Seatbelt - Seatbelt is a C# project that performs a number of

项目说明

Seatbelt

----

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensi perspectives.

' HostEnum.ps1 script and \_'s Get-HostProfile.ps1 provided inspiration for many of the artifacts to collect.

and are the primary authors of this implementation.

Seatbelt is licensed under the BSD 3-Clause license.

Table of Contents

Seatbelt

* Table of Contents
* Command Line Usage
* Command Groups
+ system
+ user
+ misc
+ Additional Command Groups
* Command Arguments
* Output
* Remote Enumeration
* Building Your Own Modules
* Compile Instructions
* Acknowledgments

Command Line Usage

Note: searches that target users will run for the current user if not-elevated and for ALL users if elevated.

Command Groups

Note: many commands do some type of filtering by default. Supplying the -full argument prevents filtering output. Also, the command group all will run all current checks.

For example, the following command will run ALL checks and returns ALL output:

Seatbelt.exe -group=all -full

system

Runs checks that mine interesting data about the system.

Executed with: Seatbelt.exe -group=system

| Command | Description |
| ----------- | ----------- |
| AMSIPro | Pro registered for AMSI |
| AntiVirus | Registered antivirus (via WMI) |
| AppLocker | AppLocker settings, if installed |
| ARPTable | Lists the current ARP table and adapter information(equi to arp -a) |
| AuditPolicies | Enumerates classic and ad audit policy settings |
| AuditPolicyRegistry | Audit settings via the registry |
| AutoRuns | Auto run executables/scripts/programs |
| Certificates | User and machine personal certificate files |
| CertificateThumbprints | Thumbprints for all certificate store certs on the system |
| CredGuard | CredentialGuard configuration |
| DNSCache | DNS cache entries (via WMI) |
| DotNet | DotNet |
| En | Current en %PATH$ folders and SDDL information |
| En | Current user en |
| Hotfixes | Installed hotfixes (via WMI) |
| InterestingProcesses | "Interesting" processes - defensi and admin tools |
| InternetSettings | Internet settings including proxy configs |
| LAPS | LAPS settings, if installed |
| LastShutdown | Returns the DateTime of the last system shutdown (via the registry) |
| LocalGPOs | Local Group Policy settings applied to the machine/local users |
| LocalGroups | Non-empty local groups, "full" displays all groups (argument == computername to enumerate) |
| LocalUsers | Local users, whether they're acti, and pwd last set (argument == computername to enumerate) |
| LogonSessions | Logon events (Event ID 4624) from the security event log. Default of 10 days, argument == last X days. |
| LSASettings | LSA settings (including auth packages) |
| McAfeeConfigs | Finds McAfee configuration files |
| NamedPipes | Named pipe names and any readable ACL information |
| NetworkProfiles | Windows network profiles |
| NetworkShares | Network shares exposed by the machine (via WMI) |
| NTLMSettings | NTLM authentication settings |
| OptionalFeatures | TODO |
| OSInfo | Basic OS info (i.e. architecture, OS , etc.) |
| PoweredOnEvents | Reboot and sleep schedule based on the System event log EIDs 1, 12, 13, 42, and 6008. Default of 7 days, argument == last X days. |
| PowerShell | PowerShell and security settings |
| Processes | Running processes with file info company names that don't contain 'Microsoft', "full" enumerates all processes |
| PSSessionSettings | Enumerates PS Session Settings from the registry |
| RDPSessions | Current incoming RDP sessions (argument == computername to enumerate) |
| RDPsettings | Remote Desktop Ser Settings |
| SCCM | System Center Configuration Manager (SCCM) settings, if applicable |
| Services | Services with file info company names that don't contain 'Microsoft', "full" dumps all processes |
| Sysmon | Sysmon configuration from the registry |
| TcpConnections | Current TCP connections and their associated processes and services |
| TokenPri | Currently enabled token pri (e.g. SeDebugPri/etc.) |
| UAC | UAC system policies via the registry |
| UdpConnections | Current UDP connections and associated processes and services |
| UserRightAssignments | Configured User Right Assignments (e.g. SeDenyNetworkLogonRight, SeShutdownPri, etc.) argument == computername to enumerate |
| WifiProfile | TODO |
| WindowsAutoLogon | Registry autologon information |
| WindowsDefender | Windows Defender settings (including exclusion locations) |
| WindowsE | Windows Event Forwarding (WEF) settings via the registry |
| WindowsFirewall | Non-standard firewall rules, "full" dumps all (arguments == allow/deny/tcp/udp/in/out/domain/private/public) |
| WMIE | Lists WMI Event Consumers |
| WMIE | Lists WMI Event Filters |
| WMIFilterBinding | Lists WMI Filter to Consumer Bindings |
| WSUS | Windows Ser Services (WSUS) settings, if applicable |

user

Runs checks that mine interesting data about the currently logged on user (if not elevated) or ALL users (if elevated).

