ghostpack / seatbelt Goto Github PK

Describe the bug
When running the PSSessionSettings command, it failed with the following exception:

====== PSSessionSettings ======

  Name : Microsoft.PowerShell
    BUILTIN\Administrators                 AccessAllowed      

ERROR:   [!] Terminating exception running command 'PSSessionSettings': System.ArgumentNullException: Value cannot be null.
Parameter name: s
   at System.IO.StringReader..ctor(String s)
   at System.Xml.XmlDocument.LoadXml(String xml)
   at Windows.PSSessionSettingsCommand.<Execute>d__10.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

To Reproduce
I don't have access to a system where I can reproduce the first error . Occurred when running the PSSessionSettings command on a Windows 7 Enterprise system.

Expected behavior
The module to run and display this PS session settings or not display anything at all

Observed behavior
An exception was thrown

Describe the bug
An exception is being thrown during the IETabs command:

ERROR:   [!] Terminating exception running command 'IETabs': System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Runtime.InteropServices.COMException: The server process could not be started because the configured identity is incorrect. Check the username and password. (Exception from HRESULT: 0x8000401A)
   --- End of inner exception stack trace ---
   at System.RuntimeType.InvokeDispMethod(String name, BindingFlags invokeAttr, Object target, Object[] args, Boolean[] byrefModifiers, Int32 culture, String[] namedParameters)
   at System.RuntimeType.InvokeMember(String name, BindingFlags bindingFlags, Binder binder, Object target, Object[] providedArgs, ParameterModifier[] modifiers, CultureInfo culture, String[] namedParams)
   at Seatbelt.Commands.Browser.InternetExplorerTabCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs.
Looks like it may manifest itself on 2012 R2 machines. Might also occur after performing lateral movement to a host using WMI or WinRM.

Another error also happens when logged in as a user and you use runas to start a command prompt (not with /netonly) and then run the IETabs command:

ERROR:   [!] Terminating exception running command 'IETabs': System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.UnauthorizedAccessException: Access is denied.

   --- End of inner exception stack trace ---
   at System.RuntimeType.InvokeDispMethod(String name, BindingFlags invokeAttr, Object target, Object[] args, Boolean[] byrefModifiers, Int32 culture, String[] namedParameters)
   at System.RuntimeType.InvokeMember(String name, BindingFlags bindingFlags, Binder binder, Object target, Object[] providedArgs, ParameterModifier[] modifiers, CultureInfo culture, String[] namedParams)
   at System.Type.InvokeMember(String name, BindingFlags invokeAttr, Binder binder, Object target, Object[] args)
   at Seatbelt.Commands.Browser.InternetExplorerTabCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

Occurs even if the directory you're in is writable.

To Reproduce
Run Seatbelt's IETabs command.

Expected behavior
The command to run, displaying any tabs, or a notification saying that there aren't any or it's not possible to run this command.

Observed behavior
An exception occurs.

Describe the bug
When "Use FIPS compliant algorithms for encryption, hashing, and signing" is enabled on the system (you can check this with the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy, and if Enabled = 1), Seatbelt throws the following exception:

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.RijndaelManaged..ctor()

To Reproduce
Steps to reproduce the behavior. Please include any applicable artifacts that we could use to replicate the issue(e.g. files, registry keys, screenshots, etc.)

1. Enable the GPO "Use FIPS compliant algorithms for encryption, hashing, and signing"
2. Run Seatbealt running all modules

Expected behavior
Seatbelt should run successfully

Observed behavior
Errors with

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.RijndaelManaged..ctor()

Additional Context
See https://github.com/GhostPack/Rubeus/pull/66/files

Describe the bug
An exception is being thrown during the OSInfo command:

====== OSInfo ======

ERROR:   [!] Terminating exception running command 'OSInfo': System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
   at Seatbelt.Runtime.GetEnvironmentVariable(String variableName)
   at Seatbelt.Commands.Windows.OSInfoCommand.<Execute>d__10.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs. Occurred during remote collection. Other commands that used the registry worked fine, but this one didn't for whatever reason.

To Reproduce
seatbelt.exe -q -group=remote -computername=COMPUTER

Expected behavior
The command to run and return OS information. If it can't, collect one piece of info, at least return a partial result (or print an error where the problem happened)

Observed behavior
An exception occurs and no command output is recieved

The LICENSE file states Rubeus. Should be Seatbelt.

I was wondering if it was possible to run this complied .exe binary on a Windows system which doesnt have .NET 3.5 framework installed. My inital thoughts is no but just wanted to reach out for a definitive answer.

Windows has localized names for well-known groups in some locales (for example French or German).
The "Local Group Memberships" section does not implement those and therefore fails on such localized Windows versions.

