Pearson's OSCP Notebook

winExploitSuggester

Properties1
tagswinexploitsuggester, windows-exploit-suggester, privilege-escalation, systeminfo, windows, kernel-exploit, oscp

3 min read

winExploitSuggester — Windows Exploit Suggester

windows-exploit-suggester.py (often called winExploitSuggester) compares systeminfo output from a Windows host against Microsoft’s security bulletin database and lists missing patches with known public exploits [E] or Metasploit modules [M].

Ctrl+F: winExploitSuggester · windows-exploit-suggester · systeminfo · --local · --update · hotfixes

When: Low Windows shell, WinPEAS done, looking for kernel / missing-patch privesc. Run on Kali only — never on the target.

Repo: GDSSecurity/Windows-Exploit-Suggester · fork: Windows-Exploit-Suggester-v2

Linux equivalent → linux-exploit-suggester

Alternatives: Privesc Tools (WinPEAS) · Windows PrivEsc (manual) · searchsploit

Install (Kali)

git clone https://github.com/GDSSecurity/Windows-Exploit-Suggester.git
cd Windows-Exploit-Suggester
 
pip3 install xlrd --upgrade --break-system-packages    # Excel DB parser
 
# Download / refresh MS bulletin database (run periodically)
python3 windows-exploit-suggester.py --update
# Creates e.g. 2024-06-07-mssb.xls

Full install index → Installation - Kali Setup > 📌 Privilege escalation

📌 1) Target — collect systeminfo

systeminfo > C:\Temp\systeminfo.txt

If hotfix list shows File 1 or is empty, also run:

wmic qfe list full > C:\Temp\hotfixes.txt

Transfer to Kali → File Transfer

📌 2) Run analysis on Kali

python3 windows-exploit-suggester.py --database 2024-06-07-mssb.xls --systeminfo systeminfo.txt
 
# Privesc only (filter remote noise)
python3 windows-exploit-suggester.py --database 2024-06-07-mssb.xls --systeminfo systeminfo.txt --local
 
# If systeminfo hotfixes broken — add wmic output
python3 windows-exploit-suggester.py --database 2024-06-07-mssb.xls --systeminfo systeminfo.txt --hotfixes hotfixes.txt

Output markers:

MarkerMeaning
[E]ExploitDB / public PoC
[M]Metasploit module
[*]Missing bulletin (no known public exploit listed)

Cross-check hits with searchsploit and MetaSploit before running exploits.

CLI flags

FlagPurpose
--updateDownload latest MS bulletin .xls database
--database FILEPath to DATE-mssb.xls
--systeminfo FILETarget systeminfo output
--hotfixes FILEwmic qfe output if hotfixes missing in systeminfo
--localFilter to local privesc only (skip remote/IIS noise)

📌 3) Workflow

Low-priv Windows shell
    ↓
WinPEAS / manual enum ([[Windows PrivEsc]] · [[Every Box - Manual Workflow]])
    ↓
systeminfo > systeminfo.txt → transfer to Kali
    ↓
windows-exploit-suggester.py --database DATE-mssb.xls --systeminfo systeminfo.txt --local
    ↓
searchsploit / MSF module → test in lab

Also in Privesc Tools > 📌 2b) winExploitSuggester · Windows PrivEsc > 📌 0) Automated Enumeration Tools

📌 Quick Cheat Sheet

# Target
systeminfo > systeminfo.txt
wmic qfe list full > hotfixes.txt    # if needed
 
# Kali
python3 windows-exploit-suggester.py --update
python3 windows-exploit-suggester.py --database DATE-mssb.xls --systeminfo systeminfo.txt --local

Notes

  • False positives are common — verify OS version/build and exploit requirements manually.
  • Database must be updated periodically (--update) — old .xls misses recent bulletins.
  • OSCP boxes are often fully patched — treat output as hints, not a hit list. Pair with Potato Attacks, service abuse, and Windows PrivEsc checklist.

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks