Microsoft Windows WinVerifyTrust Authenticode signature padding validation bypass

# Test-CVE-2013-3900.ps1

# Checks whether CVE-2013-3900 hardening is correctly enabled.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$paths = @(
    'HKLM:\Software\Microsoft\Cryptography\Wintrust\Config',
    'HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config'
)

function Get-ValueInfo {
    param([string]$Path, [string]$Name)

    if (-not (Test-Path -LiteralPath $Path)) {
        return [pscustomobject]@{
            Path = $Path
            Exists = $false
            HasValue = $false
            Type = $null
            Value = $null
        }
    }

    try {
        $item = Get-Item -LiteralPath $Path -ErrorAction Stop
        $props = Get-ItemProperty -LiteralPath $Path -ErrorAction Stop
        $value = $props.$Name

        $kind = $item.GetValueKind($Name)
        return [pscustomobject]@{
            Path = $Path
            Exists = $true
            HasValue = $null -ne $value
            Type = $kind.ToString()
            Value = $value
        }
    }
    catch {
        return [pscustomobject]@{
            Path = $Path
            Exists = $true
            HasValue = $false
            Type = $null
            Value = $null
        }
    }
}

$results = foreach ($p in $paths) {
    Get-ValueInfo -Path $p -Name 'EnableCertPaddingCheck'
}

# PATCHED only when BOTH keys exist and BOTH are REG_DWORD == 1

$patched = $true
$unknown = $false
$notes = @()

foreach ($r in $results) {
    if (-not $r.Exists) {
        $patched = $false
        $notes += "Missing key: $($r.Path)"
        continue
    }

    if (-not $r.HasValue) {
        $patched = $false
        $notes += "Missing value: $($r.Path)\\EnableCertPaddingCheck"
        continue
    }

    if ($r.Type -ne 'DWord') {
        $patched = $false
        $unknown = $true
        $notes += "Unexpected type at $($r.Path): $($r.Type) value=$($r.Value)"
        continue
    }

    try {
        $intVal = [int]$r.Value
    }
    catch {
        $patched = $false
        $unknown = $true
        $notes += "Non-integer DWORD at $($r.Path): $($r.Value)"
        continue
    }

    if ($intVal -ne 1) {
        $patched = $false
        $notes += "DWORD not set to 1 at $($r.Path): $intVal"
    }
}

if ($patched) {
    Write-Output 'PATCHED'
    exit 0
}
elseif ($unknown) {
    Write-Output 'UNKNOWN'
    $notes | ForEach-Object { Write-Output $_ }
    exit 2
}
else {
    Write-Output 'VULNERABLE'
    $notes | ForEach-Object { Write-Output $_ }
    exit 1
}