BarTender .NET Remoting Unauthenticated RCE via BtSystem.Service.exe

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Check-CVE-2026-25550.ps1 - Detect vulnerable BarTender .NET Remoting exposure
.DESCRIPTION
    Checks for BtSystem.Service.exe listening on TCP 7375 on non-localhost
    interfaces and verifies BarTender version against affected ranges.
    Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
#>

$exitCode = 2
$status = "UNKNOWN"

try {
    # Check if BtSystem.Service.exe is running
    $svc = Get-Process -Name "BtSystem.Service" -ErrorAction SilentlyContinue
    if (-not $svc) {
        Write-Host "[INFO] BtSystem.Service.exe is not running on this host."
        Write-Host "UNKNOWN - BarTender service not detected"
        exit 2
    }

    # Check TCP 7375 listeners
    $listeners = Get-NetTCPConnection -LocalPort 7375 -State Listen -ErrorAction SilentlyContinue
    $externalListener = $listeners | Where-Object {
        $_.LocalAddress -ne "127.0.0.1" -and $_.LocalAddress -ne "::1"
    }

    # Get BarTender version from the executable
    $btPath = $svc.Path
    if (-not $btPath) {
        $btPath = (Get-WmiObject Win32_Process -Filter "Name='BtSystem.Service.exe'").ExecutablePath
    }

    $version = $null
    if ($btPath -and (Test-Path $btPath)) {
        $fileInfo = Get-Item $btPath
        $version = $fileInfo.VersionInfo.ProductVersion
        Write-Host "[INFO] BarTender version detected: $version"
        Write-Host "[INFO] Path: $btPath"
    }

    # Check registry for version info as fallback
    if (-not $version) {
        $regPaths = @(
            "HKLM:\SOFTWARE\Seagull Scientific\BarTender",
            "HKLM:\SOFTWARE\WOW6432Node\Seagull Scientific\BarTender"
        )
        foreach ($rp in $regPaths) {
            if (Test-Path $rp) {
                $version = (Get-ItemProperty $rp -ErrorAction SilentlyContinue).Version
                if ($version) {
                    Write-Host "[INFO] BarTender version from registry: $version"
                    break
                }
            }
        }
    }

    # Determine vulnerability status
    if ($externalListener) {
        Write-Host "[ALERT] TCP 7375 is listening on non-localhost: $($externalListener.LocalAddress -join ', ')"
        Write-Host "[ALERT] .NET Remoting endpoint is network-accessible without authentication."
        $status = "VULNERABLE"
        $exitCode = 1
    } elseif ($listeners) {
        Write-Host "[INFO] TCP 7375 is listening on localhost only (2021+ behavior)."
        Write-Host "[INFO] Remote exploitation vector is NOT present (CVE-2026-25550 not applicable)."
        Write-Host "[INFO] Check CVE-2026-25551 for local privilege escalation if version < 12.1."
        $status = "PATCHED"
        $exitCode = 0
    } else {
        Write-Host "[INFO] TCP 7375 is not listening."
        $status = "PATCHED"
        $exitCode = 0
    }
} catch {
    Write-Host "[ERROR] $_"
    $status = "UNKNOWN"
    $exitCode = 2
}

Write-Host ""
Write-Host "Result: $status"
exit $exitCode