Describe the bug
An exception is being thrown during the InterestingProcesses command:

ERROR:   [!] Terminating exception running command 'InterestingProcesses': System.Management.ManagementException: Not found 
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementObject.InvokeMethod(String methodName, ManagementBaseObject inParameters, InvokeMethodOptions options)
   at System.Management.ManagementObject.InvokeMethod(String methodName, Object[] args)
   at Seatbelt.Commands.Windows.InterestingProcessesCommand.<Execute>d__10.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs.
Looks like it may manifest itself on 2012 R2 machines. Might also occur after performing lateral movement to a host using WMI or WinRM.

Looks like it might be caused when obtaining the process owner (that's the only place a WMI method is invoked)

To Reproduce
Run Seatbelt's InterestingProcesses command.

Expected behavior
The command to run, displaying interesting process, or a notification saying that there aren't any or it's not possible to run this command.

Observed behavior
Some processes are output, but then the process listing is cut short due to an exception

username是字符串吗？还是路径？
password的问题一样。

Prologue:

• Compiled seatbelt in a win10 +VS community (no AV, AMSI, etc.)
• The standalone EXE works fine
• Invoke-ReflectedPEInject works fine with a simple calc.exe
• With Seatbelt.exe I get the following errors with both versions of powershell.exe (32/64bit)

Probably an issue with the reference ?

Error 1 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 62 42 Seatbelt
Error 2 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 81 47 Seatbelt
Error 3 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 805 50 Seatbelt
Error 4 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 841 44 Seatbelt
Error 5 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 871 43 Seatbelt
Error 6 Type byte, sbyte, short, ushort, int, uint, long, or ulong expected E:\pentest\Seatbelt\Seatbelt\Program.cs 886 41 Seatbelt
Error 7 { expected E:\pentest\Seatbelt\Seatbelt\Program.cs 4319 44 Seatbelt
Error 8 ; expected E:\pentest\Seatbelt\Seatbelt\Program.cs 4319 100 Seatbelt
Error 9 } expected E:\pentest\Seatbelt\Seatbelt\Program.cs 4322 14 Seatbelt
Error 10 The name 'when' does not exist in the current context E:\pentest\Seatbelt\Seatbelt\Program.cs 4319 44 Seatbelt

Hi there,

Would it be possible to incorporate support for the connections.xml file that Oracle SQLDeveloper will drop, containing hostnames and credentials? Often useful for onward lateral movement.

I believe it is stored in:
\Users[User]\AppData\Roaming\SQL Developer\System\

but also often under a subfolder such as:

(Win 7)
C:\Users\<username>\AppData\Roaming\SQL Developer\systemX.X.X.X.X\o.jdeveloper.db.connection.X.X.X.X.X.X.X\connections.xml
or
“C:\users\USER\AppData\Roaming\SQL Developer\system3.1.07.42\o.jdeveloper.db.connection.11.1.1.4.37.59.48”.

They can also be decrypted using something similar to this:
https://pypi.org/project/sqldeveloperpassworddecryptor/

If I figure out how to do it within the code, I'll do a PR, but thought I'd submit this issue so that others can see it also.

When running the ChromiumHistory command i get the following error:
ERROR: IO exception, history file likely in use (i.e. browser is likely running): The process cannot access the file ...

This line is where it fails:

using (var fs = new FileStream(userChromiumHistoryPath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
using (var r = new StreamReader(fs)){ ...

The link in Readme.md below Compile Instructions points to Visual Studio Community Edition version 2015, this does not recognize the used version C# 8.0 in config. It will throw the error "CS1617 C# Invalid option for /langversion" as it only recognizes version 1 through 6.

I would recommend linking to https://visualstudio.microsoft.com/downloads/, this gives the option for Visual Studio 2019.

Describe the bug
PowerShellHistory was failing with the following error:

ERROR:   [!] Terminating exception running command 'PowerShellHistory': System.ArgumentOutOfRangeException: StartIndex cannot be less than zero.
Parameter name: startIndex
   at System.String.Substring(Int32 startIndex, Int32 length)
   at Windows.PowerShellHistoryCommand.<Execute>d__10.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

Not sure what was causing it and don't have the ConsoleHost_history.txt to troubleshoot

To Reproduce
Run Seatbelt.exe -q PowerShellHistory

Expected behavior
For the command to run and no errors be thrown

Observed behavior
An exception was thrown due to string parsing bugs

Not sure is this is known issue but I see multiple errors when enumerating WindowsVault

ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented
ERROR: Exception: VAULT_ELEMENT_TYPE 'ByteArray' is currently unimplemented

The README states that:

SeatBelt.exe all will run ALL enumeration checks, can be combined with full.

And the blog post states that:

SeatBelt.exe [system/user/all/CheckName] full will prevent any filtering and will return complete results.

However something seems wrong with the arguments parsing since neither Seatbelt.exe all full nor Seatbelt.exe full all work. Both generate the Check "all" not found! error.

