Add Remote parameter to Invoke-WinlogonCheck

[nurfed1]

Hi,

Would it be possible to add a remote parameter to the Invoke-WinlogonCheck to search in the GPP files in the SYSVOL share, similarly like you implemented in the Invoke-GPPPasswordCheck function?

[itm4n]

Hi,

I think that would be a completely different check.

With Invoke-WinlogonCheck I check whether the registry key is present and if it contains a cleartext password. WIth Invoke-GPPPasswordCheck, on the other hand, I was already parsing local Group Policy files, so implementing a "remote" version was easy because I just had to change the path used for the file search.

For Winlogon I don't even know which file to look for. Perhaps you could elaborate a bit on what you expect. As far as I know you need to create a GPO that populates the Winlogon registry key "manually". This means that I would need to grep all the cached GPO files. :thinking:

[nurfed1]

Hi,

My bad, I didn't closely check the source code of Invoke-WinlogonCheck.

I think these settings can only be configured through Computer configuration > Preferences > Windows Settings > Registry and the corresponding file is \\dc\sysvol\test.lab\Policies\<guid>\Machine\Preferences\Registry\Registry.xml. Here's a sample: Registry.xml.

I think the annoying part is that technically, it's possible to add duplicate registry key/values in a group policy. I created the following sample snippet based on Invoke-GPPPasswordCheck which I think is correct but it's quite ugly.

$GppPath = "\\$($Env:USERDNSDOMAIN)\SYSVOL"

$CachedGPPFiles = Get-ChildItem -Path $GppPath -Recurse -Include 'Registry.xml' -Force -ErrorAction SilentlyContinue

foreach ($File in $CachedGPPFiles) {

    $FileFullPath = $File.FullName 
    Write-Verbose $FileFullPath

    try {
        [xml]$XmlFile = Get-Content -Path $FileFullPath -ErrorAction SilentlyContinue
    }
    catch [Exception] {
        Write-Verbose $_.Exception.Message 
    }

    if ($null -eq $XmlFile) {
        continue
    }

    $Results = New-Object -TypeName PSObject -Property @{    
        DefaultDomainName    = [System.Collections.ArrayList]@()
        DefaultUserName      = [System.Collections.ArrayList]@()
        DefaultPassword      = [System.Collections.ArrayList]@()
        AutoAdminLogon       = [System.Collections.ArrayList]@()
        AltDefaultDomainName = [System.Collections.ArrayList]@()
        AltDefaultUserName   = [System.Collections.ArrayList]@()
        AltDefaultPassword   = [System.Collections.ArrayList]@()
        AltAutoAdminLogon    = [System.Collections.ArrayList]@()
    }

    $XmlFile.GetElementsByTagName("Properties") | ForEach-Object {

        $Properties = $_ 

        if ([string]::IsNullOrEmpty($Properties.value)) {
            return
        }

        switch ($Properties.name) {

            DefaultDomainName {
                $null = $Results.DefaultDomainName.Add($Properties.value)
            }

            DefaultUserName {
                $null = $Results.DefaultUserName.Add($Properties.value)
            }

            DefaultPassword {
                $null = $Results.DefaultPassword.Add($Properties.value)
            }

            AutoAdminLogon {
                $null = $Results.AutoAdminLogon.Add($Properties.value)
            }

            AltDefaultDomainName {
                $null = $Results.AltDefaultDomainName.Add($Properties.value)
            }

            AltDefaultUserName {
                $null = $Results.AltDefaultUserName.Add($Properties.value)
            }

            AltDefaultPassword {
                $null = $Results.AltDefaultPassword.Add($Properties.value)
            }

            AltAutoAdminLogon {
                $null = $Results.AltAutoAdminLogon.Add($Properties.value)
            }
        }
    }

    if ($Results.DefaultPassword.Count -ne 0) {
         $Result = New-Object -TypeName PSObject
         $Result | Add-Member -MemberType "NoteProperty" -Name "Domains" -Value $Results.DefaultDomainName
         $Result | Add-Member -MemberType "NoteProperty" -Name "Usernames" -Value $Results.DefaultUserName
         $Result | Add-Member -MemberType "NoteProperty" -Name "Passwords" -Value $Results.DefaultPassword
         $Result | Add-Member -MemberType "NoteProperty" -Name "AutoAdminLogons" -Value $Results.AutoAdminLogon
         $Result
     }

    if ($Results.AltDefaultPassword.Count -ne 0) {
         $Result = New-Object -TypeName PSObject
         $Result | Add-Member -MemberType "NoteProperty" -Name "Domains" -Value $Results.AltDefaultDomainName
         $Result | Add-Member -MemberType "NoteProperty" -Name "Usernames" -Value $Results.AltDefaultUserName
         $Result | Add-Member -MemberType "NoteProperty" -Name "Passwords" -Value $Results.AltDefaultPassword
         $Result | Add-Member -MemberType "NoteProperty" -Name "AutoAdminLogon" -Value $Results.AltAutoAdminLogon
         $Result
     }
}

[itm4n]

Oh nice! Thank you very much for your detailed answer! Your implementation seems pretty close to what I would have probably done.

I thought about another way to handle the duplicate values but I think the one you chose is the most relevant. As we cannot really determine which value is correct beforehand, the best solution is to return all the values as you did.

I will just make some slight adjustments but, overall, your code seems fine to me. Thanks again. I will probably take care of this in the coming days. :)

[itm4n]

I had to find the time and motivation to do it, but it's finally there! I did some testing using the sample file you attached. It seems to work pretty fine. But of course, I would be glad to have some feedback as well. :slightly_smiling_face:

[itm4n]

By the way, if you want to test it quickly, you can use the following command:

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-WinlogonCheck -Remote"

[nurfed1]

No worries, thank you for your time. I just did a quick test and it seems to be working fine.

[itm4n]

Nice! Thank you for your feedback. So, I close the issue for now but don't hesitate to let me know if something looks wrong.