from subprocess import Popen, PIPE import sys,argparse,re #MIT License #Copyright (c) 2020 John Page (aka hyp3rlinx) #Permission is hereby granted, free of charge, to any person obtaining a copy #of this software and associated documentation files (the "Software"), to deal #in the Software without restriction, including without limitation the rights #to use, copy, modify, merge, publish, distribute, sublicense, and/or sell #copies of the Software, and to permit persons to whom the Software is #furnished to do so, subject to the following conditions: #The above copyright notice and this permission notice shall be included in all #copies or substantial portions of the Software. #THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR #IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, #FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE #AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER #LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, #OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE #SOFTWARE. #Permission is also explicitly given for insertion in vulnerability databases and similar, #provided that due credit is given to the author John Page (aka hyp3rlinx). # # # NtFileSins v2.2 (c) # By John Page (aka hyp3rlinx) # Python v3 compatible # Enhancements: search target user dir on first pass, unless the -d flag is used, added .dat, .tmp file ext checks. # TODO: Alternate Data Streams (ADS) check e.g. abc.txt:test.txt:$DATA # Original advisory: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NTFS-PRIVILEGED-FILE-ACCESS-ENUMERATION.txt # # NtFileSins is a Windows File Enumeration Intel Gathering Tool. # Standard users can prove existence of privileged user artifacts. # # Typically, the Windows commands DIR or TYPE hand out a default "Access Denied" error message, # when a file exists or doesn't exist, when restricted access is attempted by another user. # # However, accessing files directly by attempting to "open" them from cmd.exe shell, # we can determine existence by compare inconsistent Windows error messages. # # Requirements: 1) target users with >= privileges (not admin to admin). # 2) artifacts must contain a dot "." or returns false positives. # # Windows message "Access Denied" = Exists # Windows message "The system cannot find the file" = Not exists # Windows returns "no message" OR "c:\victim\artifact is not recognized as an internal or external command, # operable program or batch file" = Admin to Admin so this script is not required. # # Profile other users by compare ntfs error messages to potentially learn their activities or machines purpose. # For evil or maybe check for basic malware IOC existence on disk with user-only rights. #From a defensive perspective we can leverage this to try to detect basic IOC and malware artifacts like .tmp, .ini, .dll, .exe #or related config files on disk with user-only rights, instead of authenticating with admin rights as a quick paranoid first pass. #Example, if malware hides itself by unlinking themselves from the EPROCESS list in memory or using programs like WinRAP to hide #processess from Windows TaskMgr, we may not discover them even if using tasklist command. The EPROCESS structure and flink/blink is #how Windows TaskMgr shows all running processes. However, we may possibly detect them by testing for the correct IOC name if the #malicious code happens to reside on disk and not only in memory. Whats cool is we can be do this without the need for admin rights. # #Other Windows commands that will also let us confirm file existence by comparing error messages are start, call, copy, icalcs, and cd. #However, Windows commands rename, ren, cacls, type, dir, erase, move or del commands will issue flat out "Access is denied" messages. # #==========================================================================# # NtFileSins.py - Windows File Enumeration Intel Gathering Tool v2.2 (c) # # By John Page (aka hyp3rlinx) # # Apparition Security # #==========================================================================# BANNER=''' _ _______________ __ _____ _ / | / /_ __/ ____(_) /__ / ___/(_)___ _____ / |/ / / / / /_ / / / _ \\__ \ / / __ \/ ___/ / /| / / / / __/ / / / __/__/ / / / / (__ ) /_/ |_/ /_/ /_/ /_/_/\___/____/_/_/ /_/____/ v2.2 (c) By hyp3rlinx ApparitionSec ''' sin_cnt=0 internet_sin_cnt=0 found_set=set() zone_set=set() ARTIFACTS_SET=set() ROOTDIR = "c:/Users/" ZONE_IDENTIFIER=":Zone.Identifier:$DATA" USER_DIRS=["Contacts","Desktop","Downloads","Favorites","My Documents","Searches","Videos/Captures", "Pictures","Music","OneDrive","OneDrive/Attachments","OneDrive/Documents"] APPDATA_DIR=["AppData/Local/Temp"] EXTS = set([".contact",".url",".lnk",".search-ms",".exe",".csv",".txt",".ini",".conf",".config",".log",".pcap",".zip",".mp4",".mp3", ".bat",".tmp", ".wav",".docx",".pptx",".reg",".vcf",".avi",".mpg",".jpg",".jpeg",".png",".rtf",".pdf",".dll",".xml",".doc",".gif",".xls",".wmv",".dat"]) REPORT="NtFileSins_Log.txt" def usage(): print("NtFileSins is a privileged file access enumeration tool to search multi-account artifacts without admin rights.