N-able N-central Authentication Bypass via Alternate Path (Incomplete Patch for CVE-2026-18556)

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the local N-able N-central installation is vulnerable to CVE-2026-18577.
.DESCRIPTION
    Reads the installed N-central build version from the filesystem or registry
    and compares against the minimum patched build (2026.3.1.10, Hotfix 2).
    Also checks for known indicators of compromise.
.OUTPUTS
    VULNERABLE, PATCHED, or UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$minSafeBuild = [version]'2026.3.1.10'
$recommendedBuild = [version]'2026.3.1.14'
$result = 'UNKNOWN'

# --- Attempt to find N-central installation ---
$ncentralPaths = @(
    'C:\Program Files\N-able Technologies\N-central',
    'C:\Program Files (x86)\N-able Technologies\N-central',
    'C:\N-able\N-central'
)

$installPath = $null
foreach ($p in $ncentralPaths) {
    if (Test-Path $p) {
        $installPath = $p
        break
    }
}

if (-not $installPath) {
    # Try registry
    $regPaths = @(
        'HKLM:\SOFTWARE\N-able Technologies\N-central',
        'HKLM:\SOFTWARE\WOW6432Node\N-able Technologies\N-central'
    )
    foreach ($rp in $regPaths) {
        if (Test-Path $rp) {
            $regVal = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
            if ($regVal.InstallPath) {
                $installPath = $regVal.InstallPath
            }
            if ($regVal.Version) {
                $rawVersion = $regVal.Version
            }
            break
        }
    }
}

if (-not $installPath -and -not $rawVersion) {
    Write-Host '[!] N-central installation not found on this host.'
    Write-Host 'UNKNOWN'
    exit 2
}

# --- Determine version ---
if (-not $rawVersion) {
    # Try version.properties or build.properties
    $versionFiles = @(
        (Join-Path $installPath 'version.properties'),
        (Join-Path $installPath 'conf\version.properties'),
        (Join-Path $installPath 'build.properties')
    )
    foreach ($vf in $versionFiles) {
        if (Test-Path $vf) {
            $content = Get-Content $vf -Raw
            if ($content -match '(?:version|build\.number)\s*=\s*([\d\.]+)') {
                $rawVersion = $Matches[1]
                break
            }
        }
    }
}

if (-not $rawVersion) {
    # Try reading from any JAR manifest or DLL file version
    $dlls = Get-ChildItem -Path $installPath -Filter '*.dll' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
    if ($dlls) {
        $rawVersion = $dlls.VersionInfo.FileVersion
    }
}

if (-not $rawVersion) {
    Write-Host '[!] Could not determine N-central version.'
    Write-Host 'UNKNOWN'
    exit 2
}

Write-Host "[*] Detected N-central version: $rawVersion"

try {
    $installedVersion = [version]$rawVersion
} catch {
    Write-Host "[!] Could not parse version string: $rawVersion"
    Write-Host 'UNKNOWN'
    exit 2
}

# --- Version comparison ---
if ($installedVersion -ge $recommendedBuild) {
    Write-Host "[+] Version $installedVersion >= $recommendedBuild (Hotfix 4 - recommended)"
    $result = 'PATCHED'
} elseif ($installedVersion -ge $minSafeBuild) {
    Write-Host "[~] Version $installedVersion >= $minSafeBuild (Hotfix 2 - minimum safe for CVE-2026-18577)"
    Write-Host '[~] WARNING: Upgrade to 2026.3.1.14 (Hotfix 4) to also address CVE-2026-86218 (pre-auth RCE).'
    $result = 'PATCHED'
} else {
    Write-Host "[!] Version $installedVersion < $minSafeBuild — VULNERABLE to CVE-2026-18577"
    $result = 'VULNERABLE'
}

# --- IOC Checks ---
Write-Host ''
Write-Host '[*] Checking for known indicators of compromise...'
$iocFound = $false

# Check for Cloudflare tunnel service
$cfService = Get-Service -Name 'cloudflared' -ErrorAction SilentlyContinue
if ($cfService) {
    Write-Host '[!!] IOC FOUND: Cloudflared service detected!'
    $iocFound = $true
}

# Check for svchost.exe in user Documents folders
$userProfiles = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($profile in $userProfiles) {
    $suspPath = Join-Path $profile.FullName 'Documents\svchost.exe'
    if (Test-Path $suspPath) {
        Write-Host "[!!] IOC FOUND: Suspicious svchost.exe at $suspPath"
        $iocFound = $true
    }
}

# Check for unexpected remote access tools
$suspiciousServices = @('AnyDesk', 'TeamViewer', 'RustDesk', 'SimpleHelp*')
foreach ($svc in $suspiciousServices) {
    $found = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($found) {
        Write-Host "[!] WARNING: Potentially unauthorized remote access tool service found: $($found.Name)"
    }
}

if ($iocFound) {
    Write-Host ''
    Write-Host '[!!] COMPROMISE INDICATORS DETECTED — initiate incident response immediately.'
}

Write-Host ''
Write-Host $result

switch ($result) {
    'VULNERABLE' { exit 1 }
    'PATCHED'    { exit 0 }
    default      { exit 2 }
}