search

bitsadmin / wesng

Windows Exploit Suggester - Next Generation
BSD 3-Clause "New" or "Revised" License
4.24k stars 571 forks source link

Truncated systeminfo output #18

Closed raoulh closed 5 years ago

raoulh commented 5 years ago

Hi,

First thanks for this nice tool.

I tried the tool on a Windows Server 2012 R2, and it seems the output of KBs from systeminfo is wrong, and that makes wes to output a lot of false positive.

Here is the output of systeminfo:

Host Name:                 HOSTNAME
OS Name:                   Microsoft Windows Server 2012 R2 Standard
OS Version:                6.3.9600 N/A Build 9600
[...]
Hotfix(s):                 275 Hotfix(s) Installed.
                           [01]: KB2868626
                           [02]: KB2883200
                           [03]: KB2887595
                           [04]: KB2894852
                           [05]: KB2894856
                           [06]: KB2896496
                           [07]: KB2903939
                           [08]: KB2911106
                           [09]: KB2919355
                           [10]: KB2919394
                           [11]: KB2920189
                           [12]: KB2928680
                           [13]: KB2934520
                           [14]: KB2938066
                           [15]: KB2954879
                           [16]: KB2955164
                           [17]: KB2959626
                           [18]: KB2961908
                           [19]: KB2962409
                           [20]: KB2965500
                           [21]: KB2966826
                           [22]: KB2966828
                           [23]: KB2967917
                           [24]: KB2971203
                           [25]: KB2972103
                           [26]: KB2973448
                           [27]: KB2975061
                           [28]: KB2975719
                           [29]: KB2976627
                           [30]: KB2977629
                           [31]: KB2984006
                           [32]: KB2987107
                           [33]: KB2989647
                           [34]: KB2989930
                           [35]: KB2993100
                           [36]: KB2995004
                           [37]: KB2995388
                           [38]: KB2996799
                           [39]: KB2998174
                           [40]: KB3000483
                           [41]: KB3000850
                           [42]: KB3003057
                           [43]: KB3004365
                           [44]: KB3004545
                           [45]: KB3008923
                           [46]: KB3012199
                           [47]: KB3012702
                           [48]: KB3013172
                           [49]: KB3013769
                           [50]: KB3013791
                           [51]: KB3013816
                           [52]: KB3014442
                           [53]: KB3019978
                           [54]: KB3021910
                           [55]: KB3021952
                           [56]: KB3023219
                           [57]: KB3023266
                           [58]: KB3024751
                           [59]: KB3024755
                           [60]: KB3030947
                           [61]: KB3033446
                           [62]: KB3035126
                           [63]: KB3036612
                           [64]: KB3037576
                           [65]: KB3037924
                           [66]: KB3038002
                           [67]: KB3038701
                           [68]: KB3042085
                           [69]: KB3044374
                           [70]: KB3044673
                           [71]: KB3045634
                           [72]: KB3045685
                           [73]: KB3045717
                           [74]: KB3045719
                           [75]: KB3045755
                           [76]: KB3045999
                           [77]: KB3046017
                           [78]: KB3046339
                           [79]: KB3046737
                           [80]: KB3054169
                           [81]: KB3054203
                           [82]: KB3054256
                           [83]: KB3054464
                           [84]: KB3055323
                           [85]: KB3055343
                           [86]: KB3055642
                           [87]: KB3059317
                           [88]: KB3060681
                           [89]: KB3060793
                           [90]: KB3061512
                           [91]: KB3063843
                           [92]: KB3071756
                           [93]: KB3072307
                           [94]: KB3074228
                           [95]: KB3074545
                           [96]: KB3077715
                           [97]: KB3078405
                           [98]: KB3078676
                           [99]: KB3080149
                           [100]: KB3082089
                           [101]: KB3084135
                           [102]: KB3084905
                           [103]: KB3086255
                           [104]: KB3087041
                           [105]: KB3087137
                           [106]: KB3091297
                           [107]: KB3094486
                           [108]: KB3095701
                           [109]: KB3097992
                           [110]: KB3099834
                           [111]: KB3100473
                           [112]: KB3102429
                           [113]: KB3102467
                           [114]: KB3103616
                           [115]: KB3103696
                           [116]: KB3103709
                           [117]: KB3109103
                           [118]: KB3109976
                           [119]: KB3110329
                           [120]: KB3115224
                           [121]: KB3118401
                           [122]: KB3121261
                           [123]: KB3123245
                           [124]: KB3126434
                           [125]: KB3126587
                           [126]: KB3127222
                           [127]: KB3133043