.\sb.exe powershell

                    %&&@@@&&
                    &&&&&&&%%%,                       #&&@@@@@@%%%%%%###############%
                    &%&   %&%%                        &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%%

%%%%%%%%%%%######%%%#%%####% &%%**# @////(((&%%%%%%######################(((((((((((((((((((
#%#%%%%%%%#######%#%%####### %&%,,,,,,,,,,,,,,,, @////(((&%%%%%#%#####################(((((((((((((((((((
#%#%%%%%%#####%%#%#%%####### %%%,,,,,, ,,. ,, @////(((&%%%%%%%######################(#(((#(#((((((((((
#####%%%#################### &%%...... ... .. @////(((&%%%%%%%###############%######((#(#(####((((((((
#######%##########%######### %%%...... ... .. @////(((&%%%%%#########################(#(#######((#####
###%##%%#################### &%%............... @////(((&%%%%%%%%##############%#######(#########((#####
#####%###################### %%%.. @////(((&%%%%%%%################
&%& %%%%% Seatbelt %////(((&%%%%%%%%#############*
&%%&&&%%%%% v1.1.1 ,(((&%%%%%%%%%%%%%%%%%,
#%%%%##,

====== PowerShell ======

ERROR: [!] Terminating exception running command 'PowerShell': System.FormatException: Input string was not in a correct format.
at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
at Seatbelt.Commands.Windows.PowerShellCommand.d__14.MoveNext()
at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

[*] Completed collection in 5.54 seconds

Describe the bug
When running the CredEnum command, it failed with the following exception:

ERROR:   [!] Terminating exception running command 'CredEnum': System.ComponentModel.Win32Exception (0x80004005): Element not found
   at Windows.CredEnumCommand.<Execute>d__9.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

It looks like it may be accessing an array incorrectly?

Another error:

ERROR:   [!] Terminating exception running command 'CredEnum': System.ComponentModel.Win32Exception (0x80004005): A specified logon session does not exist. It may already have been terminated
   at Seatbelt.Commands.Windows.CredEnumCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

To Reproduce
I don't have access to a system where I can reproduce the first error . Occurred when running the CredEnum command.

The 2nd exception be reproduced by running the CredEnum command under a command prompt started with runas /netonly /user:asdf\asdf cmd.exe

Expected behavior
The module to run and dump creds, or not print anything (or a message saying there weren't any)

Observed behavior
An exception was thrown

MSBuild complains when I try to compile latest version from git in .net 4.5:

  Commands\Misc\LOLBAS.cs(130,27): error CS8618: Non-nullable property 'Path' is uninitialized. Consider declaring the property as nullable. [D:\a\1\s\Seatbelt\Seatbelt.csproj]

Without the LOLBAS module it compiles fine. Probably not that hard to fix but I don't have a VS env and git setup nearby to test and create a PR. Thx for the work on this!

Describe the bug
When running the SearchIndex command, it failed with the following exception:

ERROR:   [!] Terminating exception running command 'SearchIndex': System.InvalidOperationException: The 'Search.CollatorDSO' provider is not registered on the local machine.
   at System.Data.OleDb.OleDbServicesWrapper.GetDataSource(OleDbConnectionString constr, DataSourceWrapper& datasrcWrapper)
   at System.Data.OleDb.OleDbConnectionInternal..ctor(OleDbConnectionString constr, OleDbConnection connection)
   at System.Data.OleDb.OleDbConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningObject)
   at System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource`1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection)
   at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource`1 retry, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionInternal.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
   at System.Data.OleDb.OleDbConnection.Open()
   at SearchIndexCommand.<SearchWindowsIndex>d__9.MoveNext()
   at SearchIndexCommand.<Execute>d__10.MoveNext()
   at Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

To Reproduce
I don't have access to a system where the error occurred . Occurred when running the SearchIndex command.

Occurred on a Server 2012 R2 machine after pivoting via WMI event subs

Expected behavior
The module to run and return matching or not print anything or print a message saying the searchindexer isn't available

Observed behavior
An exception was thrown

When running seatbelt.exe all on a machine it consistently errored out when encountering file names that were at the maximum permissible length in windows.

The following error was thrown

Unhandled Exception: System.IO.PathTooLongException: The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.
at System.IO.Path.SafeSetStackPointerValue(Char* buffer, Int32 index, Char value)
at System.IO.Path.NormalizePathFast(String path, Boolean fullCheck)
at System.IO.File.GetLastAccessTimeUtc(String path)
at Seatbelt.Program.ListInterestingFiles()
at Seatbelt.Program.Main(String[] args)

If the program can skip (and maybe count how many files are skipped) without crashing that would be desirable behavior. Alternately, handling the unusually long values and parsing them the same would be ideal.

Using the latest version of Seatbelt and compiled locally.

