,,. ,, @////(((&%%%%%%%######################(#(((#(#((((((((((
#####%%%#################### &%%...... ... .. @////(((&%%%%%%%###############%######((#(#(####((((((((
#######%##########%######### %%%...... ... .. @////(((&%%%%%#########################(#(#######((#####
###%##%%#################### &%%............... @////(((&%%%%%%%%##############%#######(#########((#####
#####%###################### %%%.. @////(((&%%%%%%%################
&%& %%%%% Seatbelt %////(((&%%%%%%%%#############*
&%%&&&%%%%% v1.1.1 ,(((&%%%%%%%%%%%%%%%%%,
#%%%%##,

====== PowerShell ======

ERROR: [!] Terminating exception running command 'PowerShell': System.FormatException: Input string was not in a correct format.
at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
at Seatbelt.Commands.Windows.PowerShellCommand.d__14.MoveNext()
at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

[*] Completed collection in 5.54 seconds

To enumerate a remote system, supply -computername=COMPUTER.DOMAIN.COM - an alternate username and password can be specified with -username=DOMAIN\USER -password=PASSWORD For example, the following command runs remote-focused checks against a remote system: Seatbelt.exe -group=remote -computername=192.168.230.209 -username=THESHIRE\sam -password="yum \"po-ta-toes\""

username是字符串吗？还是路径？
password的问题一样。

IETabs Exception

Describe the bug
An exception is being thrown during the IETabs command:

ERROR:   [!] Terminating exception running command 'IETabs': System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Runtime.InteropServices.COMException: The server process could not be started because the configured identity is incorrect. Check the username and password. (Exception from HRESULT: 0x8000401A)
   --- End of inner exception stack trace ---
   at System.RuntimeType.InvokeDispMethod(String name, BindingFlags invokeAttr, Object target, Object[] args, Boolean[] byrefModifiers, Int32 culture, String[] namedParameters)
   at System.RuntimeType.InvokeMember(String name, BindingFlags bindingFlags, Binder binder, Object target, Object[] providedArgs, ParameterModifier[] modifiers, CultureInfo culture, String[] namedParams)
   at Seatbelt.Commands.Browser.InternetExplorerTabCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs.
Looks like it may manifest itself on 2012 R2 machines. Might also occur after performing lateral movement to a host using WMI or WinRM.

Another error also happens when logged in as a user and you use runas to start a command prompt (not with /netonly) and then run the IETabs command:

ERROR:   [!] Terminating exception running command 'IETabs': System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.UnauthorizedAccessException: Access is denied.

   --- End of inner exception stack trace ---
   at System.RuntimeType.InvokeDispMethod(String name, BindingFlags invokeAttr, Object target, Object[] args, Boolean[] byrefModifiers, Int32 culture, String[] namedParameters)
   at System.RuntimeType.InvokeMember(String name, BindingFlags bindingFlags, Binder binder, Object target, Object[] providedArgs, ParameterModifier[] modifiers, CultureInfo culture, String[] namedParams)
   at System.Type.InvokeMember(String name, BindingFlags invokeAttr, Binder binder, Object target, Object[] args)
   at Seatbelt.Commands.Browser.InternetExplorerTabCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

Occurs even if the directory you're in is writable.

To Reproduce
Run Seatbelt's IETabs command.

Expected behavior
The command to run, displaying any tabs, or a notification saying that there aren't any or it's not possible to run this command.

Observed behavior
An exception occurs.

Seatbelt.exe not executed through Invoke-ReflectedPSInject (What am I missing to the puzzle?)

Prologue:

• Compiled seatbelt in a win10 +VS community (no AV, AMSI, etc.)
• The standalone EXE works fine
• Invoke-ReflectedPEInject works fine with a simple calc.exe
• With Seatbelt.exe I get the following errors with both versions of powershell.exe (32/64bit)

PrintNightmare in 2024

Hi 👋
itm4n released a new blog post about misconfiguration that could lead to exploiting PrintNightmare.

The blog: https://itm4n.github.io/printnightmare-exploitation/
itm4n's powershell implementation: itm4n/PrivescCheck@f555354

Detecting misconfiguration:

• Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint RestrictDriverInstallationToAdministrators -> 0
• Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall -> 1
• Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint UpdatePromptSettings -> 2

CredEnum Exception

Describe the bug
When running the CredEnum command, it failed with the following exception:

ERROR:   [!] Terminating exception running command 'CredEnum': System.ComponentModel.Win32Exception (0x80004005): Element not found
   at Windows.CredEnumCommand.<Execute>d__9.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

It looks like it may be accessing an array incorrectly?

