new-check(winpeas): add high-impact vulnerability detection (#767)

Co-authored-by: HackTricks PEASS New-Check Agent <[email protected]>

winPEAS/winPEASexe/Tests/DefenderEngineCve41091Tests.cs

@@ -0,0 +1,40 @@
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using winPEAS.Info.SystemInfo.WindowsDefender;
+
+namespace winPEAS.Tests
+{
+    [TestClass]
+    public class DefenderEngineCve41091Tests
+    {
+        [TestMethod]
+        public void VersionsBeforeTheMicrosoftFixedFloorAreCandidates()
+        {
+            Assert.AreEqual(DefenderCve41091Status.Candidate,
+                WindowsDefender.AssessCve41091Engine("1.1.26030.3008"));
+            Assert.AreEqual(DefenderCve41091Status.Candidate,
+                WindowsDefender.AssessCve41091Engine("1.1.26040.7"));
+        }
+
+        [TestMethod]
+        public void FixedFloorAndNewerEnginesAreFixed()
+        {
+            Assert.AreEqual(DefenderCve41091Status.Fixed,
+                WindowsDefender.AssessCve41091Engine("1.1.26040.8"));
+            Assert.AreEqual(DefenderCve41091Status.Fixed,
+                WindowsDefender.AssessCve41091Engine("1.1.26050.11"));
+        }
+
+        [TestMethod]
+        public void MissingUnloadedAndMalformedVersionsRemainUnknown()
+        {
+            foreach (string version in new[]
+            {
+                null, "", "0.0.0.0", "1.1.26040", "1.1.26040.8.1", "not-a-version"
+            })
+            {
+                Assert.AreEqual(DefenderCve41091Status.Unknown,
+                    WindowsDefender.AssessCve41091Engine(version), version ?? "null");
+            }
+        }
+    }
+}

winPEAS/winPEASexe/Tests/winPEAS.Tests.csproj

@@ -169,6 +169,7 @@
     <Compile Include="Pdf24RepairPrerequisitesTests.cs" />
     <Compile Include="FirefoxCredentialFilePathTests.cs" />
     <Compile Include="PrinterDriverAclReviewTests.cs" />
+    <Compile Include="DefenderEngineCve41091Tests.cs" />
     <Compile Include="DefenderPathExclusionDisplayTests.cs" />
     <Compile Include="StorvspVsmbRuntimeTests.cs" />
     <Compile Include="SearchHelperRuntimeTests.cs" />

winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs

@@ -1893,6 +1893,38 @@ namespace winPEAS.Checks
         {
             Beaprint.MainPrint("Windows Defender configuration", "T1518.001");
 
+            Beaprint.ColorPrint("  Defender engine CVE-2026-41091", Beaprint.LBLUE);
+            Beaprint.LinkPrint(
+                "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091",
+                "Actively exploited link-following LPE; Microsoft fixed the engine in 1.1.26040.8");
+
+            var engineInfo = WindowsDefender.GetDefenderEngineInfo();
+            var engineStatus = WindowsDefender.AssessCve41091Engine(engineInfo?.EngineVersion);
+            if (engineStatus == DefenderCve41091Status.Candidate && engineInfo.ServiceEnabled == true)
+            {
+                Beaprint.BadPrint("    Microsoft Defender engine " + engineInfo.EngineVersion +
+                    " predates the CVE-2026-41091 fix and the antimalware service is enabled. This is a local SYSTEM escalation candidate; update the Defender engine.");
+            }
+            else if (engineStatus == DefenderCve41091Status.Candidate && engineInfo.ServiceEnabled == false)
+            {
+                Beaprint.InfoPrint("    Microsoft Defender engine " + engineInfo.EngineVersion +
+                    " predates the CVE-2026-41091 fix, but WMI reports the antimalware service disabled. Exposure is not confirmed; update before enabling Defender.");
+            }
+            else if (engineStatus == DefenderCve41091Status.Candidate)
+            {
+                Beaprint.InfoPrint("    Microsoft Defender engine " + engineInfo.EngineVersion +
+                    " predates the CVE-2026-41091 fix, but service state is unavailable. Verify that Defender is active and update the engine.");
+            }
+            else if (engineStatus == DefenderCve41091Status.Fixed)
+            {
+                Beaprint.GoodPrint("    Microsoft Defender engine " + engineInfo.EngineVersion +
+                    " is at or above the CVE-2026-41091 fixed version (1.1.26040.8).");
+            }
+            else
+            {
+                Beaprint.GrayPrint("    Defender engine version unavailable or unparsable; CVE-2026-41091 status is unknown.");
+            }
+
             void DisplayDefenderSettings(WindowsDefenderSettings settings)
             {
                 var pathExclusions = settings.PathExclusions;