                           [128]: KB3133690
                           [129]: KB3134179
                           [130]: KB3134813
                           [131]: KB3134815
                           [132]: KB3137728
                           [133]: KB3138602
                           [134]: KB3139164
                           [135]: KB3139398
                           [136]: KB3139914
                           [137]: KB3140219
                           [138]: KB3140234
                           [139]: KB3145384
                           [140]: KB3145432
                           [141]: KB3146604
                           [142]: KB3146723
                           [143]: KB3146751
                           [144]: KB3147071
                           [145]: KB3155784
                           [146]: KB3156059
                           [147]: KB3159398
                           [148]: KB3161949
                           [149]: KB3162343
                           [150]: KB3162835
                           [151]: KB3172614
                           [152]: KB3172729
                           [153]: KB3173424
                           [154]: KB3175024
                           [155]: KB3178539
                           [156]: KB3179574
                           [157]: KB3185319
                           [158]: KB3186539
                           [159]: KB3192392
                           [160]: KB3197873
                           [161]: KB3205400
                           [162]: KB4012213
                           [163]: KB4014505
                           [164]: KB4014510
                           [165]: KB4014512
                           [166]: KB4014555
                           [167]: KB4014562
                           [168]: KB4014581
                           [169]: KB4014598
                           [170]: KB4014604
                           [171]: KB4014661
                           [172]: KB4015547
                           [173]: KB4018271
                           [174]: KB4019213
                           [175]: KB4020322
                           [176]: KB4021558
                           [177]: KB4022717
                           [178]: KB4025252
                           [179]: KB4025333
                           [180]: KB4033369
                           [181]: KB4033428
                           [182]: KB4034672
                           [183]: KB4034733
                           [184]: KB4036586
                           [185]: KB4038793
                           [186]: KB4040685
                           [187]: KB4040967
                           [188]: KB4040972
                           [189]: KB4040981
                           [190]: KB4041687
                           [191]: KB4041777
                           [192]: KB4043763
                           [193]: KB4047206
                           [194]: KB4048961
                           [195]: KB4049068
                           [196]: KB4051956
                           [197]: KB4052978
                           [198]: KB4054177
                           [199]: KB4054522
                           [200]: KB4054566
                           [201]: KB4054854
                           [202]: KB4054980
                           [203]: KB4054999
                           [204]: KB4055001
                           [205]: KB4056568
                           [206]: KB4056898
                           [207]: KB4073700
                           [208]: KB4074597
                           [209]: KB4074837
                           [210]: KB4088879
                           [211]: KB4089187
                           [212]: KB4092946
                           [213]: KB4093115
                           [214]: KB4093753
                           [215]: KB4095515
                           [216]: KB4095875
                           [217]: KB4096236
                           [218]: KB4096417
                           [219]: KB4098972
                           [220]: KB4103715
                           [221]: KB4103768
                           [222]: KB4130978
                           [223]: KB4229727
                           [224]: KB4284878
                           [225]: KB4338419
                           [226]: KB4338424
                           [227]: KB4338605
                           [228]: KB4338824
                           [229]: KB4339093
                           [230]: KB4339284
                           [231]: KB4342310
                           [232]: KB4342315
                           [233]: KB4343205
                           [234]: KB4343888
                           [235]: KB4344145
                           [236]: KB4344153
                           [237]: KB4344166
                           [238]: KB4344178
                           [239]: KB4345424
                           [240]: KB4457009
                           [241]: KB4457015
                           [242]: KB4457026
                           [243]: KB4457034
                           [244]: KB4457045
                           [245]: KB4457056
                           [246
Network Card(s):           1 NIC(s) Installed.
                           [01]: HP Ethernet 1Gb 4-port 331T Adapter
                                 Connection Name: ETH-B3
                                 DHCP Enabled:    Yes
                                 DHCP Server:     N/A
                                 IP address(es)
[...]

As you can see the Hotfix(s): entry is truncated...

It would maybe good to find a better way of getting the installed KBs from the machine, because systeminfo seems broken and unreliable.

bitsadmin commented 5 years ago

Thanks Raoul, I added the note at the wiki.

https://github.com/bitsadmin/wesng/wiki/Developers#Observations

bitsadmin commented 5 years ago

Just added support for wmic qfe output in wes.py. See CHANGELOG.md and CMDLINE.md for more details. Make sure to also check out the --usekbdate parameter which will probably eliminate a lot of false positives.

raoulh commented 5 years ago

Nice work, thanks