Some Windows hardening with free tools
By: Mark Mo
Tags: Security, Information Security, Infosec, Windows 10

Some Windows hardening with free tools

First, big thanks to @gw1sh1n and @bitwise for their help on this.

Second, as I hear at security meetups, “if you don’t own it, don’t pwn it”. I’m using my virtual environment to reproduce these steps which consists of a 2016 domain controller, a 2008 r2 server and a windows 10 user machine. You could reproduce any one of these machines by asking your build server admin to make and OVA copy of a “gold” image server you want to review. If you only have physical machine, you could get a fresh machine, disconnect it from your network, isolate it and start testing! The point here is I’m testing in a completely isolated environment and I often run tools that I might never run on a computer connected to a real domain. As always, I take frequent snapshots before I install/use tools so I can easily roll back. Run these tools at your own risk and only in an isolated environment where you have permission to test.

First up Microsoft Security Compliance ToolKit https://www.microsoft.com/en-us/download/details.aspx?id=55319

For Microsoft Security Compliance Toolkit download it all to a single folder. I’m going to look at my windows 10 machine which is running version 1803 of windows 10.

Put the zip files all in a folder off of the root due to the path size of the download. I’m using C:\MSCT (short for Microsoft Security Compliance Toolkit). I’m unzipping Policy Analyzer and the Windows 10 Version 1803 Security Baseline zip files into folder C:\MSCT. If you extract it somewhere with a big file path you may run into the path is too long issue.

Now browse to the Policy Analyzer folder and click on PolicyAnalyzer.exe and select the “Add” button

Select “File” and “Add files from GPO’s”

Now Browse here and when you have the “Windows 10 Version 1803 Security Baseline” folder selected click “Select Folder”

You should see this screen and since it is all applicable, just select “Import”

**BE SURE TO SAVE THE FILE IN THE LOCATION IT SUGGUESTS!!!!*** I’m not sure why but if I try to save it in other locations it just doesn’t work some of the time. Do yourself a favor and save it where it suggests. I’m calling my import Microsoft1803BestPractices so I can easily understand what I’m comparing it to.

If you did everything correct your screen should look like this

Next select “Compare Local registry” and “Local Policy” check boxes then click on the “View/Compare” button

At this point it will ask you for an administrative account to pull what it needs. Enter admin credentials for the computer so it can read what it needs.

When the comparison is done you should see this

To focus on conflicts with Microsoft recommendations select view and “Show only Conflicts”

This will help you focus on where you might want to make changes. As you select each individual row, you will see detail about the setting

Next up, Hardening Auditor (https://github.com/cottinghamd/HardeningAuditor) I’m downloading the tools to my Windows 10 box here and I’ll take a snapshot before I run these. This is based on the recommendations from this great PDF here: https://www.asd.gov.au/publications/protect/Hardening_Win10.pdf . Troy Hunt isn’t the only great thing from Australia!

**NOTE, this tool requires at least .net framework 4.0 so make sure you have that if you want to run the .exe file*** Now, click on the .exe and follow the prompts

Say yes (y) to all of the prompts except for the one that wants to know if you want to compare it. When it is done you will get the results and a file called results.csv

It nice to scroll up through to see the details but its also in the CSV file. Here is what the CSV looks like after a touch of formatting in excel.

Now let’s look at one of the machines from an attacker perspective to see what might be exploitable and should be prioritized for fixing

First up Watson from Rasta Mouse. The only hard mild issue with Watson is you need to compile it the last time I checked. To compile this you first need to download visual studio community edition (https://visualstudio.microsoft.com/downloads/). Next download Watson from here (https://github.com/rasta-mouse/Watson )

Open up the watson VS solution

After you open the solution, right click on the project to select properties. I compile/target every version of .net so I don’t ever have to do this more than once!

The build the solution

The output will be here. This is where you can copy or rename your exe so you know which exe to run for a specific version of .net framework.

As you can see we’ve compiled and re-named the executable for several version of .net framework. Each one targets a different version. That way if your 2008 R2 server only has .net framework 3.5 installed you can run that version of Watson that you compile.

Now just run the exe as a regular user on the target machine. I’m running it on my Windows 2008 R2 machine and I’ve found an issue.

Next up, Powerup! Copy https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1 to a file and place to a folder where you want to run it. Here it is in action

Next up is WesNG (Windows Exploit Suggester Next Generation). I love that you can do a “systeminfo > systeminfo.txt” on another machine and take that file and analyze it on another machine. I’m running “systeminfo > systeminfo.txt” on my windows 2008 r2 server. Here is WESNG location for download ( https://github.com/bitsadmin/wesng )

Now, I’m going to install Python on my Windows 10 machine, but I’ll be looking for vulnerabilities in my 2008 R2 machine. When you install python, be sure to click the path check box! Otherwise you will have to mess with your path variables manually.

Download WESNG to a folder and extract all the bits. I copy all I need into my root WesNG folder, so I don’t have to dig down a few levels. I also copy the systeminfo.txt from my Windows2008 R2 server here as well.

First run “wes.py — update” to get the latest definitions

Now run it!

And if you are a red teamer and want to only see the ones with known exploits, run it with the “-e” flag

Next up PrivEsc

Privesc — https://github.com/enjoiz/Privesc

Download https://github.com/enjoiz/Privesc/blob/master/privesc.bat to your Windows machine.

Download Sysinternals Suite to your Windows machine from here: https://download.sysinternals.com/files/SysinternalsSuite.zip

*** IMPORTANT**( After unzipping SysinternalsSuite.zip, copy accesschk.exe, ListDLLs.exe, and pipelist.exe to your C:\Windows folder. Open a command prompt, navigate to the directory that contains privesc.bat and run it. Here is what it looks like after I clean up some of the output

A couple more tools to check but I don’t have time to do today.

Windows Enum — https://github.com/absolomb/WindowsEnum

Windows Exploit Suggester V1 — https://github.com/GDSSecurity/Windows-Exploit-Suggester

Windows Privesc Check — https://github.com/pentestmonkey/windows-privesc-check

Download windows-privesc-check2.exe to the Windows machine C:\Temp

Open a command prompt and type:

C:\Temp\windows-privesc-check2.exe — audit -a -o OutputFileName.txt

JAWS — https://github.com/411Hall/JAWS

Copy https://github.com/411Hall/JAWS/blob/master/jaws-enum.ps1 to a file and place it on your Windows C:\Temp

Open a command prompt and type:

C:\Temp\> powershell.exe -ExecutionPolicy Bypass -File jaws-enum.ps1 -OutputFilename JAWS-Enum.txt

I think that’s it for today. Feel free to follow @gw1sh1n, @fastm00 and @_markmo_ on twitter. I’ll write something for Linux when time permits.