Extended Full Enumeration for Windows (EFEW)

Introduction

I know some of y'all get lazy when doing or working on CTF Boxes (It often called Boot2root for Indonesian and other countries out there). I went through the same thing. So, i've done writing this tool for mini-Seatbelt and my own ideas to be implemented here. I wrote all of this mainly to speed up my own learning process for Windows privilege escalation. It might look odd since there are plenty of open-source tools out there, yet I still build my own. Maybe it’s just preference, but honestly, I do it because it keeps my learning environment comfortable.

Screenshot

Features

Features

• Enumerates and collects all dates of created files, scheduled task, services in the system
• UAC Bypass enumeration checks (in common way)
• Amsi Bypass on three functions, AmsiOpenSession(), AmsiStringScan(), and AmsiStringBuffer()
• UAC Bypass enumeration basic, general, and modern bypass checks (in advanced way)
• Sensitive Keywords Hunt By Date (adding more features of ESK)
  • Enumerate all suspicious created files, directories, folders by date (CTF-only)
  • Enumerate all files, directories, folders that have sensitive keywords (by date)
  • Enumerate all files, directories, folders that have sensitive keywords (general)
• Users & Groups enumeration
  • Get User Comments
  • Get Local Group Comments
• Drives enumeration
• System Information
• Check AntiVirus
• Enumerate windows suspicious privileges (e.g: SeRestorePrivilege, SeManageVolumePrivilege, SeDebugPrivilege)
• Check Local RecycleBin & AD
• Autoruns
• DNS caches
• ARP tables
• Logon sessions
• Microsoft updates
• AppLocker Settings
• Cloud Credentials
• Check browsers
• Proccesses
  • Checks for windows service (svchost.exe, services.exe) and scheduled task (taskhost.exe)
  • via WMI
  • Process Owner
• Windows Credentials File aka \\Microsoft\\Credentials
• Searches PowerShell console history files for sensitive regex matches
• Registry autologon information
• Enumerates the current user's saved credentials using CredEnumerate()
• RDP Saved Credentials
• WiFi credentials dumping
• TCPConnections
• UDPConnections
• Inline-Execute: .NET assembly loader/injection with ETW and Amsi Bypass on AmsiStringBuffer()
• Probable Suspicious Scheduled Tasks
• Probable Suspicious Windows Services
• Clipboard
• Screenshot, manipulates window states
• winpspy (by @xct) implementation in Rust

Notes

Example Usage

TheFrizz (HTB)

username@target$ C:\Windows\Temp\a.exe enum-sus-word --dirs '.' --exclude-exts 'lock,geLog,css,scss,js,yml,yaml,map,html,uthMicrosoftAdapter.php' --exclude-dirs '.\vendor' --exclude-words 'st,ca,mfa,2FA'

By doing command above, we got some hints here:

Our current user is webservice, because of RCE-ing on the web application. After that, we do some enumeration on users & groups:

We got some information about f.frizzle user that has two groups, Domain Users and Remote Management Use.

References Taken From

• Shoutout to these projects!
  • SharpUp
  • winPEAS
  • Watson
  • Seatbelt
  • PowerUp
• https://hadess.io/74-methods-for-privilege-escalationpart-2/
• https://0xdf.gitlab.io/tags#windows
• https://0xdf.gitlab.io/cheatsheets/offsec
• https://0xdf.gitlab.io/cheatsheets/htb-interactive
• https://www.slideshare.net/slideshow/privilege-escalation-techniques-and-methodology-pdf/277335698
• https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/windows-privilege-escalation/
• https://github.com/gtworek/Priv2Admin?tab=readme-ov-file
• https://github.com/GhostPack/Seatbelt/tree/master/Seatbelt/Commands/Windows