/Sherlock

Permalink
Switch branches/tags
Nothing to show
Find file Copy path
8b5f897 Jun 3, 2018
2 contributors

Users who have contributed to this file
@rasta-mouse @recrudesce
Raw Blame History
566 lines (346 sloc) 16.3 KB
<#
File: Sherlock.ps1
Author: @_RastaMouse
License: GNU General Public License v3.0
#>
<#
RTM build reference, because I'm stupid and forget...
6002: Vista SP2/2008 SP2
7600: 7/2008 R2
7601: 7 SP1/2008 R2 SP1
9200: 8/2012
9600: 8.1/2012 R2
10240: 10 Threshold
10586: 10 Threshold 2
14393: 10 Redstone/2016
15063: 10 Redstone 2
16299: 10 Redstone 3
17134: 10 Redstone 4
#>
$Global:ExploitTable = $null
function Get-FileVersionInfo ($FilePath) {
$VersionInfo = (Get-Item $FilePath).VersionInfo
$FileVersion = ( "{0}.{1}.{2}.{3}" -f $VersionInfo.FileMajorPart, $VersionInfo.FileMinorPart, $VersionInfo.FileBuildPart, $VersionInfo.FilePrivatePart )
return $FileVersion
}
function Get-InstalledSoftware($SoftwareName) {
$SoftwareVersion = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -eq $SoftwareName } | Select-Object Version
$SoftwareVersion = $SoftwareVersion.Version # I have no idea what I'm doing
return $SoftwareVersion
}
function Get-Architecture {
# This is the CPU architecture. Returns "64-bit" or "32-bit".
$CPUArchitecture = (Get-WmiObject Win32_OperatingSystem).OSArchitecture
# This is the process architecture, e.g. are we an x86 process running on a 64-bit system. Retuns "AMD64" or "x86".
$ProcessArchitecture = $env:PROCESSOR_ARCHITECTURE
return $CPUArchitecture, $ProcessArchitecture
}
function Get-CPUCoreCount {
$CoreCount = (Get-WmiObject Win32_Processor).NumberOfLogicalProcessors
return $CoreCount
}
function New-ExploitTable {
# Create the table
$Global:ExploitTable = New-Object System.Data.DataTable
# Create the columns
$Global:ExploitTable.Columns.Add("Title")
$Global:ExploitTable.Columns.Add("MSBulletin")
$Global:ExploitTable.Columns.Add("CVEID")
$Global:ExploitTable.Columns.Add("Link")
$Global:ExploitTable.Columns.Add("VulnStatus")
# Add the exploits we are interested in.
# MS10
$Global:ExploitTable.Rows.Add("User Mode to Ring (KiTrap0D)","MS10-015","2010-0232","https://www.exploit-db.com/exploits/11199/")
$Global:ExploitTable.Rows.Add("Task Scheduler .XML","MS10-092","2010-3338, 2010-3888","https://www.exploit-db.com/exploits/19930/")
# MS13
$Global:ExploitTable.Rows.Add("NTUserMessageCall Win32k Kernel Pool Overflow","MS13-053","2013-1300","https://www.exploit-db.com/exploits/33213/")
$Global:ExploitTable.Rows.Add("TrackPopupMenuEx Win32k NULL Page","MS13-081","2013-3881","https://www.exploit-db.com/exploits/31576/")
# MS14
$Global:ExploitTable.Rows.Add("TrackPopupMenu Win32k Null Pointer Dereference","MS14-058","2014-4113","https://www.exploit-db.com/exploits/35101/")
# MS15
$Global:ExploitTable.Rows.Add("ClientCopyImage Win32k","MS15-051","2015-1701, 2015-2433","https://www.exploit-db.com/exploits/37367/")
$Global:ExploitTable.Rows.Add("Font Driver Buffer Overflow","MS15-078","2015-2426, 2015-2433","https://www.exploit-db.com/exploits/38222/")
# MS16
$Global:ExploitTable.Rows.Add("'mrxdav.sys' WebDAV","MS16-016","2016-0051","https://www.exploit-db.com/exploits/40085/")
$Global:ExploitTable.Rows.Add("Secondary Logon Handle","MS16-032","2016-0099","https://www.exploit-db.com/exploits/39719/")
$Global:ExploitTable.Rows.Add("Windows Kernel-Mode Drivers EoP","MS16-034","2016-0093/94/95/96","https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS16-034?")
