Convert Figma logo to code with AI

bitsadmin logowesng

Windows Exploit Suggester - Next Generation

4,249
573
4,249
9
View on GitHub

Quick Overview

WES-NG (Windows Exploit Suggester - Next Generation) is a Python script that analyzes the output of the Microsoft Windows "systeminfo" command and provides a list of vulnerabilities that the target system may be susceptible to, along with details on each vulnerability.

Pros

  • Provides a comprehensive list of known vulnerabilities for the target system, making it easier to identify and address potential security issues.
  • Supports a wide range of Windows operating systems, from Windows XP to the latest versions.
  • Regularly updated with the latest vulnerability information, ensuring the tool remains relevant and effective.
  • Offers detailed information on each vulnerability, including CVE IDs, CVSS scores, and links to relevant Microsoft security bulletins.

Cons

  • Requires the "systeminfo" command to be executed on the target system, which may not be possible in all scenarios.
  • Relies on external data sources (e.g., Microsoft security bulletins) for vulnerability information, which could potentially be outdated or incomplete.
  • May not identify all vulnerabilities on the target system, as it is limited to the information provided by the "systeminfo" command.
  • Requires Python to be installed on the system running the script, which may not be the case in all environments.

Getting Started

To use WES-NG, follow these steps:

  1. Clone the GitHub repository:
git clone https://github.com/bitsadmin/wesng.git
  1. Navigate to the cloned directory:
cd wesng
  1. Run the script, providing the output of the "systeminfo" command as input:
python wes.py "C:\Users\username\Desktop\systeminfo.txt"

Replace "C:\Users\username\Desktop\systeminfo.txt" with the path to the file containing the "systeminfo" output.

  1. The script will analyze the input and display a list of vulnerabilities, along with detailed information for each one.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Windows Exploit Suggester - Next Generation (WES-NG)

WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, including their Windows Server counterparts, is supported.

At the BITSADMIN blog an in-depth article on WES-NG is available: Windows Security Updates for Hackers.

Usage

  1. Download WES-NG using pip install wesng or using the following commandline: git clone https://github.com/bitsadmin/wesng --depth 1
  2. Obtain the latest database of vulnerabilities by executing the command wes.py --update
  3. There are two options to check for missing patches: a. Launch missingkbs.vbs or missingkbs.ps1 on the host to have Windows determine which patches are missing b. Use Windows' built-in systeminfo.exe tool to obtain the system information of the local system, or from a remote system using systeminfo /S MyRemoteHost, and redirect this to a file: systeminfo > systeminfo.txt
  4. Depending on the method chosen in step 3 execute WES-NG: a. With the missing.txt file as input: wes.py --missing missing.txt (or wes.py -m missing.txt) b. With the systeminfo.txt file as the parameter: wes.py systeminfo.txt WES-NG then uses the database to determine which patches are applicable to the system and to which vulnerabilities are currently exposed, including exploits if available.
  5. As the data provided by Microsoft's MSRC feed is frequently incomplete and false positives are reported by wes.py, @DominicBreuker contributed the --muc-lookup parameter to validate identified missing patches from the systeminfo.txt file against Microsoft's Update Catalog. Additionally, make sure to check the Eliminating false positives page at the Wiki on how to interpret the results. For an overview of all available parameters for missingkbs.vbs, missingkbs.ps1 and wes.py, check CMDLINE.md.

Demo

Gif animation showing usage of Windows Exploit Suggester - Next Generation

Collector

This GitHub repository regularly updates the database of vulnerabilities, so running wes.py with the --update parameter gets the latest version. If manual generation of the .csv file with hotfix information is required, use the scripts from the /collector folder to compile the database. Read the comments at the top of each script and execute them in the order as they are listed below. Executing these scripts will produce definitions.zip. The WES-NG collector pulls information from various sources:

  • Microsoft Security Bulletin Data: KBs for older systems [1]
  • MSRC: The Microsoft Security Update API of the Microsoft Security Response Center (MSRC): Standard source of information for modern Microsoft Updates [2]
  • NIST National Vulnerability Database (NVD): Complement vulnerabilities with Exploit-DB links [3] These are combined into a single .csv file which is compressed and hosted in this GitHub repository.

Rationale

I developed WES-NG because while GDSSecurity's Windows-Exploit-Suggester worked excellently for operating systems in the Windows XP and Windows Vista era, GDSSecurity's Windows-Exploit-Suggester does not work for operating systems like Windows 11 and vulnerabilities published in recent years. This is because Microsoft replaced the Microsoft Security Bulletin Data Excel file [1] on which GDSSecurity's Windows-Exploit-Suggester is fully dependent, by the MSRC API [2]. The Microsoft Security Bulletin Data Excel file has not been updated since Q1 2017, so later operating systems and vulnerabilities cannot be detected. Thanks @gdssecurity, for this great tool which has served many of us for so many years!

Bugs

Changelog

See CHANGELOG.md

Improvements

  • Add support for NoPowerShell's Get-SystemInfo cmdlet output
  • Add support for alternative output formats of systeminfo (csv, table)
  • More testing on the returned false positive vulnerabilities - see also the wiki

References

[1] https://www.microsoft.com/download/details.aspx?id=36982

[2] https://portal.msrc.microsoft.com/en-us/developer

[3] https://nvd.nist.gov/vuln/data-feeds

Authored by Arris Huijgen (@bitsadmin - https://github.com/bitsadmin/)