1
1
<# PSScriptInfo
2
2
3
3
.Version
4
- 1.3
4
+ 1.4
5
5
.Guid
6
6
477aa3f4-0434-4925-9c92-7323066cceb7
7
7
.Author
11
11
.ProjectUri
12
12
https://github.com/dotps1/PSFunctions
13
13
.ReleaseNotes
14
- Added a try catch to first WMI call in the 'ByComputerName' parameter set . If the call fails the entire loop for that system will be terminated .
14
+ Moved ComputerName connectivity test to the parameter validation . Added Write-Progress output for the steps being completed .
15
15
16
16
#>
17
17
57
57
Not applicable to windows 10.
58
58
. Link
59
59
https://www.redsocks.eu/news/ransomware-wannacry/
60
+ . Link
61
+ https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012
60
62
. Link
61
63
https://dotps1.github.io
62
64
. Link
@@ -80,6 +82,13 @@ param (
80
82
ValueFromPipeline = $true ,
81
83
ValueFromPipelineByPropertyName = $true
82
84
)]
85
+ [ValidateScript ({
86
+ if (Test-Connection - ComputerName $_ - Count 1 - Quiet) {
87
+ return $true
88
+ } else {
89
+ throw " Failed to contact '$_ '."
90
+ }
91
+ })]
83
92
[Alias (
84
93
" ComputerName"
85
94
)]
@@ -147,12 +156,8 @@ process {
147
156
switch ($PSCmdlet.ParameterSetName ) {
148
157
" ByComputerName" {
149
158
foreach ($nameValue in $Name ) {
150
- if (-not (Test-Connection - ComputerName $nameValue - Count 1 - Quiet)) {
151
- Write-Warning - Message " Failed to contact $nameValue ."
152
- continue
153
- }
154
-
155
159
try {
160
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using WMI" - CurrentOperation " Retrieve operating system caption" - PercentComplete 20
156
161
$osCaption = Get-WmiObject - ComputerName $nameValue - Class Win32_OperatingSystem - Property Caption - Credential $Credential - ErrorAction Stop |
157
162
Select-Object - ExpandProperty Caption
158
163
} catch {
@@ -165,12 +170,14 @@ process {
165
170
continue
166
171
}
167
172
168
- # Patches
169
- $appliedHotFixIds = Get-WmiObject - ComputerName $nameValue - Class Win32_QuickFixEngineering - Credential $Credential |
170
- Where-Object - FilterScript { $_.HotFixID -in $hotFixIDs } |
171
- Select-Object - ExpandProperty HotFixID
173
+ # HotFixes
174
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using WMI" - CurrentOperation " Inventory hotfix information" - PercentComplete 40
175
+ $appliedHotFixIds = (Get-WmiObject - ComputerName $nameValue - Class Win32_QuickFixEngineering - Credential $Credential ).Where ({
176
+ $_.HotFixID -in $hotFixIDs
177
+ }).HotFixID
172
178
173
179
# SMB1 Feature
180
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using WMI" - CurrentOperation " Retrieve SMB1 feature installation status" - PercentComplete 60
174
181
$smb1Feature = Get-WmiObject - ComputerName $nameValue - Class Win32_OptionalFeature - Property InstallState - Filter " Name = 'SMB1Protocol'" - Credential $Credential |
175
182
Select-Object - ExpandProperty InstallState
176
183
@@ -181,6 +188,7 @@ process {
181
188
}
182
189
183
190
# SMB1 Protocol
191
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using WMI" - CurrentOperation " Retrieve SMB1 protocol status" - PercentComplete 80
184
192
$smb1Protocol = Invoke-WmiMethod - ComputerName $nameValue - Class StdRegProv - Name GetDwordValue - ArgumentList @ ( [uint32 ]2147483650 , " SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" , " SMB1" ) - Credential $Credential |
185
193
Select-Object - ExpandProperty uValue
186
194
@@ -189,7 +197,9 @@ process {
189
197
} else {
190
198
$smb1ProtocolEnabled = $true
191
199
}
192
-
200
+
201
+ # Vulnerable?
202
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using WMI" - CurrentOperation " Determine vulnerability status" - PercentComplete 100
193
203
if ($appliedHotFixIds.Count -gt 0 -and -not $smb1FeatureEnabled -and -not $smb1ProtocolEnabled ) {
194
204
$vulnerable = $false
195
205
} else {
@@ -211,6 +221,7 @@ process {
211
221
212
222
" ByCimSession" {
213
223
foreach ($cimSessionValue in $CimSession ) {
224
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using CIM" - CurrentOperation " Retrieve operating system caption" - PercentComplete 20
214
225
$osCaption = Get-CimInstance - CimSession $cimSessionValue - ClassName Win32_OperatingSystem - Property Caption |
215
226
Select-Object - ExpandProperty Caption
216
227
@@ -219,12 +230,15 @@ process {
219
230
continue
220
231
}
221
232
222
- # Patches
223
- $appliedHotFixIds = Get-CimInstance - CimSession $CimSession - ClassName Win32_QuickFixEngineering |
224
- Where-Object - FilterScript { $_.HotFixID -in $hotFixIds } |
225
- Select-Object - ExpandProperty HotFixID
233
+ # HotFixes
234
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using CIM" - CurrentOperation " Inventory hotfix information" - PercentComplete 40
235
+ $appliedHotFixIds = (Get-CimInstance - CimSession $CimSession - ClassName Win32_QuickFixEngineering).Where ({
236
+ $_.HotFixID -in $hotFixIDs
237
+ }).HotFixID
238
+
226
239
227
240
# SMB1 Feature
241
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using CIM" - CurrentOperation " Retrieve SMB1 feature installation status" - PercentComplete 60
228
242
$smb1Feature = Get-CimInstance - CimSession $cimSessionValue - ClassName Win32_OptionalFeature - Property InstallState - Filter " Name = 'SMB1Protocol'" |
229
243
Select-Object - ExpandProperty InstallState
230
244
@@ -235,6 +249,7 @@ process {
235
249
}
236
250
237
251
# SMB1 Protocol
252
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using CIM" - CurrentOperation " Retrieve SMB1 protocol status" - PercentComplete 80
238
253
$smb1Protocol = Invoke-CimMethod - CimSession $cimSessionValue - ClassName StdRegProv - MethodName GetDwordValue - Arguments @ { hDefKey = [uint32 ]2147483650 ; sSubKeyName = " SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" ; sValueName = " SMB1" } |
239
254
Select-Object - ExpandProperty uValue
240
255
@@ -244,6 +259,8 @@ process {
244
259
$smb1ProtocolEnabled = $true
245
260
}
246
261
262
+ # Vulnerable?
263
+ Write-Progress - Activity " Testing '$nameValue ' for WannaCry vulnerabilities using CIM" - CurrentOperation " Determine vulnerability status" - PercentComplete 100
247
264
if ($appliedHotFixIds.Count -gt 0 -and -not $smb1FeatureEnabled -and -not $smb1ProtocolEnabled ) {
248
265
$vulnerable = $false
249
266
}
0 commit comments