$Global:ExploitTable.Rows.Add("Win32k Elevation of Privilege","MS16-135","2016-7255","https://github.com/FuzzySecurity/PSKernel-Primitives/tree/master/Sample-Exploits/MS16-135")
# Miscs that aren't MS
$Global:ExploitTable.Rows.Add("Nessus Agent 6.6.2 - 6.10.3","N/A","2017-7199","https://aspe1337.blogspot.co.uk/2017/04/writeup-of-cve-2017-7199.html")
}
function Set-ExploitTable ($MSBulletin, $VulnStatus) {
if ( $MSBulletin -like "MS*" ) {
$Global:ExploitTable | Where-Object { $_.MSBulletin -eq $MSBulletin
} | ForEach-Object {
$_.VulnStatus = $VulnStatus
}
} else {
$Global:ExploitTable | Where-Object { $_.CVEID -eq $MSBulletin
} | ForEach-Object {
$_.VulnStatus = $VulnStatus
}
}
}
function Get-Results {
$Global:ExploitTable
}
function Find-AllVulns {
if ( !$Global:ExploitTable ) {
$null = New-ExploitTable
}
Find-MS10015
Find-MS10092
Find-MS13053
Find-MS13081
Find-MS14058
Find-MS15051
Find-MS15078
Find-MS16016
Find-MS16032
Find-MS16034
Find-MS16135
Find-CVE20177199
Get-Results
}
function Find-MS10015 {
$MSBulletin = "MS10-015"
$Architecture = Get-Architecture
if ( $Architecture[0] -eq "64-bit" ) {
$VulnStatus = "Not supported on 64-bit systems"
} Else {
$Path = $env:windir + "\system32\ntoskrnl.exe"
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "20591" ] }
default { $VulnStatus = "Not Vulnerable" }
}
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS10092 {
$MSBulletin = "MS10-092"
$Architecture = Get-Architecture
if ( $Architecture[1] -eq "AMD64" -or $Architecture[0] -eq "32-bit" ) {
$Path = $env:windir + "\system32\schedsvc.dll"
} ElseIf ( $Architecture[0] -eq "64-bit" -and $Architecture[1] -eq "x86" ) {
$Path = $env:windir + "\sysnative\schedsvc.dll"
}
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "20830" ] }
default { $VulnStatus = "Not Vulnerable" }
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS13053 {
$MSBulletin = "MS13-053"
$Architecture = Get-Architecture
if ( $Architecture[0] -eq "64-bit" ) {
$VulnStatus = "Not supported on 64-bit systems"
} Else {
$Path = $env:windir + "\system32\win32k.sys"
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -ge "17000" ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "22348" ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "20732" ] }
default { $VulnStatus = "Not Vulnerable" }
}
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS13081 {
$MSBulletin = "MS13-081"
$Architecture = Get-Architecture
if ( $Architecture[0] -eq "64-bit" ) {
$VulnStatus = "Not supported on 64-bit systems"
} Else {
$Path = $env:windir + "\system32\win32k.sys"
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -ge "18000" ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "22435" ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "20807" ] }
default { $VulnStatus = "Not Vulnerable" }
}
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS14058 {
$MSBulletin = "MS14-058"
$Architecture = Get-Architecture
if ( $Architecture[1] -eq "AMD64" -or $Architecture[0] -eq "32-bit" ) {
$Path = $env:windir + "\system32\win32k.sys"
} ElseIf ( $Architecture[0] -eq "64-bit" -and $Architecture[1] -eq "x86" ) {
$Path = $env:windir + "\sysnative\win32k.sys"
}
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -ge "18000" ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "22823" ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "21247" ] }
9600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "17353" ] }
default { $VulnStatus = "Not Vulnerable" }
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS15051 {
$MSBulletin = "MS15-051"
$Architecture = Get-Architecture
if ( $Architecture[1] -eq "AMD64" -or $Architecture[0] -eq "32-bit" ) {
$Path = $env:windir + "\system32\win32k.sys"
} ElseIf ( $Architecture[0] -eq "64-bit" -and $Architecture[1] -eq "x86" ) {
$Path = $env:windir + "\sysnative\win32k.sys"
}
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "18000" ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "22823" ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "21247" ] }
9600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "17353" ] }
default { $VulnStatus = "Not Vulnerable" }
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS15078 {
$MSBulletin = "MS15-078"
$Path = $env:windir + "\system32\atmfd.dll"
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(" ")
$Revision = $VersionInfo[2]
switch ( $Revision ) {
243 { $VulnStatus = "Appears Vulnerable" }
default { $VulnStatus = "Not Vulnerable" }
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS16016 {
$MSBulletin = "MS16-016"
$Architecture = Get-Architecture
