GhostPack Seatbelt
Overview
GhostPack Seatbelt is part of GhostPack, a collection of post-exploitation tools designed for use in Windows environments.
Seatbelt is a tool that performs an enumeration of a system's security configurations and collects information about user accounts, permissions, and other system details. It's primarily used to gather information after gaining access to a system in a penetration test or malicious attack.
Resources
Description
GhostPack contains different toolsets of C# implementations of PowerShell functionality. It includes Seatbelt, SharpUp, SharpRoast, SharpDump, SafetyKatz, and SharpWMI. Seatbelt is a C# project that performs several security-oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
Attackers use Seatbelt to collect host information including PowerShell security settings, Kerberos tickets, and items in Recycle Bin. Using Seatbelt, attackers perform security checks to find insecurities, which can be exploited to launch active attacks on the host network.
Command Groups
Seatbelt has the following command groups: All, User, System, Slack, Chromium, Remote, and Misc.
Invoke command groups using the command Seatbelt.exe <group>.
All Commands Group
| Command | Description |
Seatbelt.exe -group=all | Runs all the commands |
User Commands Group
| Command | Description |
Seatbelt.exe -group=user | Retrieves information by executing the following commands: ChromiumPresence, CloudCredentials, CloudSyncProviders, CredEnum, dir, DpapiMasterKeys, ExplorerMRUs, ExplorerRunCommands, FileZilla, FirefoxPresence, IdleTime, IEFavorites, IETabs, IEUrls, KeePass, MappedDrives, OfficeMRUs, OracleSQLDeveloper, PowerShellHistory, PuttyHostKeys, PuttySessions, RDCManFiles, RDPSavedConnections, SecPackageCreds, SlackDownloads, SlackPresence, SlackWorkspaces, SuperPutty, TokenGroups, WindowsCredentialFiles, WindowsVault |
System Commands Group
| Command | Description |
Seatbelt.exe -group=system | Retrieves information by executing the following commands: AMSIProviders, AntiVirus, AppLocker, ARPTable, AuditPolicies, AuditPolicyRegistry, AutoRuns, CredGuard, DNSCache, DotNet, EnvironmentPath, EnvironmentVariables, Hotfixes, InterestingProcesses, InternetSettings, LAPS, LastShutdown, LocalGPOs, LocalGroups, LocalUsers, LogonSessions, LSASettings, McAfeeConfigs, NamedPipes, NetworkProfiles, NetworkShares, NTLMSettings, OSInfo, PoweredOnEvents, PowerShell, Processes, PSSessionSettings, RDPSessions, RDPsettings, SCCM, Services, Sysmon, TcpConnections, TokenPrivileges, UAC, UdpConnections, UserRightAssignments, WindowsAutoLogon, WindowsDefender, WindowsEventForwarding, WindowsFirewall, WMIEventConsumer, WMIEventFilter, WMIFilterBinding, WSUS |
Slack Commands Group
| Command | Description |
Seatbelt.exe -group=slack | Retrieves information by executing the following commands: SlackDownloads, SlackPresence, SlackWorkspaces |
Chromium Commands Group
| Command | Description |
Seatbelt.exe -group=chromium | Retrieves information by executing the following commands: ChromiumBookmarks, ChromiumHistory, ChromiumPresence |
Remote Commands Group
| Command | Description |
Seatbelt.exe -group=remote | Retrieves information by executing the following commands: AMSIProviders, AntiVirus, AuditPolicyRegistry, ChromiumPresence, CloudCredentials, DNSCache, DotNet, DpapiMasterKeys, EnvironmentVariables, ExplicitLogonEvents, ExplorerRunCommands, FileZilla, Hotfixes, InterestingProcesses, KeePass, LastShutdown, LocalGroups, LocalUsers, LogonEvents, LogonSessions, LSASettings, MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings, OSInfo, PoweredOnEvents, PowerShell, ProcessOwners, PSSessionSettings, PuttyHostKeys, PuttySessions, RDPSavedConnections, RDPSessions, RDPsettings, Sysmon, WindowsDefender, WindowsEventForwarding, WindowsFirewall |
Misc Commands Group
| Command | Description |
Seatbelt.exe -group=misc | Retrieves information by executing the following commands: ChromiumBookmarks, ChromiumHistory, ExplicitLogonEvents, FileInfo, FirefoxHistory, InstalledProducts, InterestingFiles, LogonEvents, LOLBAS, McAfeeSiteList, MicrosoftUpdates, OutlookDownloads, PowerShellEvents, Printers, ProcessCreationEvents, ProcessOwners, RecycleBin, reg, RPCMappedEndpoints, ScheduledTasks, SearchIndex, SecurityPackages, SysmonEvents |
Additional Command Options
| Command | Description |
Seatbelt.exe <Command> [Command2]... | Runs one or more specified commands |
Seatbelt.exe <Command> -full | Retrieves complete results for a command without any filtering |
Seatbelt.exe <Command> -computername=COMPUTER.DOMAIN.COM [-username=DOMAIN\USER -password=PASSWORD] | Runs one or more specified commands remotely |
Seatbelt.exe -group=system -outputfile="C:\Temp\out.txt" | Runs system checks and outputs to a .txt file |