base on Moriarty is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments. # Moriarty Moriarty is a comprehensive .NET tool that extends the functionality of [Watson](https://github.com/rasta-mouse/Watson) and [Sherlock](https://github.com/rasta-mouse/sherlock), originally developed by [@_RastaMouse](https://twitter.com/_RastaMouse). It is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments. Moriarty combines the capabilities of Watson and Sherlock, adding enhanced scanning for newer vulnerabilities and integrating additional checks. ## Supported Versions - Windows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2) - Windows 11 (Versions: 21H2, 22H1, 22H2, 23H1) - Server 2016, 2019, 2022 ## Installation and Build Instructions First, clone the Moriarty repository to your local machine using Git: ```bash git clone https://github.com/BC-SECURITY/Moriarty.git ``` ### Building the Project After cloning the repository, you can build the Moriarty executable using Visual Studio. ### Using Visual Studio 1. Open `Moriarty.sln` in Visual Studio. 2. Right-click on the solution in Solution Explorer and select "Restore NuGet Packages" to ensure all dependencies are up to date. 3. Set the build configuration to "Release". 4. Build the solution by selecting "Build > Build Solution" from the menu. ## Usage ### Help Menu ``` C:\> Moriarty.exe --help ███ ███ ██████ ██████ ██ █████ ██████ ████████ ██ ██ ████ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██████ ██ ███████ ██████ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ v1.2 BC Security Usage: Moriarty.exe [options] Options: -h, --help Display this help message. -d, --debug Run in debug mode for additional output. -l, --list-vulns List all vulnerabilities that are scanned for. Examples: Moriarty.exe -d Moriarty.exe --list-vulns ``` ### Scan ``` C:\> Moriarty.exe ███ ███ ██████ ██████ ██ █████ ██████ ████████ ██ ██ ████ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██████ ██ ███████ ██████ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ v1.2 BC Security [*] OS Version: 22H2 (22621) [*] Enumerating installed KBs... [+] CVE-2023-36664 : VULNERABLE [>] https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection [+] PrintNightmare (CVE-2021-1675, CVE-2021-34527) : VULNERABLE [>] https://github.com/xbufu/PrintNightmareCheck/tree/main [*] Vulnerabilities found: 2/37 [+] Scan Complete! ``` ## CVEs and Vulnerabilities Moriarty scans for a variety of CVEs and vulnerabilities. Below is a table detailing each, along with a more detailed description and links to the CVE database. | CVE/Vulnerability ID | Description | | --------------------- | ----------- | | [MS10-015](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-015) | Vulnerability in Windows Kernel related to privilege elevation, allowing attackers to execute arbitrary code. | | [MS10-092](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-092) | Vulnerability in Windows Task Scheduler allowing for arbitrary code execution with escalated privileges. | | [MS13-053](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053) | Multiple vulnerabilities in Windows Kernel-Mode Drivers that could allow elevation of privilege. | | [MS13-081](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081) | Multiple vulnerabilities in Windows Kernel-Mode Drivers that could allow remote code execution. | | [MS14-058](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-058) | Vulnerabilities in Kernel-Mode Driver that could allow remote code execution through specially crafted TrueType font files. | | [MS15-051](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051) | Vulnerability in Windows Kernel-Mode Drivers allowing for elevation of privilege by bypassing the security features of Windows. | | [MS15-078](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078) | Vulnerability in Windows Font Driver allowing remote code execution through maliciously crafted OpenType fonts. | | [MS16-016](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-016) | Vulnerability in WebDAV that could allow elevation of privilege through improper handling of memory. | | [MS16-032](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032) | Vulnerability in Secondary Logon process that could allow elevation of privilege by running a specially crafted application. | | [MS16-034](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-034) | Vulnerabilities in Windows Kernel-Mode Driver that could allow elevation of privilege due to the way kernel-mode drivers handle objects in memory. | | [MS16-135](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135) | Vulnerability