Merge pull request #545 from peass-ng/update_PEASS-linpeas-ECS_on_EC2__Covering_Gaps_in_IMDS_Ha_20251229_015718

[LINPEAS] Add privilege escalation check: ECS on EC2 Covering Gaps in IMDS Hardeni...

linPEAS/builder/linpeas_parts/3_cloud/3_AWS_ECS.sh

@@ -1,14 +1,14 @@
 # Title: Cloud - AWS ECS
 # ID: CL_AWS_ECS
 # Author: Carlos Polop
-# Last Update: 22-08-2023
+# Last Update: 17-01-2026
 # Description: AWS ECS Enumeration
 # License: GNU GPL
 # Version: 1.0
 # Functions Used: check_aws_ecs, exec_with_jq, print_2title, print_3title
 # Global Variables: $aws_ecs_metadata_uri, $aws_ecs_service_account_uri, $is_aws_ecs
 # Initial Functions: check_aws_ecs
-# Generated Global Variables: $aws_ecs_req
+# Generated Global Variables: $aws_ecs_req, $aws_exec_env, $ecs_task_metadata, $launch_type, $network_modes, $imds_tool, $imds_token, $imds_roles, $imds_http_code, $ecs_block_line, $ecs_host_line, $iptables_cmd, $docker_rules, $first_role
 # Fat linpeas: 0
 # Small linpeas: 1
 
@@ -44,5 +44,146 @@ if [ "$is_aws_ecs" = "Yes" ]; then
     else
         echo "I couldn't find AWS_CONTAINER_CREDENTIALS_RELATIVE_URI env var to get IAM role info (the task is running without a task role probably)"
     fi
+
+    print_3title "ECS task metadata hints"
+    aws_exec_env=$(printenv AWS_EXECUTION_ENV 2>/dev/null)
+    if [ "$aws_exec_env" ]; then
+        printf "AWS_EXECUTION_ENV=%s\n" "$aws_exec_env"
+    fi
+
+    ecs_task_metadata=""
+    if [ "$aws_ecs_metadata_uri" ]; then
+        ecs_task_metadata=$(eval $aws_ecs_req "$aws_ecs_metadata_uri/task" 2>/dev/null)
+    fi
+
+    if [ "$ecs_task_metadata" ]; then
+        launch_type=$(printf "%s" "$ecs_task_metadata" | grep -oE '"LaunchType":"[^"]+"' | head -n 1 | cut -d '"' -f4)
+        if [ "$launch_type" ]; then
+            printf "ECS LaunchType reported: %s\n" "$launch_type"
+        fi
+        network_modes=$(printf "%s" "$ecs_task_metadata" | grep -oE '"NetworkMode":"[^"]+"' | cut -d '"' -f4 | sort -u | tr '\n' ' ')
+        if [ "$network_modes" ]; then
+            printf "Reported NetworkMode(s): %s\n" "$network_modes"
+        fi
+    else
+        echo "Unable to fetch task metadata (check ECS_CONTAINER_METADATA_URI)."
+    fi
     echo ""
-fi
+
+    print_3title "IMDS reachability from this task"
+    imds_token=""
+    imds_roles=""
+    imds_http_code=""
+    imds_tool=""
+
+    if command -v curl >/dev/null 2>&1; then
+        imds_tool="curl"
+    elif command -v wget >/dev/null 2>&1; then
+        imds_tool="wget"
+    fi
+
+    if [ "$imds_tool" = "curl" ]; then
+        imds_token=$(curl -s --connect-timeout 2 --max-time 2 -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null)
+        if [ "$imds_token" ]; then
+            printf "[!] IMDSv2 token request succeeded (metadata reachable from this task).\n"
+            imds_roles=$(curl -s --connect-timeout 2 --max-time 2 -H "X-aws-ec2-metadata-token: $imds_token" "http://169.254.169.254/latest/meta-data/iam/security-credentials/" 2>/dev/null | tr '\n' ' ')
+            if [ "$imds_roles" ]; then
+                printf "    Instance profile role(s) exposed via IMDS: %s\n" "$imds_roles"
+                first_role=$(printf "%s" "$imds_roles" | awk '{print $1}')
+                if [ "$first_role" ]; then
+                    printf "    Example: curl -H 'X-aws-ec2-metadata-token: <TOKEN>' http://169.254.169.254/latest/meta-data/iam/security-credentials/%s\n" "$first_role"
+                fi
+            else
+                printf "    No IAM role names returned (instance profile might be missing).\n"
+            fi
+        else
+            imds_http_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 --max-time 2 "http://169.254.169.254/latest/meta-data/" 2>/dev/null)
+            case "$imds_http_code" in
+                000|"")
+                    printf "[i] IMDS endpoint did not respond (likely blocked via hop-limit or host firewalling).\n"
+                    ;;
+                401)
+                    printf "[i] IMDS requires v2 tokens but token requests are being blocked (bridge-mode tasks rely on this when hop limit = 1).\n"
+                    ;;
+                *)
+                    printf "[i] IMDS GET returned HTTP %s (investigate host configuration).\n" "$imds_http_code"
+                    ;;
+            esac
+        fi
+    elif [ "$imds_tool" = "wget" ]; then
+        imds_token=$(wget -q -O - --timeout=2 --tries=1 --method=PUT --header="X-aws-ec2-metadata-token-ttl-seconds: 21600" "http://169.254.169.254/latest/api/token" 2>/dev/null)
+        if [ "$imds_token" ]; then
+            printf "[!] IMDSv2 token request succeeded (metadata reachable from this task).\n"
+            imds_roles=$(wget -q -O - --timeout=2 --tries=1 --header="X-aws-ec2-metadata-token: $imds_token" "http://169.254.169.254/latest/meta-data/iam/security-credentials/" 2>/dev/null | tr '\n' ' ')
+            if [ "$imds_roles" ]; then
+                printf "    Instance profile role(s) exposed via IMDS: %s\n" "$imds_roles"
+            else
+                printf "    No IAM role names returned (instance profile might be missing).\n"
+            fi
+        else
+            wget --server-response -O /dev/null --timeout=2 --tries=1 "http://169.254.169.254/latest/meta-data/" 2>&1 | awk 'BEGIN{code=""} /^  HTTP/{code=$2} END{ if(code!="") { printf("[i] IMDS GET returned HTTP %s (token could not be retrieved).\n", code); } else { print "[i] IMDS endpoint did not respond (likely blocked)."; } }'
+        fi
+    else
+        echo "Neither curl nor wget were found, I can't test IMDS reachability."
+    fi
+    echo ""
+
+    print_3title "ECS agent IMDS settings"
+    if [ -r "/etc/ecs/ecs.config" ]; then
+        ecs_block_line=$(grep -E "^ECS_AWSVPC_BLOCK_IMDS=" /etc/ecs/ecs.config 2>/dev/null | tail -n 1)
+        ecs_host_line=$(grep -E "^ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST=" /etc/ecs/ecs.config 2>/dev/null | tail -n 1)
+        if [ "$ecs_block_line" ]; then
+            printf "%s\n" "$ecs_block_line"
+            if echo "$ecs_block_line" | grep -qi "=true"; then
+                echo "    -> awsvpc-mode tasks should be blocked from IMDS by the ECS agent."
+            else
+                echo "    -> awsvpc-mode tasks can still reach IMDS (set this to true to block)."
+            fi
+        else
+            echo "ECS_AWSVPC_BLOCK_IMDS not set (awsvpc tasks inherit host IMDS reachability)."
+        fi
+
+        if [ "$ecs_host_line" ]; then
+            printf "%s\n" "$ecs_host_line"
+            if echo "$ecs_host_line" | grep -qi "=false"; then
+                echo "    -> Host-network tasks lose IAM task roles but IMDS is blocked."
+            else
+                echo "    -> Host-network tasks keep IAM task roles and retain IMDS access."
+            fi
+        else
+            echo "ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST not set (defaults keep IMDS reachable for host-mode tasks)."
+        fi
+    else
+        echo "Cannot read /etc/ecs/ecs.config (file missing or permissions denied)."
+    fi
+    echo ""
+
+    print_3title "DOCKER-USER IMDS filtering"
+    iptables_cmd=""
+    if command -v iptables >/dev/null 2>&1; then
+        iptables_cmd=$(command -v iptables)
+    elif command -v iptables-nft >/dev/null 2>&1; then
+        iptables_cmd=$(command -v iptables-nft)
+    fi
+
+    if [ "$iptables_cmd" ]; then
+        docker_rules=$($iptables_cmd -S DOCKER-USER 2>/dev/null)
+        if [ $? -eq 0 ]; then
+            if [ "$docker_rules" ]; then
+                echo "$docker_rules"
+            else
+                echo "(DOCKER-USER chain exists but no rules were found)"
+            fi
+            if echo "$docker_rules" | grep -q "169\\.254\\.169\\.254"; then
+                echo "    -> IMDS traffic is explicitly filtered before Docker NAT."
+            else
+                echo "    -> No DOCKER-USER rule drops 169.254.169.254 traffic (bridge tasks rely on hop limit or host firewalling)."
+            fi
+        else
+            echo "Unable to read DOCKER-USER chain (missing chain or insufficient permissions)."
+        fi
+    else
+        echo "iptables binary not found; cannot inspect DOCKER-USER chain."
+    fi
+    echo ""
+fi