Executed with: Seatbelt.exe -group=user

| Command | Description |
| ----------- | ----------- |
| Certificates | User and machine personal certificate files |
| CertificateThumbprints | Thumbprints for all certificate store certs on the system |
| ChromiumPresence | Checks if interesting Chrome/Edge/Bra files exist |
| CloudCredentials | AWS/Google/Azure cloud credential files |
| CloudSyncPro | TODO |
| CredEnum | Enumerates the current user's sa using CredEnumerate() |
| dir | Lists files/folders. By default, lists users' downloads, documents, and desktop folders (arguments == \<directory\> \<depth\> \<regex\> |
| DpapiMasterKeys | List DPAPI master keys |
| Dsregcmd | TODO |
| ExplorerMRUs | Explorer most recently used files (last 7 days, argument == last X days) |
| ExplorerRunCommands | Recent Explorer "run" commands |
| FileZilla | FileZilla configuration files |
| FirefoxPresence | Checks if interesting Firefox files exist |
| IdleTime | Returns the number of seconds since the current user's last input. |
| IEFa | Internet Explorer fa |
| IETabs | Open Internet Explorer tabs |
| IEUrls| Internet Explorer typed URLs (last 7 days, argument == last X days) |
| KeePass | TODO |
| MappedDrives | Users' mapped drives (via WMI) |
| OfficeMRUs | Office most recently used file list (last 7 days) |
| OneNote | TODO |
| OracleSQLDe | TODO |
| PowerShellHistory | Iterates through every local user and attempts to read their PowerShell console history if successful will print it |
| PuttyHostKeys | Sa SSH host keys |
| PuttySessions | Sa configuration (interesting fields) and SSH host keys |
| RDCManFiles | Windows Remote Desktop Connection Manager settings files |
| RDPSa | Saved RDP connections stored in the registry |
| SecPackageCreds | Obtains credentials from security packages |
| SlackDownloads | Parses any found 'slack-downloads' files |
| SlackPresence | Checks if interesting Slack files exist |
| SlackWorkspaces | Parses any found 'slack-workspaces' files |
| SuperPutty | SuperPutty configuration files |
| TokenGroups | The current token's local and domain groups |
| WindowsCredentialFiles | Windows credential DPAPI blobs |
| WindowsVault | Credentials saved in the Windows Vault (i.e. logins from Internet Explorer and Edge). |

misc

Runs all miscellaneous checks.

Executed with: Seatbelt.exe -group=misc

| Command | Description |
| ----------- | ----------- |
| ChromiumBookmarks | Parses any found Chrome/Edge/Bra bookmark files |
| ChromiumHistory | Parses any found Chrome/Edge/Bra history files |
| ExplicitLogonEvents | Explicit Logon events (Event ID 4648) from the security event log. Default of 7 days, argument == last X days. |
| FileInfo | Information about a file ( information, timestamps, basic PE info, etc. argument(s) == file path(s) |
| FirefoxHistory | Parses any found FireFox history files |
| InstalledProducts | Installed products via the registry |
| InterestingFiles | "Interesting" files matching patterns in the user's folder. Note: takes non-trivial time. |
| LogonEvents | Logon events (Event ID 4624) from the security event log. Default of 10 days, argument == last X days. |
| LOLBAS | Locates Living Off The Land Binaries and Scripts (LOLBAS) on the system. Note: takes non-trivial time. |
| McAfeeSiteList | Decrypt any found McAfee SiteList.xml configuration files. |
| MicrosoftUpdates | All Microsoft updates (via COM) |
| OutlookDownloads | List files downloaded by Outlook |
| PowerShellEvents | PowerShell script block logs (4104) with sensitive data. |
| Printers | Installed Printers (via WMI) |
| ProcessCreationEvents | Process creation logs (4688) with sensitive data. |
| ProcessOwners | Running non-session 0 process list with owners. For remote use. |
| RecycleBin | Items in the Recycle Bin deleted in the last 30 days - only works from a user context! |
| reg | Registry key (HKLM\Software by default) argument == [Path] [intDepth] [Regex] [boolIgnoreErrors] |
| RPCMappedEndpoints | Current RPC endpoints mapped |
| ScheduledTasks | Scheduled tasks (via WMI) that aren't authored by 'Microsoft', "full" dumps all Scheduled tasks |
| SearchIndex | Query results from the Windows Search Index, default term of 'passsword'. (argument(s) == \<search path\> \<pattern1,pattern2,...\> |
| SecurityPackages | Enumerates the security packages currently a using EnumerateSecurityPackagesA() |
| SysmonEvents | Sysmon process creation logs (1) with sensitive data. |

Additional Command Groups

Executed with: Seatbelt.exe -group=GROUPNAME

| Alias | Description |
| ----------- | ----------- |
| Slack | Runs modules that start with "Slack*" |
| Chromium | Runs modules that start with "Chromium*" |
| Remote | Runs the following modules (for use against a remote system): AMSIPro, AntiVirus, AuditPolicyRegistry, ChromiumPresence, CloudCredentials, DNSCache, DotNet, DpapiMasterKeys, En, ExplicitLogonEvents, ExplorerRunCommands, FileZilla, Hotfixes, InterestingProcesses, KeePass, LastShutdown, LocalGroups, LocalUsers, LogonEvents, LogonSessions, LSASettings, MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings, OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, ProcessOwners, PSSessionSettings, PuttyHostKeys, PuttySessions, RDPSa, RDPSessions, RDPsettings, Sysmon, WindowsDefender, WindowsE, WindowsFirewall |

Command Arguments

Command that accept arguments have it noted in their description. To pass an argument to a command, enclose the command an arguments in double quotes.

