Local Exploits

We can look for what patches on windows are installed. If a host is poorly patched, you can get a easy priv esc without having to search for poor configurations in the system. The following lists all patches:

wmic qfe get Caption,Description,HotFixID,InstalledOn


http://support.microsoft.com/?kbid=2654428     Security Update  KB2654428  
12/24/2014   
http://support.microsoft.com/?kbid=2655992     Security Update  KB2655992  
12/24/2014   
http://support.microsoft.com/?kbid=2656356     Security Update  KB2656356  
12/24/2014   
http://support.microsoft.com/?kbid=2667402     Security Update  KB2667402  
12/24/2014   
http://support.microsoft.com/?kbid=2676562     Security Update  KB2676562  
12/24/2014   
http://support.microsoft.com/?kbid=2685939     Security Update  KB2685939  
12/24/2014
...

Windows Exploit Suggester compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also tells you if there are public exploits or metasploit modules on said exploit.

$ git clone https://github.com/GDSSecurity/Windows-Exploit-Suggester.git
$ ./windows-exploit-suggester.py --update

Before it can determine of the system is missing any patches, we need to dump some data from the system. This command can be used

systeminfo > comp_host1.txt

We can then transfer this to our machine and run the script:

./windows-exploit-suggester.py --database database.xls --systeminfo comp_host1.txt

An [E] stands for an exploit has been found in the Off Sec exploit db, and an [M] stands for the exploit in the metasploit framework:

[M] MS15-100: Vulnerability in Windows Media Center Could Allow Remote 
Code Execution (3087918) - Important
[E] MS14-026: Vulnerability in .NET Framework Could Allow Elevation of 
Privilege (2958732) - Important