winPEAS/winPEASexe/README.md

@@ -74,19 +74,15 @@ winpeas.exe -lolbas  #Execute also additional LOLBAS search check
 
 The goal of this project is to search for possible **Privilege Escalation Paths** in Windows environments.
 
+New in this version:
+- Detect potential GPO abuse by flagging writable SYSVOL paths for GPOs applied to the current host and by highlighting membership in the "Group Policy Creator Owners" group.
+
+- Flag installed OEM utilities such as ASUS DriverHub, MSI Center, Acer Control Centre and Razer Synapse 4, highlighting writable updater folders and world-accessible pipes tied to recent CVEs.
+
 It should take only a **few seconds** to execute almost all the checks and **some seconds/minutes during the lasts checks searching for known filenames** that could contain passwords (the time depened on the number of files in your home folder). By default only **some** filenames that could contain credentials are searched, you can use the **searchall** parameter to search all the list (this could will add some minutes).
 
 The tool is based on **[SeatBelt](https://github.com/GhostPack/Seatbelt)**.
 
-### New (AD-aware) checks
-
-- Active Directory quick checks now include:
-  - gMSA readable managed passwords: enumerate msDS-GroupManagedServiceAccount objects and report those where the current user/group is allowed to retrieve the managed password (PrincipalsAllowedToRetrieveManagedPassword).
-  - AD object control surfaces: parse ACLs for high-value objects plus a sampled set of users/groups/computers and flag when the current security principal already has GenericAll/GenericWrite/WriteDacl/WriteOwner or attribute-specific rights (SPN, UAC, msDS-AllowedToActOnBehalfOfOtherIdentity, sidHistory, member, unicodePwd, replication) that can be abused for password resets, Kerberoasting, delegation/RBCD, DCSync, or stealth persistence.
-  - AD CS (ESC4) hygiene: enumerate published certificate templates and highlight templates where the current user/group has dangerous control rights (GenericAll/WriteDacl/WriteOwner/WriteProperty/ExtendedRight) that could allow template abuse (e.g., ESC4 -> ESC1).
-
-These checks are lightweight, read-only, and only run when the host is domain-joined.
-
 
 ## Where are my COLORS?!?!?!
 

winPEAS/winPEASexe/winPEAS/Checks/ActiveDirectoryInfo.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.DirectoryServices;
+using System.Reflection;
 using System.Linq;
 using System.Security.AccessControl;
 using System.Security.Principal;
@@ -20,6 +21,7 @@ namespace winPEAS.Checks
             new List<Action>
             {
                 PrintGmsaReadableByCurrentPrincipal,
+                PrintKerberoastableServiceAccounts,
                 PrintAdObjectControlPaths,
                 PrintAdcsMisconfigurations
             }.ForEach(action => CheckRunner.Run(action, isDebug));
@@ -751,6 +753,37 @@ namespace winPEAS.Checks
             }
         }
 