For example, the following command returns 4624 logon events for the last 30 days:

Seatbelt.exe "LogonEvents 30"

The following command queries a registry three levels deep, returning only keys// that match the regex .*defini.*, and ignoring any errors that occur.

Seatbelt.exe "reg \"HKLM\SOFTWARE\Microsoft\Windows Defender\" 3 .*defini.* true"

Output

Seatbelt can redirect its output to a file with the -outputfile="C:\Path\file.txt" argument. If the file path ends in .json, the output will be structured json.

For example, the following command will output the results of system checks to a txt file:

Seatbelt.exe -group=system -outputfile="C:\Temp\system.txt"

Remote Enumeration

Commands noted with a + in the help menu can be run remotely against another system. This is performed over WMI for WMI classes and WMI's StdRegProv for registry enumeration.

To enumerate a remote system, supply -computername=COMPUTER.DOMAIN.COM - an alternate username and password can be specified with -username=DOMAIN\USER -password=PASSWORD

For example, the following command runs remote-focused checks against a remote system:

Seatbelt.exe -group=remote -computername=192.168.230.209 -username=THESHIRE\sam -password="yum \"po-ta-toes\""

Building Your Own Modules

Seatbelt's structure is completely modular, allowing for additional command modules to be dropped into the file structure and loaded up dynamically.

There is a commented command module template at .\Seatbelt\Commands\Template.cs for reference. Once built, drop the module in the logical file location, include it in the project in the Studio Solution Explorer, and compile.

Compile Instructions

We are not planning on releasing binaries for Seatbelt, so you will have to compile yourself.

Seatbelt has been built against .NET 3.5 and 4.0 with C# 8.0 features and is compatible with Studio Community Edition. Simply open up the project .sln, choose "release", and build. To change the target .NET framework , modify the project's settings and rebuild the project.

Acknowledgments

Seatbelt incorporates collection items, code C# snippets, and bits of PoCs found throughout research for its capabilities. These ideas, snippets, and authors are highlighted in the appropriate locations in the source code, and include:

* ' HostEnum.ps1 script and \_'s Get-HostProfile.ps1 provided inspiration for many of the artifacts to collect.
* Boboes' code concerning NetLocalGroupGetMembers
* ambyte's code for con a mapped dri to a network path
* Igor Korkhov's code to retrie token group information
* RobSiklos' snippet to determine if a host is a machine
* JGU's snippet on file/folder ACL right comparison
* Rod Stephens' pattern for recursive file enumeration
* SwDe's snippet for enumerating current token pri
* Jared Atkinson's PowerShell work on Kerberos ticket caches
* darkmatter08's Kerberos C# snippet
* Numerous PInvoke.net samples <3
* Jared Hill's awesome CodeProject to use Local Security Authority to Enumerate User Sessions
* Fred's code on querying the ARP cache
* ShuggyCoUk's snippet on querying the TCP connection table
* yizhang82's example of using reflection to interact with COM objects through C#
* 's SharpWeb project
* 's E project
* 's SharpCloud project, BSD 3-Clause
* @_RastaMouse's Watson project, GPL License
* @_RastaMouse's Work on AppLocker enumeration
* 's In project, GPL License
* TrustedSec's HoneyBadger project, BSD 3-Clause
* CENTRAL Solutions's Audit User Rights Assignment Project, No license
* Collection ideas inspired from 's Reconerator
* Office MRU locations and timestamp parsing information from Dustin Hurlbut's paper Microsoft Office 2007, 2010 - Registry Artifacts
* The Windows Commands list, used for sensiti construction
* Ryan Ries' code for enumeration mapped RPC endpoints
* Chris Haas' post on EnumerateSecurityPackages()
* darkoperator's work on the HoneyBadger project
* 's work on WMI Registry enumeration
* Alexandru's answer on RegistryKey.OpenBaseKey alternatives
* Tomas Vera's post on Ja
* Marc Gravell's note on recursively listing files/folders
* 's Sysmon rule parser
* Some inspiration from spolnik's Simple.CredentialsManager project, Apache 2 license
* This post on Credential Guard settings
* This thread on network profile information
* Mark McKinnon's post on decoding the DateCreated and DateLastConnected SSID
* This Specops post on group policy caching
* sa_ddam213's StackO post on enumerating items in the Recycle Bin
* Kirill Osenkov's code for managed assembly detection
* The Mono project for the SecBuffer/SecBufferDesc classes
* Elad Shamir and his Internal-Monologue project, Le Toux for his DetectPassword project, and Lee Christensen for this GetNTLMChallenge project. All of these served as inspiration int he SecPackageCreds command.
* and 's Gopher project for inspiration for the FileZilla and SuperPutty commands
* for the original McAfee SiteList.xml decryption code

We' to do our due diligence for citations, but if we've left someone/something out, please let us know!

项目信息

开发语言：C#

Star 数：4716

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。