Microsoft Windows SMBv1 remote code execution via crafted packets

# Test-MS17-010.ps1

# Checks whether a Windows host appears vulnerable to MS17-010 / CVE-2017-0144.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Exit-Result {
    param(
        [string]$Status,
        [int]$Code
    )
    Write-Output $Status
    exit $Code
}

function Get-HotFixIds {
    try {
        return @(Get-HotFix | Select-Object -ExpandProperty HotFixID)
    } catch {
        return @()
    }
}

function Test-SMBv1Disabled {
    # If SMBv1 server is disabled, the host is not exploitable via EternalBlue.

    try {
        $cfg = Get-SmbServerConfiguration
        if ($null -ne $cfg.EnableSMB1Protocol -and $cfg.EnableSMB1Protocol -eq $false) {
            return $true
        }
    } catch {}

    try {
        $val = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name SMB1
        if ($val.SMB1 -eq 0) { return $true }
    } catch {}

    return $false
}

# Short-circuit: if SMBv1 is disabled, treat as PATCHED/non-exploitable.

if (Test-SMBv1Disabled) {
    Exit-Result 'PATCHED' 0
}

$os = Get-CimInstance Win32_OperatingSystem
if (-not $os) {
    Exit-Result 'UNKNOWN' 2
}

$caption = [string]$os.Caption
$version = [string]$os.Version
$build = [int]$os.BuildNumber
$spMajor = 0
try { $spMajor = [int]$os.ServicePackMajorVersion } catch {}

$hotfixes = Get-HotFixIds
if (-not $hotfixes) {
    # Continue anyway; some systems restrict WMI hotfix enumeration.

    $hotfixes = @()
}

# KBs from MS17-010 for supported branches in the 2017 bulletin.

$kbMap = @{
    'VistaSP2_Server2008SP2' = @('KB4012598')
    'Win7SP1_Server2008R2SP1' = @('KB4012212','KB4012215')
    'Win81_Server2012R2' = @('KB4012213','KB4012216')
    'Server2012' = @('KB4012214','KB4012217')
    'Win10_1507' = @('KB4012606')
    'Win10_1511' = @('KB4013198')
    'Win10_1607_Server2016' = @('KB4013429')
}

function Has-AnyKb {
    param([string[]]$Needles, [string[]]$Installed)
    foreach ($kb in $Needles) {
        if ($Installed -contains $kb) { return $true }
    }
    return $false
}

# Determine whether this is one of the affected OS families.

$family = $null

if ($caption -match 'Windows Vista' -and $spMajor -ge 2) {
    $family = 'VistaSP2_Server2008SP2'
} elseif ($caption -match 'Windows Server 2008' -and $caption -notmatch 'R2' -and $spMajor -ge 2) {
    $family = 'VistaSP2_Server2008SP2'
} elseif (($caption -match 'Windows 7' -or $caption -match 'Windows Server 2008 R2') -and $spMajor -ge 1) {
    $family = 'Win7SP1_Server2008R2SP1'
} elseif ($caption -match 'Windows 8.1' -or $caption -match 'Windows Server 2012 R2') {
    $family = 'Win81_Server2012R2'
} elseif ($caption -match 'Windows Server 2012' -and $caption -notmatch 'R2') {
    $family = 'Server2012'
} elseif ($caption -match 'Windows 10') {
    switch ($build) {
        10240 { $family = 'Win10_1507' }
        10586 { $family = 'Win10_1511' }
        14393 { $family = 'Win10_1607_Server2016' }
        default {
            # Other Windows 10 builds are outside the CVE's listed vulnerable client range.

            Exit-Result 'PATCHED' 0
        }
    }
} elseif ($caption -match 'Windows Server 2016') {
    if ($build -eq 14393) {
        $family = 'Win10_1607_Server2016'
    } else {
        Exit-Result 'PATCHED' 0
    }
} else {
    # Not an affected family from the advisory.

    Exit-Result 'PATCHED' 0
}

if (-not $family) {
    Exit-Result 'UNKNOWN' 2
}

$neededKbs = $kbMap[$family]
if (-not $neededKbs) {
    Exit-Result 'UNKNOWN' 2
}

if (Has-AnyKb -Needles $neededKbs -Installed $hotfixes) {
    Exit-Result 'PATCHED' 0
}

# If the host is in an affected family, SMBv1 is not disabled, and we cannot find the MS17-010 KB,

# classify as vulnerable.

Exit-Result 'VULNERABLE' 1