+        private void PrintKerberoastableServiceAccounts()
+        {
+            try
+            {
+                Beaprint.MainPrint("Kerberoasting / service ticket risks");
+                Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/kerberoast.html",
+                    "Enumerate weak SPN accounts and legacy Kerberos crypto");
+
+                if (!Checks.IsPartOfDomain)
+                {
+                    Beaprint.GrayPrint("  [-] Host is not domain-joined. Skipping.");
+                    return;
+                }
+
+                var defaultNC = GetRootDseProp("defaultNamingContext");
+                if (string.IsNullOrEmpty(defaultNC))
+                {
+                    Beaprint.GrayPrint("  [-] Could not resolve defaultNamingContext.");
+                    return;
+                }
+
+                PrintDomainKerberosDefaults(defaultNC);
+                EnumerateKerberoastCandidates(defaultNC);
+            }
+            catch (Exception ex)
+            {
+                Beaprint.GrayPrint("  [-] Kerberoasting check failed: " + ex.Message);
+            }
+        }
+
+
         // Detect AD CS misconfigurations
         private void PrintAdcsMisconfigurations()
         {
@@ -939,5 +972,420 @@ namespace winPEAS.Checks
                 Beaprint.PrintException(ex.Message);
             }
         }
+        private void PrintDomainKerberosDefaults(string defaultNc)
+        {
+            try
+            {
+                using (var domainEntry = new DirectoryEntry("LDAP://" + defaultNc))
+                {
+                    var encValue = GetDirectoryEntryInt(domainEntry, "msDS-DefaultSupportedEncryptionTypes");
+                    if (encValue.HasValue)
+                    {
+                        var desc = DescribeEncTypes(encValue);
+                        if (IsRc4Allowed(encValue))
+                            Beaprint.BadPrint($"  Domain default supported encryption types: {desc} — RC4/NT hash tickets allowed.");
+                        else
+                            Beaprint.GoodPrint($"  Domain default supported encryption types: {desc} — RC4 disabled.");
+                    }
+                    else
+                    {
+                        Beaprint.GrayPrint("  [-] Domain default supported encryption types not set (legacy compatibility defaults to RC4).");
+                    }
+                }
+
+                using (var baseDe = new DirectoryEntry("LDAP://" + defaultNc))
+                using (var ds = new DirectorySearcher(baseDe))
+                {
+                    ds.Filter = "(&(objectClass=user)(sAMAccountName=krbtgt))";
+                    ds.PropertiesToLoad.Add("msDS-SupportedEncryptionTypes");
+                    var result = ds.FindOne();
+                    if (result != null)
+                    {
+                        var encValue = GetIntProp(result, "msDS-SupportedEncryptionTypes");
+                        if (encValue.HasValue)
+                        {
+                            var desc = DescribeEncTypes(encValue);
+                            if (IsRc4Allowed(encValue))
+                                Beaprint.BadPrint($"  krbtgt supports: {desc} — RC4 TGTs can still be issued.");
+                            else
+                                Beaprint.GoodPrint($"  krbtgt supports: {desc}.");
+                        }
+                        else
+                        {
+                            Beaprint.GrayPrint("  [-] krbtgt enc types inherit domain defaults (unspecified).");
+                        }
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.GrayPrint("  [-] Unable to query Kerberos defaults: " + ex.Message);
+            }
+        }
+
+        private void EnumerateKerberoastCandidates(string defaultNc)
+        {
+            int checkedAccounts = 0;
+            int highTotal = 0;
+            int mediumTotal = 0;
+            var high = new List<KerberoastCandidate>();
+            var medium = new List<KerberoastCandidate>();
+
+            try
+            {
+                using (var baseDe = new DirectoryEntry("LDAP://" + defaultNc))
+                using (var ds = new DirectorySearcher(baseDe))
+                {
+                    ds.PageSize = 500;
+                    ds.Filter = "(servicePrincipalName=*)";
+                    ds.PropertiesToLoad.Add("sAMAccountName");
+                    ds.PropertiesToLoad.Add("displayName");
+                    ds.PropertiesToLoad.Add("distinguishedName");
+                    ds.PropertiesToLoad.Add("servicePrincipalName");
+                    ds.PropertiesToLoad.Add("msDS-SupportedEncryptionTypes");
+                    ds.PropertiesToLoad.Add("userAccountControl");
+                    ds.PropertiesToLoad.Add("pwdLastSet");
+                    ds.PropertiesToLoad.Add("memberOf");
+                    ds.PropertiesToLoad.Add("objectClass");
+
+                    foreach (SearchResult r in ds.FindAll())
+                    {
+                        checkedAccounts++;
+                        var candidate = BuildKerberoastCandidate(r);
+                        if (candidate == null)
+                        {
+                            continue;
+                        }
+
+                        if (candidate.IsHighRisk)
+                        {
+                            highTotal++;
+                            if (high.Count < 15) high.Add(candidate);
+                        }
+                        else
+                        {
+                            mediumTotal++;
+                            if (medium.Count < 12) medium.Add(candidate);
+                        }
+                    }
+                }
+
+                Beaprint.InfoPrint($"Checked {checkedAccounts} SPN-bearing accounts. High-risk RC4/privileged targets: {highTotal}, long-lived AES-only targets: {mediumTotal}.");
+
+                if (highTotal == 0 && mediumTotal == 0)
+                {
+                    Beaprint.GoodPrint("  No obvious Kerberoastable service accounts detected with current visibility.");
+                    return;
+                }
+
+                if (high.Count > 0)
+                {
+                    Beaprint.BadPrint("  [!] RC4-enabled or privileged SPN accounts:");
+                    foreach (var c in high)
+                    {
+                        Beaprint.ColorPrint($"      - {c.Label} | SPNs: {c.SpnSummary} | Enc: {c.Encryption} | {c.Reason}", Beaprint.LRED);
+                    }
+                    if (highTotal > high.Count)
+                    {
+                        Beaprint.GrayPrint($"      ... {highTotal - high.Count} additional high-risk accounts omitted.");
+                    }
+                }
+
+                if (medium.Count > 0)
+                {
+                    Beaprint.ColorPrint("  [~] Long-lived SPN accounts (still Kerberoastable via AES tickets):", Beaprint.YELLOW);
+                    foreach (var c in medium)
+                    {
+                        Beaprint.ColorPrint($"      - {c.Label} | SPNs: {c.SpnSummary} | Enc: {c.Encryption} | {c.Reason}", Beaprint.YELLOW);
+                    }
+                    if (mediumTotal > medium.Count)
+                    {
+                        Beaprint.GrayPrint($"      ... {mediumTotal - medium.Count} additional medium-risk accounts omitted.");
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.GrayPrint("  [-] LDAP error while enumerating SPNs: " + ex.Message);
+            }
+        }
+
+        private KerberoastCandidate BuildKerberoastCandidate(SearchResult r)
+        {
+            var sam = GetProp(r, "sAMAccountName");
+            var displayName = GetProp(r, "displayName");
+            var dn = GetProp(r, "distinguishedName");
+
+            if (IsComputerObject(r) || IsManagedServiceAccount(r))
+                return null;
+
+            var uac = GetIntProp(r, "userAccountControl");
+            if (uac.HasValue && (uac.Value & 0x2) != 0)
+                return null;
+
+            var encValue = GetIntProp(r, "msDS-SupportedEncryptionTypes");
+            bool rc4Allowed = IsRc4Allowed(encValue);
+            bool aesPresent = HasAes(encValue);
+            bool passwordNeverExpires = uac.HasValue && (uac.Value & 0x10000) != 0;
+            DateTime? pwdLastSet = GetFileTimeProp(r, "pwdLastSet");
+            bool stalePassword = pwdLastSet.HasValue && pwdLastSet.Value < DateTime.UtcNow.AddDays(-365);
+            var privilegeHits = GetPrivilegedGroups(r);
+            var reasons = new List<string>();
+
+            if (rc4Allowed)
+                reasons.Add("RC4 allowed");
+            else if (!aesPresent)
+                reasons.Add("No AES flag");
+            if (passwordNeverExpires)
+                reasons.Add("PasswordNeverExpires");
+            if (stalePassword)
+                reasons.Add("PwdLastSet " + pwdLastSet.Value.ToString("yyyy-MM-dd"));