Related: def4ef3
#9

Thanks,

Build started...
1>------ Build started: Project: Seatbelt, Configuration: Debug Any CPU ------
1>C:\Users\Lalit\Source\Repos\Seatbelt\Seatbelt\Commands\Misc\LOLBAS.cs(130,27,130,31): error CS8618: Non-nullable property 'Path' must contain a non-null value when exiting constructor. Consider declaring the property as nullable.
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

WriteVerbose($"Found: {query.Count()} LOLBAS");
WriteHost("\nTo see how to use the LOLBAS that were found go to https://lolbas-project.github.io/");
}

    internal class LolbasDTO : CommandDTOBase
    {

line 130: public string Path { get; set; }

=== Interesting Files (All Users) ===

Unhandled Exception: System.IO.PathTooLongException: The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.
at System.IO.Path.SafeSetStackPointerValue(Char* buffer, Int32 index, Char value)
at System.IO.Path.NormalizePathFast(String path, Boolean fullCheck)
at System.IO.Path.GetDirectoryName(String path)
at System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
at System.IO.Directory.GetFiles(String path, String searchPattern, SearchOption searchOption)
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1362
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.FindFiles(String path, String patterns) in C:\git\Seatbelt\Seatbelt\Program.cs:line 1364
at Seatbelt.Program.ListInterestingFiles() in C:\git\Seatbelt\Seatbelt\Program.cs:line 5446
at Seatbelt.Program.Main(String[] args) in C:\git\Seatbelt\Seatbelt\Program.cs:line 5735

Please, could You release a x86 and x86-64 version? Thank You

Hi 👋
itm4n released a new blog post about misconfiguration that could lead to exploiting PrintNightmare.

The blog: https://itm4n.github.io/printnightmare-exploitation/
itm4n's powershell implementation: itm4n/PrivescCheck@f555354

Detecting misconfiguration:

• Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint RestrictDriverInstallationToAdministrators -> 0
• Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall -> 1
• Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint UpdatePromptSettings -> 2

Describe the bug
An exception is being thrown during the OfficeMRUs command:

ERROR:   [!] Terminating exception running command 'OfficeMRUs': System.InvalidCastException: Unable to cast object of type 'System.Int32' to type 'System.String'.
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<GetMRUsValues>d__12.MoveNext()
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<GetMRUsFromVersionKey>d__11.MoveNext()
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<EnumRecentOfficeFiles>d__10.MoveNext()
   at System.Linq.Buffer`1..ctor(IEnumerable`1 source)
   at System.Linq.OrderedEnumerable`1.<GetEnumerator>d__1.MoveNext()
   at Seatbelt.Commands.Windows.OfficeMRUsCommand.<Execute>d__9.MoveNext()
   at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

I don't have access to a host where it occurs.
Looks like it may manifest itself on 2012 R2 machines. Might also occur after performing lateral movement to a host using WMI or WinRM.

To Reproduce
Run Seatbelt's OfficeMRUs command.

Expected behavior
The command to run, displaying an MRUs, or a notification saying that there aren't any.

Observed behavior
An exception occurs.

Expect behaviour

hotfixes command returns a list of applied hotfixes

Actual behaviour

The following error is returned. This has been tested against Windows 10 (local + remote), Windows Server 2003 (remote), Widows Server 2012r2 (remote)

====== Hotfixes ======

Enumerating Windows Hotfixes. For all Microsoft updates, use the 'MicrosoftUpdates' command.

ERROR: [!] Terminating exception running command 'Hotfixes': System.FormatException: String was not recognized as a valid DateTime.
at System.DateTimeParse.Parse(String s, DateTimeFormatInfo dtfi, DateTimeStyles styles)
at System.Convert.ToDateTime(String value)
at Seatbelt.Commands.Windows.HotfixCommand.d__10.MoveNext()
at Seatbelt.Runtime.ExecuteCommand(CommandBase command, String[] commandArgs)

Steps to reproduce

.\seatbelt.exe hotfixes

Thank you very much for this brilliant tools, by the way :D

Describe the bug

Maybe not fair to call this a bug, but Seatbelt calls Environment.Exit() here:
https://github.com/GhostPack/Seatbelt/blob/master/Seatbelt/Runtime.cs#L77

When Seatbelt is being run via (or integrated into) a tool/implant like Covenant's Grunt that runs the assembly within the implant's process (i.e. no fork & run) - it will cause the whole implant to exit when this exception is caught.

It would be nicer to orchestrate a way of gracefully returning so we can drop out of the assembly without explicitly calling this exit method.

To Reproduce

1. Start a Grunt.
2. Run Seatbelt with some remote enumeration options that will fail, e.g: Seatbelt -group=remote -computername=something.local -username=DOMAIN\fake -password=DoesNotMatter.
3. Watch the Grunt exit.