Skip to content

Commit 6ae037d

Browse files
committed
Moved ComputerName connectivity test to the parameter validation. Added Write-Progress output for the steps being completed.
1 parent 8eccfe0 commit 6ae037d

File tree

1 file changed

+33
-16
lines changed

1 file changed

+33
-16
lines changed

Functions/Test-WannaCryVulnerability.ps1

Lines changed: 33 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<#PSScriptInfo
22
33
.Version
4-
1.3
4+
1.4
55
.Guid
66
477aa3f4-0434-4925-9c92-7323066cceb7
77
.Author
@@ -11,7 +11,7 @@
1111
.ProjectUri
1212
https://github.com/dotps1/PSFunctions
1313
.ReleaseNotes
14-
Added a try catch to first WMI call in the 'ByComputerName' parameter set. If the call fails the entire loop for that system will be terminated.
14+
Moved ComputerName connectivity test to the parameter validation. Added Write-Progress output for the steps being completed.
1515
1616
#>
1717

@@ -57,6 +57,8 @@
5757
Not applicable to windows 10.
5858
.Link
5959
https://www.redsocks.eu/news/ransomware-wannacry/
60+
.Link
61+
https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012
6062
.Link
6163
https://dotps1.github.io
6264
.Link
@@ -80,6 +82,13 @@ param (
8082
ValueFromPipeline = $true,
8183
ValueFromPipelineByPropertyName = $true
8284
)]
85+
[ValidateScript({
86+
if (Test-Connection -ComputerName $_ -Count 1 -Quiet) {
87+
return $true
88+
} else {
89+
throw "Failed to contact '$_'."
90+
}
91+
})]
8392
[Alias(
8493
"ComputerName"
8594
)]
@@ -147,12 +156,8 @@ process {
147156
switch ($PSCmdlet.ParameterSetName) {
148157
"ByComputerName" {
149158
foreach ($nameValue in $Name) {
150-
if (-not (Test-Connection -ComputerName $nameValue -Count 1 -Quiet)) {
151-
Write-Warning -Message "Failed to contact $nameValue."
152-
continue
153-
}
154-
155159
try {
160+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using WMI" -CurrentOperation "Retrieve operating system caption" -PercentComplete 20
156161
$osCaption = Get-WmiObject -ComputerName $nameValue -Class Win32_OperatingSystem -Property Caption -Credential $Credential -ErrorAction Stop |
157162
Select-Object -ExpandProperty Caption
158163
} catch {
@@ -165,12 +170,14 @@ process {
165170
continue
166171
}
167172

168-
# Patches
169-
$appliedHotFixIds = Get-WmiObject -ComputerName $nameValue -Class Win32_QuickFixEngineering -Credential $Credential |
170-
Where-Object -FilterScript { $_.HotFixID -in $hotFixIDs } |
171-
Select-Object -ExpandProperty HotFixID
173+
# HotFixes
174+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using WMI" -CurrentOperation "Inventory hotfix information" -PercentComplete 40
175+
$appliedHotFixIds = (Get-WmiObject -ComputerName $nameValue -Class Win32_QuickFixEngineering -Credential $Credential).Where({
176+
$_.HotFixID -in $hotFixIDs
177+
}).HotFixID
172178

173179
#SMB1 Feature
180+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using WMI" -CurrentOperation "Retrieve SMB1 feature installation status" -PercentComplete 60
174181
$smb1Feature = Get-WmiObject -ComputerName $nameValue -Class Win32_OptionalFeature -Property InstallState -Filter "Name = 'SMB1Protocol'" -Credential $Credential |
175182
Select-Object -ExpandProperty InstallState
176183

@@ -181,6 +188,7 @@ process {
181188
}
182189

183190
#SMB1 Protocol
191+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using WMI" -CurrentOperation "Retrieve SMB1 protocol status" -PercentComplete 80
184192
$smb1Protocol = Invoke-WmiMethod -ComputerName $nameValue -Class StdRegProv -Name GetDwordValue -ArgumentList @( [uint32]2147483650, "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters", "SMB1" ) -Credential $Credential |
185193
Select-Object -ExpandProperty uValue
186194

@@ -189,7 +197,9 @@ process {
189197
} else {
190198
$smb1ProtocolEnabled = $true
191199
}
192-
200+
201+
# Vulnerable?
202+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using WMI" -CurrentOperation "Determine vulnerability status" -PercentComplete 100
193203
if ($appliedHotFixIds.Count -gt 0 -and -not $smb1FeatureEnabled -and -not $smb1ProtocolEnabled) {
194204
$vulnerable = $false
195205
} else {
@@ -211,6 +221,7 @@ process {
211221

212222
"ByCimSession" {
213223
foreach ($cimSessionValue in $CimSession) {
224+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using CIM" -CurrentOperation "Retrieve operating system caption" -PercentComplete 20
214225
$osCaption = Get-CimInstance -CimSession $cimSessionValue -ClassName Win32_OperatingSystem -Property Caption |
215226
Select-Object -ExpandProperty Caption
216227

@@ -219,12 +230,15 @@ process {
219230
continue
220231
}
221232

222-
# Patches
223-
$appliedHotFixIds = Get-CimInstance -CimSession $CimSession -ClassName Win32_QuickFixEngineering |
224-
Where-Object -FilterScript { $_.HotFixID -in $hotFixIds } |
225-
Select-Object -ExpandProperty HotFixID
233+
# HotFixes
234+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using CIM" -CurrentOperation "Inventory hotfix information" -PercentComplete 40
235+
$appliedHotFixIds = (Get-CimInstance -CimSession $CimSession -ClassName Win32_QuickFixEngineering).Where({
236+
$_.HotFixID -in $hotFixIDs
237+
}).HotFixID
238+
226239

227240
#SMB1 Feature
241+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using CIM" -CurrentOperation "Retrieve SMB1 feature installation status" -PercentComplete 60
228242
$smb1Feature = Get-CimInstance -CimSession $cimSessionValue -ClassName Win32_OptionalFeature -Property InstallState -Filter "Name = 'SMB1Protocol'" |
229243
Select-Object -ExpandProperty InstallState
230244

@@ -235,6 +249,7 @@ process {
235249
}
236250

237251
# SMB1 Protocol
252+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using CIM" -CurrentOperation "Retrieve SMB1 protocol status" -PercentComplete 80
238253
$smb1Protocol = Invoke-CimMethod -CimSession $cimSessionValue -ClassName StdRegProv -MethodName GetDwordValue -Arguments @{ hDefKey = [uint32]2147483650; sSubKeyName = "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"; sValueName = "SMB1" } |
239254
Select-Object -ExpandProperty uValue
240255

@@ -244,6 +259,8 @@ process {
244259
$smb1ProtocolEnabled = $true
245260
}
246261

262+
# Vulnerable?
263+
Write-Progress -Activity "Testing '$nameValue' for WannaCry vulnerabilities using CIM" -CurrentOperation "Determine vulnerability status" -PercentComplete 100
247264
if ($appliedHotFixIds.Count -gt 0 -and -not $smb1FeatureEnabled -and -not $smb1ProtocolEnabled) {
248265
$vulnerable = $false
249266
}

0 commit comments

Comments
 (0)