winPEAS/winPEASexe/winPEAS/Info/SystemInfo/WindowsDefender/WindowsDefender.cs

@@ -1,7 +1,25 @@
-namespace winPEAS.Info.SystemInfo.WindowsDefender
+using System;
+using System.Management;
+
+namespace winPEAS.Info.SystemInfo.WindowsDefender
 {
+    internal enum DefenderCve41091Status
+    {
+        Unknown,
+        Candidate,
+        Fixed
+    }
+
+    internal sealed class DefenderEngineInfo
+    {
+        public string EngineVersion { get; set; }
+        public bool? ServiceEnabled { get; set; }
+    }
+
     internal class WindowsDefender
     {
+        private static readonly Version Cve41091FixedEngine = new Version(1, 1, 26040, 8);
+
         public static WindowsDefenderSettingsInfo GetDefenderSettingsInfo()
         {
             return new WindowsDefenderSettingsInfo(
@@ -9,5 +27,61 @@
                 new WindowsDefenderSettings(@"SOFTWARE\Policies\Microsoft\Windows Defender\")
             );
         }
+
+        internal static DefenderCve41091Status AssessCve41091Engine(string engineVersion)
+        {
+            if (string.IsNullOrWhiteSpace(engineVersion))
+                return DefenderCve41091Status.Unknown;
+
+            string value = engineVersion.Trim();
+            if (value.Split('.').Length != 4)
+                return DefenderCve41091Status.Unknown;
+
+            Version parsed;
+            if (!Version.TryParse(value, out parsed) || parsed.Equals(new Version(0, 0, 0, 0)))
+                return DefenderCve41091Status.Unknown;
+
+            return parsed.CompareTo(Cve41091FixedEngine) < 0
+                ? DefenderCve41091Status.Candidate
+                : DefenderCve41091Status.Fixed;
+        }
+
+        public static DefenderEngineInfo GetDefenderEngineInfo()
+        {
+            try
+            {
+                var scope = new ManagementScope(@"\\.\root\Microsoft\Windows\Defender");
+                var query = new ObjectQuery("SELECT AMEngineVersion, AMServiceEnabled FROM MSFT_MpComputerStatus");
+                var options = new EnumerationOptions
+                {
+                    ReturnImmediately = true,
+                    Rewindable = false
+                };
+
+                using (var searcher = new ManagementObjectSearcher(scope, query, options))
+                using (var results = searcher.Get())
+                {
+                    foreach (ManagementObject status in results)
+                    {
+                        using (status)
+                        {
+                            return new DefenderEngineInfo
+                            {
+                                EngineVersion = Convert.ToString(status["AMEngineVersion"]),
+                                ServiceEnabled = status["AMServiceEnabled"] == null
+                                    ? (bool?)null
+                                    : Convert.ToBoolean(status["AMServiceEnabled"])
+                            };
+                        }
+                    }
+                }
+            }
+            catch (Exception)
+            {
+                // Defender, its WMI provider, or the requested properties may be unavailable.
+            }
+
+            return null;
+        }
     }
 }