windows-exploit-suggester.py Wont Read .xlsx Database

Problem

windows-exploit-suggester.py isn’t reading the database file generated from the --update. It claims it doesn’t support xlsx files even though I ran pip install xlrd.

Solution

I don’t really know exactly *why* this doesn’t work and maybe will come back later to figure it out but I’m working on an OSCP-related time crunch here and thought I’d post this solution. It has something to do with newer versions of xlrd not supporting the database generated out of the windows_exploit_suggester.py --upgrade command. This solution fixed the problem for me but probably introduces some instability or vulnerabilities. Use with caution.

┌──(2022.06.19 | 14:56:40)──[~/hacking/htb/devel]
└─$ pip install xlrd==1.2.0
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.
Defaulting to user installation because normal site-packages is not writeable
Collecting xlrd==1.2.0
  Downloading xlrd-1.2.0-py2.py3-none-any.whl (103 kB)
     |████████████████████████████████| 103 kB 2.5 MB/s 
Installing collected packages: xlrd
  Attempting uninstall: xlrd
    Found existing installation: xlrd 2.0.1
    Uninstalling xlrd-2.0.1:
      Successfully uninstalled xlrd-2.0.1
Successfully installed xlrd-1.2.0

Source

Hat-tip to Peter Mortensen from https://stackoverflow.com/questions/65254535/xlrd-biffh-xlrderror-excel-xlsx-file-not-supported

Original Error

┌──(2022.06.19 | 14:43:22)──[~/hacking/htb/devel]
└─$ pip install xlrd --upgrade
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.
Defaulting to user installation because normal site-packages is not writeable
Requirement already up-to-date: xlrd in /home/tac0shell/.local/lib/python2.7/site-packages (2.0.1)
                                                                                                                                                                                
┌──(2022.06.19 | 14:43:52)──[~/hacking/htb/devel]
└─$ ./tools/windows-exploit-suggester.py --database 2022-06-19-mssb.xls --systeminfo sysinfo.txt
[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
Traceback (most recent call last):
  File "./tools/windows-exploit-suggester.py", line 1639, in <module>
    main()
  File "./tools/windows-exploit-suggester.py", line 414, in main
    wb = xlrd.open_workbook(ARGS.database)
  File "/home/tac0shell/.local/lib/python2.7/site-packages/xlrd/__init__.py", line 170, in open_workbook
    raise XLRDError(FILE_FORMAT_DESCRIPTIONS[file_format]+'; not supported')
xlrd.biffh.XLRDError: Excel xlsx file; not supported