+            if (privilegeHits.Count > 0)
+                reasons.Add("Privileged: " + string.Join("/", privilegeHits));
+
+            if (reasons.Count == 0)
+                return null;
+
+            bool isHigh = rc4Allowed || privilegeHits.Count > 0;
+            if (!isHigh && !(passwordNeverExpires || stalePassword))
+                return null;
+
+            var label = !string.IsNullOrEmpty(sam) ? sam : dn;
+            if (!string.IsNullOrEmpty(displayName) && !string.Equals(displayName, sam, StringComparison.OrdinalIgnoreCase))
+            {
+                label = string.IsNullOrEmpty(sam) ? displayName : $"{sam} ({displayName})";
+            }
+
+            return new KerberoastCandidate
+            {
+                Label = label ?? "<unknown>",
+                SpnSummary = BuildSpnSummary(r),
+                Encryption = DescribeEncTypes(encValue),
+                Reason = string.Join("; ", reasons),
+                IsHighRisk = isHigh
+            };
+        }
+
+        private static string BuildSpnSummary(SearchResult r)
+        {
+            if (!r.Properties.Contains("servicePrincipalName") || r.Properties["servicePrincipalName"].Count == 0)
+                return "<none>";
+
+            var values = r.Properties["servicePrincipalName"];
+            var list = new List<string>();
+            int limit = values.Count < 3 ? values.Count : 3;
+            for (int i = 0; i < limit; i++)
+            {
+                var spn = values[i]?.ToString();
+                if (!string.IsNullOrEmpty(spn))
+                    list.Add(spn);
+            }
+
+            string summary = list.Count > 0 ? string.Join(", ", list) : "<none>";
+            if (values.Count > limit)
+                summary += $" (+{values.Count - limit} more)";
+            return summary;
+        }
+
+        private static List<string> GetPrivilegedGroups(SearchResult r)
+        {
+            var hits = new List<string>();
+            if (!r.Properties.Contains("memberOf"))
+                return hits;
+
+            var memberships = r.Properties["memberOf"];
+            foreach (var membership in memberships)
+            {
+                var cn = ExtractCn(membership?.ToString());
+                if (string.IsNullOrEmpty(cn))
+                    continue;
+
+                foreach (var keyword in PrivilegedGroupKeywords)
+                {
+                    if (cn.IndexOf(keyword, StringComparison.OrdinalIgnoreCase) >= 0)
+                    {
+                        if (!hits.Contains(cn))
+                            hits.Add(cn);
+                        break;
+                    }
+                }
+            }
+            return hits;
+        }
+
+        private static string ExtractCn(string dn)
+        {
+            if (string.IsNullOrEmpty(dn))
+                return null;
+
+            var parts = dn.Split(',');
+            foreach (var part in parts)
+            {
+                var trimmed = part.Trim();
+                if (trimmed.StartsWith("CN=", StringComparison.OrdinalIgnoreCase))
+                    return trimmed.Substring(3);
+            }
+            return dn;
+        }
+
+        private static bool IsComputerObject(SearchResult r)
+        {
+            return HasObjectClass(r, "computer");
+        }
+
+        private static bool IsManagedServiceAccount(SearchResult r)
+        {
+            return HasObjectClass(r, "msDS-ManagedServiceAccount") || HasObjectClass(r, "msDS-GroupManagedServiceAccount");
+        }
+
+        private static bool HasObjectClass(SearchResult r, string className)
+        {
+            if (!r.Properties.Contains("objectClass"))
+                return false;
+
+            foreach (var val in r.Properties["objectClass"])
+            {
+                if (string.Equals(val?.ToString(), className, StringComparison.OrdinalIgnoreCase))
+                    return true;
+            }
+            return false;
+        }
+
+        private static DateTime? GetFileTimeProp(SearchResult r, string propName)
+        {
+            if (!r.Properties.Contains(propName) || r.Properties[propName].Count == 0)
+                return null;
+            return ConvertFileTime(r.Properties[propName][0]);
+        }
+
+        private static DateTime? ConvertFileTime(object value)
+        {
+            if (value == null)
+                return null;
+            try
+            {
+                if (value is long longVal)
+                {
+                    if (longVal <= 0) return null;
+                    return DateTime.FromFileTimeUtc(longVal);
+                }
+
+                if (value is IConvertible convertible)
+                {
+                    long converted = convertible.ToInt64(null);
+                    if (converted > 0)
+                        return DateTime.FromFileTimeUtc(converted);
+                }
+
+                var type = value.GetType();
+                var highProp = type.GetProperty("HighPart", BindingFlags.Public | BindingFlags.Instance);
+                var lowProp = type.GetProperty("LowPart", BindingFlags.Public | BindingFlags.Instance);
+                if (highProp != null && lowProp != null)
+                {
+                    int high = Convert.ToInt32(highProp.GetValue(value, null));
+                    int low = Convert.ToInt32(lowProp.GetValue(value, null));
+                    long fileTime = ((long)high << 32) | (uint)low;
+                    if (fileTime > 0)
+                        return DateTime.FromFileTimeUtc(fileTime);
+                }
+            }
+            catch
+            {
+                return null;
+            }
+            return null;
+        }
+
+        private static int? GetIntProp(SearchResult r, string name)
+        {
+            if (!r.Properties.Contains(name) || r.Properties[name].Count == 0)
+                return null;
+            return ConvertToNullableInt(r.Properties[name][0]);
+        }
+
+        private static int? GetDirectoryEntryInt(DirectoryEntry entry, string name)
+        {
+            try
+            {
+                return ConvertToNullableInt(entry.Properties[name]?.Value);
+            }
+            catch
+            {
+                return null;
+            }
+        }
+
+        private static int? ConvertToNullableInt(object value)
+        {
+            if (value == null)
+                return null;
+            if (value is int intValue)
+                return intValue;
+            if (value is long longValue)
+                return unchecked((int)longValue);
+            if (int.TryParse(value.ToString(), out var parsed))
+                return parsed;
+            return null;
+        }
+
+        private static bool IsRc4Allowed(int? encValue)
+        {
+            if (!encValue.HasValue || encValue.Value == 0)
+                return true;
+            return (encValue.Value & EncFlagRc4) != 0;
+        }
+
+        private static bool HasAes(int? encValue)
+        {
+            if (!encValue.HasValue)
+                return false;
+            return (encValue.Value & (EncFlagAes128 | EncFlagAes256)) != 0;
+        }
+
+        private static string DescribeEncTypes(int? encValue)
+        {
+            if (!encValue.HasValue || encValue.Value == 0)
+                return "Unspecified (inherits defaults / RC4 compatible)";
+
+            var parts = new List<string>();
+            if ((encValue.Value & EncFlagDesCrc) != 0) parts.Add("DES-CBC-CRC");
+            if ((encValue.Value & EncFlagDesMd5) != 0) parts.Add("DES-CBC-MD5");
+            if ((encValue.Value & EncFlagRc4) != 0) parts.Add("RC4-HMAC");
+            if ((encValue.Value & EncFlagAes128) != 0) parts.Add("AES128");
+            if ((encValue.Value & EncFlagAes256) != 0) parts.Add("AES256");
+            if ((encValue.Value & 0x20) != 0) parts.Add("FAST");
+            if (parts.Count == 0) parts.Add($"0x{encValue.Value:X}");
+            return string.Join(", ", parts);
+        }
+
+        private class KerberoastCandidate
+        {
+            public string Label { get; set; }
+            public string SpnSummary { get; set; }
+            public string Encryption { get; set; }
+            public string Reason { get; set; }
+            public bool IsHighRisk { get; set; }
+        }
+
+        private static readonly string[] PrivilegedGroupKeywords = new[]
+        {
+            "Domain Admin",
+            "Enterprise Admin",
+            "Administrators",
+            "Exchange",
+            "Schema Admin",
+            "Account Operator",
+            "Server Operator",
+            "Backup Operator",
+            "DnsAdmin"
+        };
+
+        private const int EncFlagDesCrc = 0x1;
+        private const int EncFlagDesMd5 = 0x2;
+        private const int EncFlagRc4 = 0x4;
+        private const int EncFlagAes128 = 0x8;
+        private const int EncFlagAes256 = 0x10;
+
+
     }
 }

