3

Two situations with a similar goal:

1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to the system without attempting actual exploits?

2) If you have either partial or full access to a target (unprivileged login, or root access) is it possible to finger print the security patches that have been applied without attempting the exploits that the patches remedy?

I should state first, that this is from a red team perspective. The owner of the target computer cannot be asked questions, or be asked to take any actions. Furthermore, stealth is of the essence.

There is a world of difference between an unpatched system, and a patched system, but it is quite noisy, and risks downing the system to try too many actual exploits (and it seems like the dumb way to go about finding the patch level.) Is there any safe, and quiet way to fingerprint this?

Improve this question
7
  • If you've got full access, "fingerprinting" is unnecessary. Just query the OS and it'll tell you.
    – Iszi
    Commented Jan 30, 2015 at 15:25
  • I think the command to do that would be a great part of the full answer :)
    – MrSynAckSter
    Commented Jan 30, 2015 at 15:26
  • PowerShell: Get-Hotfix You want just the stuff that Microsoft considers a security fix: Get-Hotfix | ? 'Description' -eq 'Security Update'
    – Iszi
    Commented Jan 30, 2015 at 17:03
  • I like this one a lot! But what priv level does it need? Is there a batch alternative for systems without powershell?
    – MrSynAckSter
    Commented Jan 30, 2015 at 17:13
  • 1
    Since Vista, all Windows versions have had PowerShell. Certain versions may lack certain features, or require different syntax. The command ran fine without triggering permissions errors or UAC for me, so I don't think you need to be admin.
    – Iszi
    Commented Jan 30, 2015 at 17:37

2 Answers 2

Reset to default
2

It is possible to do an unauthenticated network fingerprint for certain patches, but only a few. Nessus is one tool, and it can find e.g. MS08-067, MS12-036, with no credentials. You can use Nessus for free under the home license. Nmap also has some scripts for this (e.g. MS08-067) although be aware that this is different to the fingerprinting Ramrod mentioned in his answer.

A lot of patches don't affect anything that's directly network-accessible, e.g. Internet Explorer patches. You can do a similar test by having the client visit a website that checks it. Qualys BrowserCheck is one example.

The usual way to do patch scanning to do scan using administrator credentials. There are lots of tools that do this (including Nessus). In theory I expect you can do pretty good patch scanning with non-admin credentials. However, I don't know of any tool that does this - and I doubt anyone would be particularly interested in creating one.

Improve this answer
5
  • I like your answer, but I thought I'd add some suggestions, and a little more info: This is from a red team perspective, so it wouldn't be possible to ask the client to do things. For the nmap bit, can you added a relevant command. Bonus: format your answer into network/priv/unpriv. Figuring out the patch level without admin is useful for prevesc.
    – MrSynAckSter
    Commented Jan 30, 2015 at 15:56
  • @baordog - red team can't get a victim to visit your web page? must try harder!
    – paj28
    Commented Jan 30, 2015 at 15:58
  • I understand your perspective, but spear fishing campaigns are not always possible (or to be more specific, within the rules of engagement)
    – MrSynAckSter
    Commented Jan 30, 2015 at 16:00
  • @baordog - meterpreter's getsystem() is the only thing I know that does automatic probing for privilege escalation. I expect you can figure out the nmap command on your own.
    – paj28
    Commented Jan 30, 2015 at 16:03
  • 1
    You can use the WMI query SELECT HotFixID FROM win32_QuickFixEngineering which will list the installed patches on the remote machine. Metasploit has a post module post/windows/gather/enum_patches which can be used when you have meterpreter session.
    – void_in
    Commented Jan 30, 2015 at 17:55
-1

It is possible to fingerprint a system remotely, although it generates a fair amount of network traffic in the process.

Programs such as NMAP can send a multitude of packets over varying ports and analyze the response of the target system.

Basically, each patch typically adjusts the default of one, if not multiple, port responses. NMAP analyzes these responses, all the way down to bit-by-bit, to determine which patches are running. Some patches are easier to fingerprint because they may have some anomalies in their code structure, which (for example)may cause certain TCP/UDP flags to be set that wouldn't normally be.

It may seem like this is a fairly unreliable method, but ports are numbered with 16 bits, giving 65,536 different ports for UDP and TCP that could potentially be checked!

Improve this answer
2
  • Can you explain how to applies to Windows patches specifically? I use nmap quite a bunch and I have never seen to enumerate a patch level. Also, adding nmap commands and output would improve the answer quite a bit ;)
    – MrSynAckSter
    Commented Jan 30, 2015 at 15:37
  • I'm not sure we can say it's "typical" of a patch to adjust port responses. There's a fair number, if not a large majority, of patches that don't affect network services at all - so, why would they do this? Have you ever performed vulnerability scanning with tools like Nessus? The difference between a credentialed scan (e.g.: effectively performing local analysis of the OS components) and a non-credentialed scan (only seeing what's visible to non-authenticated users on the network) is night and day!
    – Iszi
    Commented Jan 30, 2015 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .