search

peass-ng / PEASS-ng

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
https://book.hacktricks.xyz
Other
15.73k stars 3.05k forks source link

Windows Defender flag winPEASany_ofs.exe with the "one line setupping" (powershell). - W10 21h1 #273

Closed archidote closed 2 years ago

archidote commented 2 years ago

Issue description

Hello ! I encoutered an issue when I tried to execute winPEAS on windows 10 pro (domain's PC) as a normal user.

Steps to reproduce the issue

  1. Open Cmd.exe and tap "powershell"
$url = "https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASany_ofs.exe"
$wp=[System.Reflection.Assembly]::Load([byte[]](Invoke-WebRequest "$url" -UseBasicParsing | Select-Object -ExpandProperty Content)); [winPEAS.Program]::Main("")

If winpeas, did you use a clean or obfuscated winpeas, and for which architecture?

winPEASany_ofs.exe

Is there any AV / Threat protection in the system?

Yes. windows defender with full option activated.

Please, indicate the OS, the OS version, and the kernel version (build number in case of Windows)

W10 Pro 21h1 Build : 19043.1348

Please, indicate the check that is failing and add a screenshot showing the problem

fsddsf

sdsqdqs

Additional details / screenshot

when I disbaled the "Real time protection" feature of Windows defender, it's work as I expected.

image

Ps : Your tool work very well on WS22 Datacenter (build : 20348.288). Amazing work ! thank you so much for this powerfull tool. (and also for the linux version).

++

rautamiekka commented 2 years ago

Please change the language to English.

archidote commented 2 years ago

@rautamiekka

Hi, I just updated the post with english screenshots.

I apologize for showing you some french powershell errors code

++

clem9669 commented 2 years ago

@archidote how sure are you that winPEAS get detected as a virus ?

Because the powershell issue don't mention any virus problem.

carlospolop commented 2 years ago

Hi @archidote, I offer the obfuscated version of Winpeas as a way to offer something more stealth and as an example of how to obfuscate it. I won't be offering a public non-detected version because a public version like that will be undetected only a small period of time. Therefore, if you need an obfuscated version, you will need to create one for yourself at the moment.