winPEAS/winPEASexe/winPEAS/Checks/Checks.cs

@@ -94,6 +94,7 @@ namespace winPEAS.Checks
                 new SystemCheck("activedirectoryinfo", new ActiveDirectoryInfo()),
                 new SystemCheck("cloudinfo", new CloudInfo()),
                 new SystemCheck("windowscreds", new WindowsCreds()),
+                new SystemCheck("registryinfo", new RegistryInfo()),
                 new SystemCheck("browserinfo", new BrowserInfo()),
                 new SystemCheck("filesinfo", new FilesInfo()),
                 new SystemCheck("fileanalysis", new FileAnalysis()),

winPEAS/winPEASexe/winPEAS/Checks/RegistryInfo.cs

@@ -0,0 +1,141 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using winPEAS.Helpers;
+using winPEAS.Helpers.Registry;
+
+namespace winPEAS.Checks
+{
+    internal class RegistryInfo : ISystemCheck
+    {
+        private const string TypingInsightsRelativePath = @"Software\Microsoft\Input\TypingInsights";
+
+        private static readonly string[] KnownWritableSystemKeyCandidates = new[]
+        {
+            @"SOFTWARE\Microsoft\CoreShell",
+            @"SOFTWARE\Microsoft\DRM",
+            @"SOFTWARE\Microsoft\Input\Locales",
+            @"SOFTWARE\Microsoft\Input\Settings",
+            @"SOFTWARE\Microsoft\Shell\Oobe",
+            @"SOFTWARE\Microsoft\Shell\Session",
+            @"SOFTWARE\Microsoft\Tracing",
+            @"SOFTWARE\Microsoft\Windows\UpdateApi",
+            @"SOFTWARE\Microsoft\WindowsUpdate\UX",
+            @"SOFTWARE\WOW6432Node\Microsoft\DRM",
+            @"SOFTWARE\WOW6432Node\Microsoft\Tracing",
+            @"SYSTEM\Software\Microsoft\TIP",
+            @"SYSTEM\ControlSet001\Control\Cryptography\WebSignIn\Navigation",
+            @"SYSTEM\ControlSet001\Control\MUI\StringCacheSettings",
+            @"SYSTEM\ControlSet001\Control\USB\AutomaticSurpriseRemoval",
+            @"SYSTEM\ControlSet001\Services\BTAGService\Parameters\Settings",
+        };
+
+        private static readonly string[] ScanBasePaths = new[]
+        {
+            @"SOFTWARE\Microsoft",
+            @"SOFTWARE\WOW6432Node\Microsoft",
+            @"SYSTEM\CurrentControlSet\Services",
+            @"SYSTEM\CurrentControlSet\Control",
+            @"SYSTEM\ControlSet001\Control",
+        };
+
+        public void PrintInfo(bool isDebug)
+        {
+            Beaprint.GreatPrint("Registry permissions for hive exploitation");
+
+            new List<Action>
+            {
+                PrintTypingInsightsPermissions,
+                PrintKnownSystemWritableKeys,
+                PrintHeuristicWritableKeys,
+            }.ForEach(action => CheckRunner.Run(action, isDebug));
+        }
+
+        private void PrintTypingInsightsPermissions()
+        {
+            Beaprint.MainPrint("Cross-user TypingInsights key (HKCU/HKU)");
+
+            var matches = new List<RegistryWritableKeyInfo>();
+            var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+            if (RegistryAclScanner.TryGetWritableKey("HKCU", TypingInsightsRelativePath, out var currentUserKey))
+            {
+                if (seen.Add(currentUserKey.FullPath))
+                {
+                    matches.Add(currentUserKey);
+                }
+            }
+
+            foreach (var sid in RegistryHelper.GetUserSIDs())
+            {
+                if (string.IsNullOrEmpty(sid) || sid.Equals(".DEFAULT", StringComparison.OrdinalIgnoreCase) || sid.EndsWith("_Classes", StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+
+                string relativePath = $"{sid}\\{TypingInsightsRelativePath}";
+                if (RegistryAclScanner.TryGetWritableKey("HKU", relativePath, out var info) && seen.Add(info.FullPath))
+                {
+                    matches.Add(info);
+                }
+            }
+
+            if (matches.Count == 0)
+            {
+                Beaprint.GrayPrint("  [-] TypingInsights key does not grant write access to low-privileged groups.");
+                return;
+            }
+
+            PrintEntries(matches);
+            Beaprint.LinkPrint("https://projectzero.google/2025/05/the-windows-registry-adventure-8-exploitation.html", "Writable TypingInsights enables cross-user hive tampering and DoS.");
+        }
+
+        private void PrintKnownSystemWritableKeys()
+        {
+            Beaprint.MainPrint("Known HKLM descendants writable by standard users");
+
+            var matches = new List<RegistryWritableKeyInfo>();
+            foreach (var path in KnownWritableSystemKeyCandidates)
+            {
+                if (RegistryAclScanner.TryGetWritableKey("HKLM", path, out var info))
+                {
+                    matches.Add(info);
+                }
+            }
+
+            if (matches.Count == 0)
+            {
+                Beaprint.GrayPrint("  [-] None of the tracked HKLM keys are writable by low-privileged groups.");
+                return;
+            }
+
+            PrintEntries(matches);
+        }
+
+        private void PrintHeuristicWritableKeys()
+        {
+            Beaprint.MainPrint("Sample of additional writable HKLM keys (depth-limited scan)");
+
+            var matches = RegistryAclScanner.ScanWritableKeys("HKLM", ScanBasePaths, maxDepth: 3, maxResults: 25);
+            if (matches.Count == 0)
+            {
+                Beaprint.GrayPrint("  [-] No additional writable HKLM keys were found within the sampled paths.");
+                return;
+            }
+
+            PrintEntries(matches);
+            Beaprint.GrayPrint("  [*] Showing up to 25 entries from the sampled paths to avoid noisy output.");
+        }
+
+        private static void PrintEntries(IEnumerable<RegistryWritableKeyInfo> entries)
+        {
+            foreach (var entry in entries)
+            {
+                var principals = string.Join(", ", entry.Principals);
+                var rights = entry.Rights.Count > 0 ? string.Join(", ", entry.Rights.Distinct(StringComparer.OrdinalIgnoreCase)) : "Write access";
+                var displayPath = string.IsNullOrEmpty(entry.FullPath) ? $"{entry.Hive}\\{entry.RelativePath}" : entry.FullPath;
+                Beaprint.BadPrint($"  [!] {displayPath} -> {principals} ({rights})");
+            }
+        }
+    }
+}

winPEAS/winPEASexe/winPEAS/Checks/ServicesInfo.cs

@@ -36,6 +36,7 @@ namespace winPEAS.Checks
                 PrintModifiableServices,
                 PrintWritableRegServices,
                 PrintPathDllHijacking,
+                PrintOemPrivilegedUtilities,
                 PrintLegacySignedKernelDrivers,
                 PrintKernelQuickIndicators,
             }.ForEach(action => CheckRunner.Run(action, isDebug));
@@ -210,6 +211,51 @@ namespace winPEAS.Checks
             }
         }
 
+        void PrintOemPrivilegedUtilities()
+        {
+            try
+            {
+                Beaprint.MainPrint("OEM privileged utilities & risky components");
+                var findings = OemSoftwareHelper.GetPotentiallyVulnerableComponents(Checks.CurrentUserSiDs);
+
+                if (findings.Count == 0)
+                {
+                    Beaprint.GoodPrint("    None of the supported OEM utilities were detected.");
+                    return;
+                }
+
+                foreach (var finding in findings)
+                {
+                    bool hasCves = finding.Cves != null && finding.Cves.Length > 0;
+                    string cveSuffix = hasCves ? $" ({string.Join(", ", finding.Cves)})" : string.Empty;
+                    Beaprint.BadPrint($"  {finding.Name}{cveSuffix}");
+
+                    if (!string.IsNullOrWhiteSpace(finding.Description))
+                    {
+                        Beaprint.GrayPrint($"      {finding.Description}");
+                    }
+
+                    foreach (var evidence in finding.Evidence)
+                    {
+                        string message = $"      - {evidence.Message}";
+                        if (evidence.Highlight)
+                        {
+                            Beaprint.BadPrint(message);
+                        }
+                        else
+                        {
+                            Beaprint.GrayPrint(message);
+                        }
+                    }
+
+                    Beaprint.PrintLineSeparator();
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException(ex.Message);
+            }
+        }
 
         void PrintLegacySignedKernelDrivers()
         {
@@ -352,4 +398,3 @@ namespace winPEAS.Checks
         }
     }
 }
-

winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs

@@ -132,6 +132,7 @@ namespace winPEAS.Helpers
             Console.WriteLine(LCYAN + "        activedirectoryinfo" + GRAY + "   Quick AD checks (gMSA readable passwords, AD CS template rights)" + NOCOLOR);
             Console.WriteLine(LCYAN + "        cloudinfo" + GRAY + "            Enumerate cloud information" + NOCOLOR);
             Console.WriteLine(LCYAN + "        windowscreds" + GRAY + "         Search windows credentials" + NOCOLOR);
+            Console.WriteLine(LCYAN + "        registryinfo" + GRAY + "         Flag writable HKLM/HKU keys that enable hive tampering" + NOCOLOR);
             Console.WriteLine(LCYAN + "        browserinfo" + GRAY + "          Search browser information" + NOCOLOR);
             Console.WriteLine(LCYAN + "        filesinfo" + GRAY + "            Search generic files that can contains credentials" + NOCOLOR);
             Console.WriteLine(LCYAN + "        fileanalysis" + GRAY + "         [NOT RUN BY DEFAULT] Search specific files that can contains credentials and for regexes inside files. Might take several minutes." + NOCOLOR);

winPEAS/winPEASexe/winPEAS/Helpers/Registry/RegistryAclScanner.cs

@@ -0,0 +1,221 @@
+using Microsoft.Win32;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using winPEAS.Helpers;
+
+namespace winPEAS.Helpers.Registry
+{
+    internal class RegistryWritableKeyInfo
+    {
+        public string Hive { get; set; }
+        public string RelativePath { get; set; }
+        public string FullPath { get; set; }
+        public List<string> Principals { get; set; } = new List<string>();
+        public List<string> Rights { get; set; } = new List<string>();
+    }
+
+    internal static class RegistryAclScanner
+    {
+        private static readonly Dictionary<string, string> LowPrivSidMap = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+        {
+            { new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null).Value, "BUILTIN\\Users" },
+            { new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null).Value, "Authenticated Users" },
+            { new SecurityIdentifier(WellKnownSidType.WorldSid, null).Value, "Everyone" },
+            { new SecurityIdentifier(WellKnownSidType.InteractiveSid, null).Value, "Interactive" },
+            { new SecurityIdentifier(WellKnownSidType.BuiltinGuestsSid, null).Value, "BUILTIN\\Guests" },
+        };
+
+        public static bool TryGetWritableKey(string hive, string relativePath, out RegistryWritableKeyInfo info)
+        {
+            info = null;
+            using (var key = OpenKey(hive, relativePath))
+            {
+                if (key == null)
+                {
+                    return false;
+                }
+
+                return TryCollectWritableInfo(hive, relativePath, key, out info);
+            }
+        }
+
+        public static List<RegistryWritableKeyInfo> ScanWritableKeys(string hive, IEnumerable<string> basePaths, int maxDepth, int maxResults)
+        {
+            var results = new List<RegistryWritableKeyInfo>();
+            var seenPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+            foreach (var basePath in basePaths ?? Enumerable.Empty<string>())
+            {
+                if (results.Count >= maxResults)
+                {
+                    break;
+                }
+
+                using (var key = OpenKey(hive, basePath))
+                {
+                    if (key == null)
+                    {
+                        continue;
+                    }
+
+                    Traverse(hive, key, basePath, 0, maxDepth, maxResults, seenPaths, results);
+                }
+            }
+
+            return results;
+        }
+
+        private static void Traverse(string hive, RegistryKey currentKey, string currentPath, int depth, int maxDepth, int maxResults, HashSet<string> seenPaths, List<RegistryWritableKeyInfo> results)
+        {
+            if (currentKey == null || results.Count >= maxResults)
+            {
+                return;
+            }
+
+            if (TryCollectWritableInfo(hive, currentPath, currentKey, out var info))
+            {
+                if (seenPaths.Add(info.FullPath))
+                {
+                    results.Add(info);
+                }
+
+                if (results.Count >= maxResults)
+                {
+                    return;
+                }
+            }
+
+            if (depth >= maxDepth)
+            {
+                return;
+            }
+
+            string[] subKeys;
+            try
+            {
+                subKeys = currentKey.GetSubKeyNames();
+            }
+            catch
+            {
+                return;
+            }
+
+            foreach (var subKeyName in subKeys)
+            {
+                if (results.Count >= maxResults)
+                {
+                    break;
+                }
+
+                try
+                {
+                    using (var childKey = currentKey.OpenSubKey(subKeyName))
+                    {
+                        if (childKey == null)
+                        {
+                            continue;
+                        }
+
+                        string childPath = string.IsNullOrEmpty(currentPath) ? subKeyName : $"{currentPath}\\{subKeyName}";
+                        Traverse(hive, childKey, childPath, depth + 1, maxDepth, maxResults, seenPaths, results);
+                    }
+                }
+                catch
+                {
+                    // Ignore keys we cannot open
+                }
+            }
+        }
+
+        private static bool TryCollectWritableInfo(string hive, string relativePath, RegistryKey key, out RegistryWritableKeyInfo info)
+        {
+            info = null;
+
+            try
+            {
+                var acl = key.GetAccessControl(AccessControlSections.Access);
+
+                var principals = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                var rights = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                foreach (RegistryAccessRule rule in acl.GetAccessRules(true, true, typeof(SecurityIdentifier)))
+                {
+                    if (rule.AccessControlType != AccessControlType.Allow)
+                    {
+                        continue;
+                    }
+
+                    var sid = rule.IdentityReference as SecurityIdentifier ?? rule.IdentityReference.Translate(typeof(SecurityIdentifier)) as SecurityIdentifier;
+                    if (sid == null)
+                    {
+                        continue;
+                    }
+
+                    if (!LowPrivSidMap.TryGetValue(sid.Value, out var label))
+                    {
+                        continue;
+                    }
+
+                    string interestingRight = PermissionsHelper.PermInt2Str((int)rule.RegistryRights, PermissionType.WRITEABLE_OR_EQUIVALENT_REG);
+                    if (string.IsNullOrEmpty(interestingRight))
+                    {
+                        continue;
+                    }
+
+                    principals.Add($"{label} ({sid.Value})");
+                    rights.Add(interestingRight);
+                }
+
+                if (principals.Count == 0)
+                {
+                    return false;
+                }
+
+                string normalizedRelativePath = relativePath ?? string.Empty;
+                string fullPath = string.IsNullOrEmpty(normalizedRelativePath) ? key.Name : $"{hive}\\{normalizedRelativePath}";
+
+                info = new RegistryWritableKeyInfo
+                {
+                    Hive = hive,
+                    RelativePath = normalizedRelativePath,
+                    FullPath = fullPath,
+                    Principals = principals.ToList(),
+                    Rights = rights.ToList(),
+                };
+                return true;
+            }
+            catch
+            {
+                return false;
+            }
+        }
+
+        private static RegistryKey OpenKey(string hive, string path)
+        {
+            if (string.IsNullOrEmpty(path))
+            {
+                return null;
+            }
+
+            try
+            {
+                RegistryKey baseKey = hive switch
+                {
+                    "HKLM" => Microsoft.Win32.Registry.LocalMachine,
+                    "HKCU" => Microsoft.Win32.Registry.CurrentUser,
+                    "HKU" => Microsoft.Win32.Registry.Users,
+                    _ => null,
+                };
+
+                return baseKey?.OpenSubKey(path);
+            }
+            catch
+            {
+                return null;
+            }
+        }
+    }
+}