in Windows Kernel-Mode Drivers that could allow elevation of privilege due to improper handling of certain types of objects in memory. | | [CVE-2017-7199](https://www.cve.org/CVERecord?id=CVE-2017-7199) | A privilege escalation vulnerability in Windows due to the way certain applications handle process tokens. | | [CVE-2019-0836](https://www.cve.org/CVERecord?id=CVE-2019-0836) | | An elevation of privilege vulnerability in Windows due to the way the Win32k component handles objects in memory. | | [CVE-2019-0836](https://www.cve.org/CVERecord?id=CVE-2019-0836) | Elevation of privilege vulnerability in Windows AppX Deployment Server, allowing attackers to overwrite system files. | | [CVE-2019-1064](https://www.cve.org/CVERecord?id=CVE-2019-1064) | An elevation of privilege vulnerability in Windows due to improper handling of symbolic links. | | [CVE-2019-1130](https://www.cve.org/CVERecord?id=CVE-2019-1130) | An elevation of privilege vulnerability in Windows due to the way the Windows CSRSS handles certain requests. | | [CVE-2019-1253](https://www.cve.org/CVERecord?id=CVE-2019-1253) |Elevation of privilege vulnerability in Windows AppX Deployment Server due to improper permissions settings. | | [CVE-2019-1315](https://www.cve.org/CVERecord?id=CVE-2019-1315) | An elevation of privilege vulnerability in Windows Error Reporting (WER) due to improper handling of hard links. | | [CVE-2019-1385](https://www.cve.org/CVERecord?id=CVE-2019-1385) | Elevation of privilege vulnerability due to improper handling of objects in memory in Windows. | | [CVE-2019-1388](https://www.cve.org/CVERecord?id=CVE-2019-1388) | A vulnerability in Windows UAC that allows bypassing of the UAC dialog, leading to elevation of privilege. | | [CVE-2019-1405](https://www.cve.org/CVERecord?id=CVE-2019-1405) | An elevation of privilege vulnerability in Windows UPnP Service due to improper handling of objects in memory. | | [CVE-2020-0668](https://www.cve.org/CVERecord?id=CVE-2020-0668) | An elevation of privilege vulnerability due to improper handling of symbolic links in Windows. | | [CVE-2020-0683](https://www.cve.org/CVERecord?id=CVE-2020-0683) | Elevation of privilege vulnerability in Windows due to improper handling of file paths. | | [CVE-2020-0796](https://www.cve.org/CVERecord?id=CVE-2020-0796) | A remote code execution vulnerability in SMBv3 known as 'SMBGhost'. | | [CVE-2020-1013](https://www.cve.org/CVERecord?id=CVE-2020-1013) | A local privilege escalation vulnerability in Windows Update Orchestrator Service. | | [CVE-2020-1013](https://www.cve.org/CVERecord?id=CVE-2020-1013) | PrintNightmare, a remote code execution vulnerability in Windows Print Spooler. | | [CVE-2021-26855](https://www.cve.org/CVERecord?id=CVE-2021-26855) | ProxyLogon - A server-side request forgery (SSRF) vulnerability in Exchange Server allowing remote code execution. | | [CVE-2021-26857](https://www.cve.org/CVERecord?id=CVE-2021-26857) | A vulnerability in Exchange Server that could allow an attacker to perform remote code execution. | | [CVE-2021-26858](https://www.cve.org/CVERecord?id=CVE-2021-26858) | A post-authentication arbitrary file write vulnerability in Exchange Server. | | [CVE-2021-27065](https://www.cve.org/CVERecord?id=CVE-2021-27065) | A post-authentication arbitrary file write vulnerability in Exchange Server could lead to remote code execution. | | [CVE-2021-44228](https://www.cve.org/CVERecord?id=CVE-2021-44228) | Log4Shell, a remote code execution vulnerability in Apache Log4j. | | [CVE-2021-36934](https://www.cve.org/CVERecord?id=CVE-2021-36934) | HiveNightmare - A vulnerability that allows for local privilege escalation due to overly permissive Access Control Lists (ACLs) on system files, including the Security Accounts Manager (SAM). | | [CVE-2022-34718](https://www.cve.org/CVERecord?id=CVE-2022-34718) | Windows TCP/IP Remote Code Execution Vulnerability. | | [CVE-2022-40140](https://www.cve.org/CVERecord?id=CVE-2022-40140) | A vulnerability in Microsoft Exchange Server leading to remote code execution. | | [CVE-2022-22965](https://www.cve.org/CVERecord?id=CVE-2022-22965) | Spring4Shell, a remote code execution vulnerability in Spring Framework. | | [CVE-2023-36664](https://www.cve.org/CVERecord?id=CVE-2023-36664) | Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the pipe character prefix). | | [CVE-2023-23397](https://www.cve.org/CVERecord?id=CVE-2023-23397) | Microsoft Outlook Elevation of Privilege Vulnerability. |", Assign "at most 3 tags" to the expected json: {"id":"6810","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"