Update 3.0. VulnerabilityScanner
This commit is contained in:
Mark
+138
-138
@@ -30,7 +30,7 @@ DELAY 200
|
||||
ENTER
|
||||
DELAY 200
|
||||
REM Create the PowerShell script in memory and execute it
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $usbName = "MYUSB"
|
||||
DELAY 200
|
||||
ENTER
|
||||
@@ -348,282 +348,282 @@ DELAY 200
|
||||
ENTER
|
||||
DELAY 200
|
||||
STRING } catch {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Error checking open ports: $_"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING function check-missingupdates {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING try {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Checking Windows Update logs..."
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $updateLogPath = Join-Path -Path $directoryPath -ChildPath "WindowsUpdate.log"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING Get-WindowsUpdateLog -LogPath $updateLogPath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "WindowsUpdate.log written to $updateLogPath"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Temp\WindowsUpdateLog\*" -Recurse -Force
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING } catch {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Error getting Windows Update log: $_"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING function check-firewallstatus {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING try {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING netsh advfirewall show allprofiles
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING } catch {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Error checking firewall status: $_"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING function check-smbv1status {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING try {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING get-windowsoptionalfeature -online -featurename smb1protocol
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING } catch {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Error checking SMBv1 status: $_"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING function check-antivirusstatus {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING try {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING get-mpcomputerstatus
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING } catch {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Error checking antivirus status: $_"
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-passwordpolicy >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING audit-services >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-networksettings >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-softwarevulnerabilities >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING analyze-logs >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-openports >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-missingupdates >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-firewallstatus >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-smbv1status >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-antivirusstatus >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
REM Dynamically identify critical software from running processes and scheduled tasks
|
||||
STRING $runningSoftware = Get-Process | Select-Object Name | Sort-Object Name -Unique
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $scheduledTasks = schtasks /query /fo CSV | ConvertFrom-Csv | Select-Object TaskName, TaskToRun | Sort-Object TaskToRun -Unique
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
REM Combine running software and scheduled tasks
|
||||
STRING $softwareList = @()
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING foreach ($process in $runningSoftware) {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $softwareList += $process.Name
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING foreach ($task in $scheduledTasks) {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $softwareList += [System.IO.Path]::GetFileNameWithoutExtension($task.TaskToRun)
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
REM Remove duplicates and empty entries
|
||||
STRING $softwareList = $softwareList | Sort-Object -Unique | Where-Object { $_ -ne "" }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
REM Check CVEs for identified software
|
||||
STRING foreach ($software in $softwareList) {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $version = (Get-ItemProperty hklm:\software\wow6432node\microsoft\windows\currentversion\uninstall\* | Where-Object { $_.DisplayName -eq $software }).DisplayVersion
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING if ($version) {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING check-cve -productname $software -version $version >> $resultsFilePath
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING $initialDelay += (Get-Random -Minimum 5 -Maximum 10)
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING start-sleep -seconds $initialDelay
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Results saved to USB drive."
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING } else {
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING write-output "Error: USB drive MYUSB not found."
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING }
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
STRING invoke-command -scriptblock $script
|
||||
DELAY 400
|
||||
DELAY 200
|
||||
ENTER
|
||||
DELAY 20000
|
||||
|
||||
Reference in New Issue
Block a user