if ( $Architecture[0] -eq "64-bit" ) {
$VulnStatus = "Not supported on 64-bit systems"
} Else {
$Path = $env:windir + "\system32\drivers\mrxdav.sys"
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = $VersionInfo[2]
$Revision = $VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "16000" ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "23317" ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "21738" ] }
9600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "18189" ] }
10240 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "16683" ] }
10586 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le "103" ] }
default { $VulnStatus = "Not Vulnerable" }
}
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS16032 {
$MSBulletin = "MS16-032"
$CPUCount = Get-CPUCoreCount
if ( $CPUCount -eq "1" ) {
$VulnStatus = "Not Supported on single-core systems"
} Else {
$Architecture = Get-Architecture
if ( $Architecture[1] -eq "AMD64" -or $Architecture[0] -eq "32-bit" ) {
$Path = $env:windir + "\system32\seclogon.dll"
} ElseIf ( $Architecture[0] -eq "64-bit" -and $Architecture[1] -eq "x86" ) {
$Path = $env:windir + "\sysnative\seclogon.dll"
}
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = [int]$VersionInfo[2]
$Revision = [int]$VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
6002 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revison -lt 19598 -Or ( $Revision -ge 23000 -And $Revision -le 23909 ) ] }
7600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 19148 ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -lt 19148 -Or ( $Revision -ge 23000 -And $Revision -le 23347 ) ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revison -lt 17649 -Or ( $Revision -ge 21000 -And $Revision -le 21767 ) ] }
9600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revison -lt 18230 ] }
10240 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -lt 16724 ] }
10586 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 161 ] }
default { $VulnStatus = "Not Vulnerable" }
}
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-MS16034 {
$MSBulletin = "MS16-034"
$Architecture = Get-Architecture
if ( $Architecture[1] -eq "AMD64" -or $Architecture[0] -eq "32-bit" ) {
$Path = $env:windir + "\system32\win32k.sys"
} ElseIf ( $Architecture[0] -eq "64-bit" -and $Architecture[1] -eq "x86" ) {
$Path = $env:windir + "\sysnative\win32k.sys"
}
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = [int]$VersionInfo[2]
$Revision = [int]$VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
6002 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revison -lt 19597 -Or $Revision -lt 23908 ] }
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -lt 19145 -Or $Revision -lt 23346 ] }
9200 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revison -lt 17647 -Or $Revision -lt 21766 ] }
9600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revison -lt 18228 ] }
default { $VulnStatus = "Not Vulnerable" }
}
Set-ExploitTable $MSBulletin $VulnStatus
}
function Find-CVE20177199 {
$CVEID = "2017-7199"
$SoftwareVersion = Get-InstalledSoftware "Nessus Agent"
if ( !$SoftwareVersion ) {
$VulnStatus = "Not Vulnerable"
} else {
$SoftwareVersion = $SoftwareVersion.Split(".")
$Major = [int]$SoftwareVersion[0]
$Minor = [int]$SoftwareVersion[1]
$Build = [int]$SoftwareVersion[2]
switch( $Major ) {
6 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Minor -eq 10 -and $Build -le 3 -Or ( $Minor -eq 6 -and $Build -le 2 ) -Or ( $Minor -le 9 -and $Minor -ge 7 ) ] } # 6.6.2 - 6.10.3
default { $VulnStatus = "Not Vulnerable" }
}
}
Set-ExploitTable $CVEID $VulnStatus
}
function Find-MS16135 {
$MSBulletin = "MS16-135"
$Architecture = Get-Architecture
if ( $Architecture[1] -eq "AMD64" -or $Architecture[0] -eq "32-bit" ) {
$Path = $env:windir + "\system32\win32k.sys"
} ElseIf ( $Architecture[0] -eq "64-bit" -and $Architecture[1] -eq "x86" ) {
$Path = $env:windir + "\sysnative\win32k.sys"
}
$VersionInfo = Get-FileVersionInfo($Path)
$VersionInfo = $VersionInfo.Split(".")
$Build = [int]$VersionInfo[2]
$Revision = [int]$VersionInfo[3].Split(" ")[0]
switch ( $Build ) {
7601 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -lt 23584 ] }
9600 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 18524 ] }
10240 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 16384 ] }
10586 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 19 ] }
14393 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 446 ] }
default { $VulnStatus = "Not Vulnerable" }
}
Set-ExploitTable $MSBulletin $VulnStatus
}