Another error:

ERROR:   [!] Terminating exception running command 'CredEnum': System.ComponentModel.Win32Exception (0x80004005): A specified logon session does not exist. It may already have been terminated
   at Seatbelt.Commands.Windows.CredEnumCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

To Reproduce
I don't have access to a system where I can reproduce the first error . Occurred when running the CredEnum command.

The 2nd exception be reproduced by running the CredEnum command under a command prompt started with runas /netonly /user:asdf\asdf cmd.exe

Expected behavior
The module to run and dump creds, or not print anything (or a message saying there weren't any)

Observed behavior
An exception was thrown

Execution fails if FIPS algorithms are enforced

Describe the bug
When "Use FIPS compliant algorithms for encryption, hashing, and signing" is enabled on the system (you can check this with the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy, and if Enabled = 1), Seatbelt throws the following exception:

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.RijndaelManaged..ctor()

To Reproduce
Steps to reproduce the behavior. Please include any applicable artifacts that we could use to replicate the issue(e.g. files, registry keys, screenshots, etc.)

1. Enable the GPO "Use FIPS compliant algorithms for encryption, hashing, and signing"
2. Run Seatbealt running all modules

Expected behavior
Seatbelt should run successfully

Observed behavior
Errors with

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.RijndaelManaged..ctor()

Additional Context
See https://github.com/GhostPack/Rubeus/pull/66/files

Does not build on VS2013

Probably an issue with the reference ?

Error 1 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 62 42 Seatbelt
Error 2 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 81 47 Seatbelt
Error 3 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 805 50 Seatbelt
Error 4 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 841 44 Seatbelt
Error 5 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 871 43 Seatbelt
Error 6 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 886 41 Seatbelt
Error 7 { expected E:\pentest\Seatbelt\Seatbelt\Program.cs 4319 44 Seatbelt
Error 8 ; expected E:\pentest\Seatbelt\Seatbelt\Program.cs 4319 100 Seatbelt
Error 9 } expected E:\pentest\Seatbelt\Seatbelt\Program.cs 4322 14 Seatbelt
Error 10 The name 'when' does not exist in the current context E:\pentest\Seatbelt\Seatbelt\Program.cs 4319 44 Seatbelt

OfficeMRUs Exception

Describe the bug
An exception is being thrown during the OfficeMRUs command:

ERROR:   [!] Terminating exception running command 'OfficeMRUs': System.InvalidCastException: Unable to cast object of type 'System.Int32' to type 'System.String'.
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<GetMRUsValues>d__12.MoveNext()
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<GetMRUsFromVersionKey>d__11.MoveNext()
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<EnumRecentOfficeFiles>d__10.MoveNext()
   at System.Linq.Buffer`1..ctor(IEnumerable`1 source)
   at System.Linq.OrderedEnumerable`1.<GetEnumerator>d__1.MoveNext()
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs.
Looks like it may manifest itself on 2012 R2 machines. Might also occur after performing lateral movement to a host using WMI or WinRM.

To Reproduce
Run Seatbelt's OfficeMRUs command.

Expected behavior
The command to run, displaying an MRUs, or a notification saying that there aren't any.

Observed behavior
An exception occurs.

Is It Possible To Run On System Without .NET Framework 3.5 Installed

I was wondering if it was possible to run this complied .exe binary on a Windows system which doesnt have .NET 3.5 framework installed. My inital thoughts is no but just wanted to reach out for a definitive answer.

SearchIndex Exception

Describe the bug
When running the SearchIndex command, it failed with the following exception:

ERROR:   [!] Terminating exception running command 'SearchIndex': System.InvalidOperationException: The 'Search.CollatorDSO' provider is not registered on the local machine.
   at System.Data.OleDb.OleDbServicesWrapper.GetDataSource(OleDbConnectionString constr, DataSourceWrapper& datasrcWrapper)
   at System.Data.OleDb.OleDbConnectionInternal..ctor(OleDbConnectionString constr, OleDbConnection connection)
   at System.Data.OleDb.OleDbConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningObject)
   at System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource`1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection)
   at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource`1 retry, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionInternal.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
   at System.Data.OleDb.OleDbConnection.Open()
   at SearchIndexCommand.<SearchWindowsIndex>d__9.MoveNext()
   at SearchIndexCommand.<Execute>d__10.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

To Reproduce
I don't have access to a system where the error occurred . Occurred when running the SearchIndex command.

Occurred on a Server 2012 R2 machine after pivoting via WMI event subs

Expected behavior
The module to run and return matching or not print anything or print a message saying the searchindexer isn't available

Observed behavior
An exception was thrown