Check-3cxVulnerability.ps1

# Title: Script to locate 3CX Windows Desktop Application
# Authors: Huntress
# Status: experimental
# Description: Searches user profiles and known installation locations for compromised 3CX Windows Application installs.
# References: https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats

# Copyright (c) 2023 Huntress Labs, Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#    * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#    * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the
#      documentation and/or other materials provided with the distribution.
#    * Neither the name of the Huntress Labs nor the names of its contributors may be used to endorse or promote products derived from this software
#      without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL HUNTRESS LABS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
# OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#


# look for Program Files 3cx installation
$locations = @()
if (test-path "C:\Program Files\3CXDesktopApp\3CXDesktopApp.exe"){
	$locations += "C:\Program Files\3CXDesktopApp\3CXDesktopApp.exe"
}
if (test-path "C:\Program Files\3CXDesktopApp\Update.exe"){
	$locations += "C:\Program Files\3CXDesktopApp\Update.exe"
}

$badHash = @(
	"a60a61bf844bc181d4540c9fac53203250a982e7c3ad6153869f01e19cc36203",
	"5d99efa36f34aa6b43cd81e77544961c5c8d692c96059fef92c2df2624550734",
	"54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02",
	"d45674f941be3cca2fbc1af42778043cc18cd86d95a2ecb9e6f0e212ed4c74ae"
	)

# recurse the user folders for 3cx
$users = Get-ChildItem "c:\users\"
foreach ($user in $users) {
	if ($user.name -ne "Public") {
		if (test-path "C:\users\$($user.name)\AppData\Local\Programs\3CXDesktopApp\3CXDesktopApp.exe"){
			$locations += "C:\users\$($user.name)\AppData\Local\Programs\3CXDesktopApp\3CXDesktopApp.exe"
		}
		if (test-path "C:\users\$($user.name)\AppData\Local\Programs\3CXDesktopApp\Update.exe"){
			$locations += "C:\users\$($user.name)\AppData\Local\Programs\3CXDesktopApp\Update.exe"
		}
	}
}

# now with all the locations stored we can start comparing them to the known bad hash
$badCount = 0
foreach ($location in $locations) {
	if ($badHash -contains (Get-FileHash $location).Hash){
		Write-Output "Bad hash found at $($location)"
		Write-Output $env:computername
		Write-Output $(ipconfig)
		$badCount++
	}
}

if ($badCount -lt 1){
	Write-Output "No bad hashes found at $($env:computername)"
}