Time4Popcorn auto-updater unsigned HTTP code execution via lapsed domain hijack

#!/usr/bin/env pwsh
# Check-CVE-2026-30612.ps1
# Detects Time4Popcorn vulnerable updater (CVE-2026-30612)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$found = $false
$serviceActive = $false

# Check 1: Look for Updater.exe in known install paths
$paths = @(
    "$env:ProgramFiles\Popcorn Time\Updater.exe",
    "${env:ProgramFiles(x86)}\Popcorn Time\Updater.exe",
    "$env:LOCALAPPDATA\Popcorn Time\Updater.exe"
)

foreach ($p in $paths) {
    if (Test-Path $p) {
        $hash = (Get-FileHash $p -Algorithm SHA256).Hash
        Write-Host "[!] Found updater: $p"
        Write-Host "    SHA256: $hash"
        # Known vulnerable hash
        if ($hash -eq '6F895E70E5E560B4B8189A8F7EDDF59EA1D237C3D69AF7C9E55CFBD76F334827') {
            Write-Host '    Hash matches known vulnerable Updater.exe'
        }
        $found = $true
    }
}

# Check 2: Look for the Windows service
$svc = Get-CimInstance Win32_Service -Filter "Name='Update service'" 2>$null
if (-not $svc) {
    # Also check by path pattern
    $svc = Get-CimInstance Win32_Service | Where-Object { $_.PathName -like '*Popcorn Time*' }
}
if ($svc) {
    Write-Host "[!] Found service: $($svc.Name) — State: $($svc.State) — StartMode: $($svc.StartMode)"
    Write-Host "    Path: $($svc.PathName)"
    $found = $true
    if ($svc.State -eq 'Running' -or $svc.StartMode -ne 'Disabled') {
        $serviceActive = $true
    }
}

# Check 3: Look for running process
$proc = Get-Process -Name 'Updater' -ErrorAction SilentlyContinue |
    Where-Object { $_.Path -like '*Popcorn Time*' }
if ($proc) {
    Write-Host "[!] Updater process running: PID $($proc.Id)"
    $found = $true
    $serviceActive = $true
}

# Check 4: Check for Popcorn Time application directory
$appDirs = @(
    "$env:ProgramFiles\Popcorn Time",
    "${env:ProgramFiles(x86)}\Popcorn Time",
    "$env:LOCALAPPDATA\Popcorn Time"
)
foreach ($d in $appDirs) {
    if (Test-Path $d) {
        Write-Host "[!] Application directory exists: $d"
        $found = $true
    }
}

# Verdict
if ($found -and $serviceActive) {
    Write-Host "`nVULNERABLE — Time4Popcorn updater is present and active. CVE-2026-30612 exploitable."
    exit 1
} elseif ($found) {
    Write-Host "`nVULNERABLE — Time4Popcorn components found (updater may be disabled but app remains). Remove entirely."
    exit 1
} else {
    Write-Host "`nPATCHED — No Time4Popcorn components detected."
    exit 0
}
# macOS equivalent: test -f /Library/PrivilegedHelperTools/PT.updd && echo VULNERABLE || echo PATCHED