\n") print('-u victim -d Searches -a "MS17-020 - Google Search.url"') print('-u victim -a "<name.ext>"') print("-u victim -d Downloads -a <name.ext> -s") print('-u victim -d Contacts -a "Mike N.contact"') print("-u victim -a APT -b -n") print("-u victim -d -z Desktop/MyFiles -a <.name>") print("-u victim -d Searches -a <name>.search-ms") print("-u victim -d . -a <name.ext>") print("-u victim -d desktop -a inverted-crosses.mp3 -b") print("-u victim -d Downloads -a APT.exe -b") print("-u victim -f list_of_files.txt") print("-u victim -f list_of_files.txt -b -s") print("-u victim -f list_of_files.txt -x .txt") print("-u victim -d desktop -f list_of_files.txt -b") print("-u victim -d desktop -f list_of_files.txt -x .rar") print("-u victim -z -s -f list_of_files.txt") def parse_args(): parser.add_argument("-u", "--user", help="Privileged user target") parser.add_argument("-d", "--directory", nargs="?", help="Specific directory to search <e.g. Downloads>.") parser.add_argument("-a", "--artifact", help="Single artifact we want to verify exists.") parser.add_argument("-t", "--appdata", nargs="?", const="1", help="Searches the AppData/Local/Temp directory.") parser.add_argument("-f", "--artifacts_from_file", nargs="?", help="Enumerate a list of supplied artifacts from a file.") parser.add_argument("-n", "--notfound", nargs="?", const="1", help="Display unfound artifacts.") parser.add_argument("-b", "--built_in_ext", nargs="?", const="1", help="Enumerate files using NtFileSin built-in ext types.") parser.add_argument("-x", "--specific_ext", nargs="?", help="Enumerate using specific ext, e.g. <.exe> using a supplied list of artifacts, a supplied ext will override any in the supplied artifact list.") parser.add_argument("-z", "--zone_identifier", nargs="?", const="1", help="Identifies artifacts downloaded from the internet by checking for Zone.Identifier:$DATA.") #parser.add_argument("-r", "--ads_streams", nargs="?", const="1", help="Locate ADS hidden file streams (artifact name required).") parser.add_argument("-s", "--save", nargs="?", const="1", help="Saves successfully enumerated artifacts, will log to "+REPORT) parser.add_argument("-v", "--verbose", nargs="?", const="1", help="Displays the file access error messages.") parser.add_argument("-e", "--examples", nargs="?", const="1", help="Show example usage.") return parser.parse_args() def access(j): result="" try: p = Popen([j], stdout=PIPE, stderr=PIPE, shell=True) stderr,stdout = p.communicate() result = stdout.strip() res = result.decode("utf-8") except Exception as e: #print(str(e)) pass return res def artifacts_from_file(artifacts_file, bflag, specific_ext): try: f=open(artifacts_file, "r") for a in f: idx = a.rfind(".") a = a.strip() if a != "": if specific_ext: if idx==-1: a = a + specific_ext else: #replace existing ext a = a[:idx] + specific_ext if bflag: ARTIFACTS_SET.add(a) else: ARTIFACTS_SET.add(a) f.close() except Exception as e: print(str(e)) exit() def save(): try: f=open(REPORT, "w") for j in found_set: f.write(j+"\n") f.close() except Exception as e: print(str(e)) def recon_msg(s): if s == 0: return "Access is denied." else: return "\t[*] Artifact exists ==>" def echo_results(args, res, x, i): global sin_cnt if res=="": print("\t[!] No NTFS message, you must already be admin, then this script is not required.") exit() if "not recognized as an internal or external command" in res: print("\t[!] You must target users with higher privileges than yours.") exit() if res != recon_msg(0): if args.verbose: print("\t"+res) else: if args.notfound: print("\t[-] not found: " + x +"/"+ i) else: sin_cnt += 1 if args.save or args.zone_identifier: found_set.add(x+"/"+i) if args.verbose: print(recon_msg(1)+ x+"/"+i) print("\t"+res) else: print(recon_msg(1)+ x+"/"+i) def valid_artifact_name(sin,args): idx = "." in sin if re.findall(r"[/\\*?:<>|]", sin): print("\t[!] Skipping: disallowed file name character.") return False if not idx and not args.built_in_ext and not args.specific_ext: print("\t[!] Warning: '"+ sin +"' has no '.' in the artifact name, this can result in false positives.") print("\t[+] Searching for '"+ sin +"' using built-in ext list to prevent false positives.") if not args.built_in_ext: if sin[-1] == ".": print("\t[!] Skipping: "+sin+" non valid file name.") return False return True def search_missing_ext(path,args,i): res="" for x in path: for e in EXTS: res = access(ROOTDIR+"/"+x+"/"+i+e) if res=="": res = access(ROOTDIR+args.user+"/"+x+"/"+i+e) if res: echo_results(args, res, x, i+e) #Check if the found artifact was downloaded from internet def zone_identifier_check(args): global ROOTDIR, internet_sin_cnt zone_set.update(found_set) for c in found_set: c = c + ZONE_IDENTIFIER res = access(ROOTDIR+args.user+"/"+c) if res == "Access is denied.": internet_sin_cnt += 1 print("\t[$] Zone Identifier found: "+c+" this file was downloaded over the internet!.") zone_set.add(c) #@TODO: Find ADS def alternate_data_dreams(): pass def ntsins(path,args,i): res="" if i.rfind(".")==-1: search_missing_ext(path,args,i) i="" for x in path: if i != "": if args.built_in_ext=="1": for e in EXTS: #Search current targets user dir first. res = access(ROOTDIR+"/"+x+"/"+i+e) if res=="": res = access(ROOTDIR+args.user+"/"+x+"/"+i+e) if res: echo_results(args, res, x, i+e) elif args.specific_ext: idx = i.rfind(".") if idx == -1: i = i + "." else: i = i[:idx] + args.specific_ext #Search current targets user dir first. res = access(ROOTDIR+"/"+x+"/"+i) if res=="": res = access(ROOTDIR+args.user+"/"+x+"/"+i) if res: echo_results(args, res, x, i) def search(args): print("\tSearching...\n") global ROOTDIR, USER_DIRS, ARTIFACTS_SET if args.artifact: ARTIFACTS_SET = set([args.artifact]) for i in ARTIFACTS_SET: idx = i.rfind(".") + 1 if idx and args.built_in_ext: i = i[:idx -1:None] if len(i) > 0 and i != None: if valid_artifact_name(i,args): #specific user dir search if args.directory: single_dir=[args.directory] ntsins(single_dir,args,i) #search appdata dirs elif args.appdata: ntsins(APPDATA_DIR,args,i) #all default user dirs else: ntsins(USER_DIRS,args,i) def check_dir_input(_dir): if len(re.findall(r":", _dir)) != 0: print("[!] Check the directory arg, NtFileSins searches under c:/Users/target by default see Help -h.") return False return True def main(args): global USER_DIRS if len(sys.argv)==1: parser.print_help(sys.stderr) sys.exit(1) if args.examples: usage() exit() if not args.user: print("[!] No target user specified see Help -h") exit() if args.appdata and args.directory: print("[!] Multiple search directories supplied see Help -h") exit() if args.specific_ext: if "." not in args.specific_ext: print("[!] Must use full extension e.g. -x ."+args.specific_ext+", dot in filenames mandatory to prevent false positives.") exit() if args.artifact and args.artifacts_from_file: print("[!] Multiple artifacts specified, use just -f or -a see Help -h") exit() if args.built_in_ext and args.specific_ext: print("\t[!] Both specific and built-in extensions supplied, use only one.") exit() if args.specific_ext and not args.artifacts_from_file: print("\t[!] -x to be used with -f flag only see Help -h.") exit() if args.artifact: if args.artifact.rfind(".")==-1 and not args.built_in_ext: print("\t[!] Artifacts must contain a .ext or will result in false positives, use -b flag (built-in ext checks).") exit() if args.directory: if not check_dir_input(args.directory): exit() if args.artifacts_from_file: artifacts_from_file(args.artifacts_from_file, args.built_in_ext, args.specific_ext) #TODO: #if args.ads_streams: #alternate_data_dreams() if not args.artifact and not args.artifacts_from_file: print("[!] Exiting, no artifacts supplied see Help -h") exit() else: #Search targets user dir by default, instead of require -d flag to specify the dir. USER_DIRS.append(args.user) search(args) if sin_cnt >= 1 and args.zone_identifier: zone_identifier_check(args) if args.save and len(found_set) != 0 and not args.zone_identifier: save() if args.save and len(zone_set) != 0: found_set.update(zone_set) save() print("\n\tNtFileSins Detected "+str(sin_cnt)+ " out of %s" % str(len(ARTIFACTS_SET)) + " Sins.\n") if args.zone_identifier and internet_sin_cnt >= 1: print("\t"+str(internet_sin_cnt) + " of the sins were internet downloaded.\n") if not args.notfound: print("\tuse -n to display unfound enumerated files.") if not args.built_in_ext: print("\tfor extra search coverage try -b flag or targeted artifact search -a.") if __name__ == "__main__": print(BANNER) parser = argparse.ArgumentParser() main(parse_args())