winPEAS/winPEASexe/winPEAS/Info/ServicesInfo/OemSoftwareHelper.cs

@@ -0,0 +1,458 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.ServiceProcess;
+using winPEAS.Helpers;
+
+namespace winPEAS.Info.ServicesInfo
+{
+    internal static class OemSoftwareHelper
+    {
+        internal static List<OemSoftwareFinding> GetPotentiallyVulnerableComponents(Dictionary<string, string> currentUserSids)
+        {
+            var findings = new List<OemSoftwareFinding>();
+            var services = GetServiceSnapshot();
+            var processes = GetProcessSnapshot();
+
+            foreach (var definition in GetDefinitions())
+            {
+                var finding = new OemSoftwareFinding
+                {
+                    Name = definition.Name,
+                    Description = definition.Description,
+                    Cves = definition.Cves,
+                };
+
+                AppendServiceEvidence(definition, services, finding);
+                AppendProcessEvidence(definition, processes, finding);
+                AppendPathEvidence(definition, currentUserSids, finding);
+                AppendPipeEvidence(definition, finding);
+
+                if (finding.Evidence.Count > 0)
+                {
+                    findings.Add(finding);
+                }
+            }
+
+            return findings;
+        }
+
+        private static void AppendServiceEvidence(OemComponentDefinition definition, List<ServiceSnapshot> services, OemSoftwareFinding finding)
+        {
+            if (definition.ServiceHints == null || definition.ServiceHints.Length == 0)
+            {
+                return;
+            }
+
+            foreach (var serviceHint in definition.ServiceHints)
+            {
+                foreach (var service in services)
+                {
+                    if (ContainsIgnoreCase(service.Name, serviceHint) ||
+                        ContainsIgnoreCase(service.DisplayName, serviceHint))
+                    {
+                        finding.Evidence.Add(new OemEvidence
+                        {
+                            EvidenceType = "service",
+                            Highlight = true,
+                            Message = $"Service '{service.Name}' (Display: {service.DisplayName}) matches indicator '{serviceHint}'"
+                        });
+                    }
+                }
+            }
+        }
+
+        private static void AppendProcessEvidence(OemComponentDefinition definition, List<ProcessSnapshot> processes, OemSoftwareFinding finding)
+        {
+            if (definition.ProcessHints == null || definition.ProcessHints.Length == 0)
+            {
+                return;
+            }
+
+            foreach (var processHint in definition.ProcessHints)
+            {
+                foreach (var process in processes)
+                {
+                    bool matchesName = ContainsIgnoreCase(process.Name, processHint);
+                    bool matchesPath = ContainsIgnoreCase(process.FullPath, processHint);
+
+                    if (matchesName || matchesPath)
+                    {
+                        var location = string.IsNullOrWhiteSpace(process.FullPath) ? "Unknown" : process.FullPath;
+                        finding.Evidence.Add(new OemEvidence
+                        {
+                            EvidenceType = "process",
+                            Highlight = true,
+                            Message = $"Process '{process.Name}' (Path: {location}) matches indicator '{processHint}'"
+                        });
+                    }
+                }
+            }
+        }
+
+        private static void AppendPathEvidence(OemComponentDefinition definition, Dictionary<string, string> currentUserSids, OemSoftwareFinding finding)
+        {
+            if ((definition.DirectoryHints == null || definition.DirectoryHints.Length == 0) &&
+                (definition.FileHints == null || definition.FileHints.Length == 0))
+            {
+                return;
+            }
+
+            if (definition.DirectoryHints != null)
+            {
+                foreach (var dirHint in definition.DirectoryHints)
+                {
+                    var expandedPath = ExpandPath(dirHint.Path);
+                    if (!Directory.Exists(expandedPath))
+                    {
+                        continue;
+                    }
+
+                    var permissions = PermissionsHelper.GetPermissionsFolder(expandedPath, currentUserSids, PermissionType.WRITEABLE_OR_EQUIVALENT);
+                    bool isWritable = permissions.Count > 0;
+
+                    finding.Evidence.Add(new OemEvidence
+                    {
+                        EvidenceType = "path",
+                        Highlight = isWritable,
+                        Message = BuildPathMessage(expandedPath, dirHint.Description, isWritable, permissions)
+                    });
+                }
+            }
+
+            if (definition.FileHints != null)
+            {
+                foreach (var fileHint in definition.FileHints)
+                {
+                    var expandedPath = ExpandPath(fileHint);
+                    if (!File.Exists(expandedPath))
+                    {
+                        continue;
+                    }
+
+                    var permissions = PermissionsHelper.GetPermissionsFile(expandedPath, currentUserSids, PermissionType.WRITEABLE_OR_EQUIVALENT);
+                    bool isWritable = permissions.Count > 0;
+
+                    finding.Evidence.Add(new OemEvidence
+                    {
+                        EvidenceType = "file",
+                        Highlight = isWritable,
+                        Message = BuildPathMessage(expandedPath, "file", isWritable, permissions)
+                    });
+                }
+            }
+        }
+
+        private static void AppendPipeEvidence(OemComponentDefinition definition, OemSoftwareFinding finding)
+        {
+            if (definition.PipeHints == null)
+            {
+                return;
+            }
+
+            foreach (var pipeHint in definition.PipeHints)
+            {
+                try
+                {
+                    var path = $"\\\\.\\pipe\\{pipeHint.Name}";
+                    var security = File.GetAccessControl(path);
+                    string sddl = security.GetSecurityDescriptorSddlForm(AccessControlSections.All);
+                    string identity = string.Empty;
+                    string rights = string.Empty;
+                    bool worldWritable = false;
+
+                    if (pipeHint.CheckWorldWritable)
+                    {
+                        worldWritable = HasWorldWritableAce(security, out identity, out rights);
+                    }
+
+                    string details = worldWritable
+                        ? $"Named pipe '{pipeHint.Name}' ({pipeHint.Description}) is writable by {identity} ({rights})."
+                        : $"Named pipe '{pipeHint.Name}' ({pipeHint.Description}) present. SDDL: {sddl}";
+
+                    finding.Evidence.Add(new OemEvidence
+                    {
+                        EvidenceType = "pipe",
+                        Highlight = worldWritable,
+                        Message = details
+                    });
+                }
+                catch (FileNotFoundException)
+                {
+                    // Pipe not present.
+                }
+                catch (DirectoryNotFoundException)
+                {
+                    // Pipe namespace not accessible.
+                }
+                catch (Exception)
+                {
+                    // Best effort: pipes might disappear during enumeration or deny access.
+                }
+            }
+        }
+
+        private static List<ServiceSnapshot> GetServiceSnapshot()
+        {
+            var services = new List<ServiceSnapshot>();
+
+            try
+            {
+                foreach (var service in ServiceController.GetServices())
+                {
+                    services.Add(new ServiceSnapshot
+                    {
+                        Name = service.ServiceName ?? string.Empty,
+                        DisplayName = service.DisplayName ?? string.Empty
+                    });
+                }
+            }
+            catch (Exception)
+            {
+                // Ignore - this is best effort.
+            }
+
+            return services;
+        }
+
+        private static List<ProcessSnapshot> GetProcessSnapshot()
+        {
+            var processes = new List<ProcessSnapshot>();
+
+            try
+            {
+                foreach (var process in Process.GetProcesses())
+                {
+                    string fullPath = string.Empty;
+                    try
+                    {
+                        fullPath = process.MainModule?.FileName ?? string.Empty;
+                    }
+                    catch
+                    {
+                        // Access denied or 64-bit vs 32-bit mismatch.
+                    }
+
+                    processes.Add(new ProcessSnapshot
+                    {
+                        Name = process.ProcessName ?? string.Empty,
+                        FullPath = fullPath ?? string.Empty
+                    });
+                }
+            }
+            catch (Exception)
+            {
+                // Ignore - enumeration is best effort.
+            }
+
+            return processes;
+        }
+
+        private static string ExpandPath(string rawPath)
+        {
+            if (string.IsNullOrWhiteSpace(rawPath))
+            {
+                return string.Empty;
+            }
+
+            var expanded = Environment.ExpandEnvironmentVariables(rawPath);
+            return expanded.Trim().Trim('"');
+        }
+
+        private static string BuildPathMessage(string path, string description, bool isWritable, List<string> permissions)
+        {
+            string descriptor = string.IsNullOrWhiteSpace(description) ? "" : $" ({description})";
+            if (isWritable)
+            {
+                return $"Path '{path}'{descriptor} is writable by current user: {string.Join(", ", permissions)}";
+            }
+
+            return $"Path '{path}'{descriptor} detected.";
+        }
+
+        private static bool ContainsIgnoreCase(string value, string toFind)
+        {
+            if (string.IsNullOrWhiteSpace(value) || string.IsNullOrWhiteSpace(toFind))
+            {
+                return false;
+            }
+
+            return value.IndexOf(toFind, StringComparison.OrdinalIgnoreCase) >= 0;
+        }
+
+        private static bool HasWorldWritableAce(FileSecurity security, out string identity, out string rights)
+        {
+            identity = string.Empty;
+            rights = string.Empty;
+
+            try
+            {
+                var rules = security.GetAccessRules(true, true, typeof(SecurityIdentifier));
+                foreach (FileSystemAccessRule rule in rules)
+                {
+                    if (rule.AccessControlType != AccessControlType.Allow)
+                    {
+                        continue;
+                    }
+
+                    if (rule.IdentityReference is SecurityIdentifier sid)
+                    {
+                        bool isWorld = sid.IsWellKnown(WellKnownSidType.WorldSid);
+                        bool isAuthenticated = sid.IsWellKnown(WellKnownSidType.AuthenticatedUserSid);
+
+                        if (!isWorld && !isAuthenticated)
+                        {
+                            continue;
+                        }
+
+                        const FileSystemRights interestingRights =
+                            FileSystemRights.FullControl |
+                            FileSystemRights.Modify |
+                            FileSystemRights.Write |
+                            FileSystemRights.WriteData |
+                            FileSystemRights.CreateFiles |
+                            FileSystemRights.ChangePermissions;
+
+                        if ((rule.FileSystemRights & interestingRights) != 0)
+                        {
+                            identity = isWorld ? "Everyone" : "Authenticated Users";
+                            rights = rule.FileSystemRights.ToString();
+                            return true;
+                        }
+                    }
+                }
+            }
+            catch
+            {
+                // Ignore parsing issues.
+            }
+
+            return false;
+        }
+
+        private static IEnumerable<OemComponentDefinition> GetDefinitions()
+        {
+            return new List<OemComponentDefinition>
+            {
+                new OemComponentDefinition
+                {
+                    Name = "ASUS DriverHub",
+                    Description = "Local web API exposed by ADU.exe allowed bypassing origin/url validation and signature checks.",
+                    Cves = new[] { "CVE-2025-3462", "CVE-2025-3463" },
+                    ServiceHints = new[] { "asusdriverhub", "asus driverhub" },
+                    ProcessHints = new[] { "adu", "asusdriverhub" },
+                    DirectoryHints = new[]
+                    {
+                        new PathHint { Path = "%ProgramFiles%\\ASUS\\AsusDriverHub", Description = "Program Files" },
+                        new PathHint { Path = "%ProgramFiles(x86)%\\ASUS\\AsusDriverHub", Description = "Program Files (x86)" },
+                        new PathHint { Path = "%ProgramData%\\ASUS\\AsusDriverHub\\SupportTemp", Description = "SupportTemp updater staging" }
+                    },
+                    FileHints = new[]
+                    {
+                        "%ProgramData%\\ASUS\\AsusDriverHub\\SupportTemp\\Installer.json"
+                    }
+                },
+                new OemComponentDefinition
+                {
+                    Name = "MSI Center",
+                    Description = "MSI.CentralServer.exe exposed TCP commands with TOCTOU and signature bypass issues.",
+                    Cves = new[] { "CVE-2025-27812", "CVE-2025-27813" },
+                    ServiceHints = new[] { "msi.center", "msi centralserver" },
+                    ProcessHints = new[] { "msi.centralserver", "msi center" },
+                    DirectoryHints = new[]
+                    {
+                        new PathHint { Path = "%ProgramFiles%\\MSI\\MSI Center", Description = "Main installation" },
+                        new PathHint { Path = "%ProgramFiles(x86)%\\MSI\\MSI Center", Description = "Main installation (x86)" },
+                        new PathHint { Path = "%ProgramData%\\MSI\\MSI Center", Description = "Shared data" },
+                        new PathHint { Path = "%ProgramData%\\MSI Center SDK", Description = "SDK temp copy location" }
+                    }
+                },
+                new OemComponentDefinition
+                {
+                    Name = "Acer Control Centre",
+                    Description = "ACCSvc.exe exposes treadstone_service_LightMode named pipe with weak impersonation controls.",
+                    Cves = new[] { "CVE-2025-5491" },
+                    ServiceHints = new[] { "accsvc", "acer control" },
+                    ProcessHints = new[] { "accsvc", "accstd" },
+                    DirectoryHints = new[]
+                    {
+                        new PathHint { Path = "%ProgramFiles%\\Acer\\Care Center", Description = "Install directory" },
+                        new PathHint { Path = "%ProgramFiles(x86)%\\Acer\\Care Center", Description = "Install directory (x86)" }
+                    },
+                    PipeHints = new[]
+                    {
+                        new PipeHint { Name = "treadstone_service_LightMode", Description = "Command dispatcher", CheckWorldWritable = true }
+                    }
+                },
+                new OemComponentDefinition
+                {
+                    Name = "Razer Synapse 4 Elevation Service",
+                    Description = "razer_elevation_service.exe exposes COM elevation helpers that allowed arbitrary process launch.",
+                    Cves = new[] { "CVE-2025-27811" },
+                    ServiceHints = new[] { "razer_elevation_service" },
+                    ProcessHints = new[] { "razer_elevation_service" },
+                    DirectoryHints = new[]
+                    {
+                        new PathHint { Path = "%ProgramFiles%\\Razer\\RazerAppEngine", Description = "Razer App Engine" },
+                        new PathHint { Path = "%ProgramFiles(x86)%\\Razer\\RazerAppEngine", Description = "Razer App Engine (x86)" }
+                    }
+                }
+            };
+        }
+
+        private class ServiceSnapshot
+        {
+            public string Name { get; set; }
+            public string DisplayName { get; set; }
+        }
+
+        private class ProcessSnapshot
+        {
+            public string Name { get; set; }
+            public string FullPath { get; set; }
+        }
+
+        private class OemComponentDefinition
+        {
+            public string Name { get; set; }
+            public string Description { get; set; }
+            public string[] Cves { get; set; } = Array.Empty<string>();
+            public string[] ServiceHints { get; set; } = Array.Empty<string>();
+            public string[] ProcessHints { get; set; } = Array.Empty<string>();
+            public PathHint[] DirectoryHints { get; set; } = Array.Empty<PathHint>();
+            public string[] FileHints { get; set; } = Array.Empty<string>();
+            public PipeHint[] PipeHints { get; set; } = Array.Empty<PipeHint>();
+        }
+
+        private class PathHint
+        {
+            public string Path { get; set; }
+            public string Description { get; set; }
+        }
+
+        private class PipeHint
+        {
+            public string Name { get; set; }
+            public string Description { get; set; }
+            public bool CheckWorldWritable { get; set; }
+        }
+    }
+
+    internal class OemSoftwareFinding
+    {
+        public string Name { get; set; }
+        public string Description { get; set; }
+        public string[] Cves { get; set; } = Array.Empty<string>();
+        public List<OemEvidence> Evidence { get; } = new List<OemEvidence>();
+    }
+
+    internal class OemEvidence
+    {
+        public string EvidenceType { get; set; }
+        public string Message { get; set; }
+        public bool Highlight { get; set; }
+    }
+}

winPEAS/winPEASexe/winPEAS/winPEAS.csproj

@@ -1201,6 +1201,7 @@
     <Compile Include="Checks\SystemInfo.cs" />
     <Compile Include="Checks\UserInfo.cs" />
     <Compile Include="Checks\WindowsCreds.cs" />
+    <Compile Include="Checks\RegistryInfo.cs" />
     <Compile Include="Helpers\AppLocker\AppLockerHelper.cs" />
     <Compile Include="Helpers\AppLocker\AppLockerRules.cs" />
     <Compile Include="Helpers\AppLocker\IAppIdPolicyHandler.cs" />
@@ -1462,12 +1463,14 @@
       <DependentUpon>Resources.resx</DependentUpon>
     </Compile>
     <Compile Include="Info\ServicesInfo\ServicesInfoHelper.cs" />
+    <Compile Include="Info\ServicesInfo\OemSoftwareHelper.cs" />
     <Compile Include="Info\SystemInfo\SystemInfo.cs" />
     <Compile Include="Info\UserInfo\UserInfoHelper.cs" />
     <Compile Include="Helpers\DomainHelper.cs" />
     <Compile Include="Helpers\CheckRunner.cs" />
     <Compile Include="Helpers\ReflectionHelper.cs" />
     <Compile Include="Helpers\Registry\RegistryHelper.cs" />
+    <Compile Include="Helpers\Registry\RegistryAclScanner.cs" />
     <Compile Include="Helpers\Search\SearchHelper.cs" />
     <Compile Include="Wifi\Wifi.cs" />
     <Compile Include="Wifi\NativeWifiApi\Interop.cs" />