Microsoft ASP

# check-traceaxd.ps1

# Purpose: Detect remotely risky ASP.NET trace.axd exposure in IIS applications.

# Logic: Enumerate IIS sites/apps, parse web.config, and flag VULNERABLE if trace is enabled and localOnly is not true.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Resolve-PhysicalPath {
    param([string]$Path)
    if ([string]::IsNullOrWhiteSpace($Path)) { return $null }
    if ($Path -match '^%') {
        return [Environment]::ExpandEnvironmentVariables($Path)
    }
    return $Path
}

function Get-TraceStateFromConfig {
    param([string]$ConfigPath)

    $result = [ordered]@{
        ConfigPath = $ConfigPath
        Enabled    = $null
        LocalOnly  = $null
        State      = 'UNKNOWN'
        Note       = ''
    }

    if (-not (Test-Path -LiteralPath $ConfigPath)) {
        $result.Note = 'web.config not found'
        return [pscustomobject]$result
    }

    try {
        [xml]$xml = Get-Content -LiteralPath $ConfigPath -Raw
        $traceNode = $xml.SelectSingleNode('/configuration/system.web/trace')

        if ($null -eq $traceNode) {
            $result.State = 'PATCHED'
            $result.Note  = 'No <trace> element found; application-level tracing not explicitly enabled here'
            return [pscustomobject]$result
        }

        $enabledAttr   = $traceNode.GetAttribute('enabled')
        $localOnlyAttr = $traceNode.GetAttribute('localOnly')

        if (-not [string]::IsNullOrWhiteSpace($enabledAttr)) {
            $result.Enabled = $enabledAttr
        }
        if (-not [string]::IsNullOrWhiteSpace($localOnlyAttr)) {
            $result.LocalOnly = $localOnlyAttr
        }

        $enabled = $false
        if ($enabledAttr) {
            [void][bool]::TryParse($enabledAttr, [ref]$enabled)
        }

        # Microsoft default is localOnly=true when the attribute is omitted.

        $localOnly = $true
        if ($localOnlyAttr) {
            [void][bool]::TryParse($localOnlyAttr, [ref]$localOnly)
        }

        if ($enabled -and (-not $localOnly)) {
            $result.State = 'VULNERABLE'
            $result.Note  = 'Tracing enabled and remotely viewable (localOnly=false)'
        }
        elseif ($enabled -and $localOnly) {
            $result.State = 'PATCHED'
            $result.Note  = 'Tracing enabled but restricted to localhost (not remotely exposed)'
        }
        else {
            $result.State = 'PATCHED'
            $result.Note  = 'Tracing disabled'
        }

        return [pscustomobject]$result
    }
    catch {
        $result.State = 'UNKNOWN'
        $result.Note  = ('Failed to parse web.config: ' + $_.Exception.Message)
        return [pscustomobject]$result
    }
}

try {
    Import-Module WebAdministration -ErrorAction Stop
}
catch {
    Write-Output 'UNKNOWN - Could not load WebAdministration module. Run on an IIS host with admin rights.'
    exit 2
}

$findings = @()

try {
    $sites = Get-Website
}
catch {
    Write-Output 'UNKNOWN - Could not enumerate IIS websites.'
    exit 2
}

foreach ($site in $sites) {
    try {
        $apps = Get-WebApplication -Site $site.Name -ErrorAction SilentlyContinue
        $allApps = @()

        # Root application for the site

        $rootPath = Resolve-PhysicalPath $site.physicalPath
        $allApps += [pscustomobject]@{
            SiteName      = $site.Name
            AppPath       = '/'
            PhysicalPath  = $rootPath
        }

        foreach ($app in $apps) {
            $appPath = Resolve-PhysicalPath $app.PhysicalPath
            $allApps += [pscustomobject]@{
                SiteName     = $site.Name
                AppPath      = $app.Path
                PhysicalPath = $appPath
            }
        }

        foreach ($appEntry in $allApps) {
            if ([string]::IsNullOrWhiteSpace($appEntry.PhysicalPath)) {
                $findings += [pscustomobject]@{
                    Site       = $appEntry.SiteName
                    AppPath    = $appEntry.AppPath
                    ConfigPath = ''
                    State      = 'UNKNOWN'
                    Enabled    = $null
                    LocalOnly  = $null
                    Note       = 'Could not resolve physical path'
                }
                continue
            }

            $cfg = Join-Path $appEntry.PhysicalPath 'web.config'
            $trace = Get-TraceStateFromConfig -ConfigPath $cfg

            $findings += [pscustomobject]@{
                Site       = $appEntry.SiteName
                AppPath    = $appEntry.AppPath
                ConfigPath = $cfg
                State      = $trace.State
                Enabled    = $trace.Enabled
                LocalOnly  = $trace.LocalOnly
                Note       = $trace.Note
            }
        }
    }
    catch {
        $findings += [pscustomobject]@{
            Site       = $site.Name
            AppPath    = '/'
            ConfigPath = ''
            State      = 'UNKNOWN'
            Enabled    = $null
            LocalOnly  = $null
            Note       = ('Enumeration failure: ' + $_.Exception.Message)
        }
    }
}

$findings | ForEach-Object {
    $enabledText = if ($null -ne $_.Enabled) { $_.Enabled } else { '<default/unspecified>' }
    $localOnlyText = if ($null -ne $_.LocalOnly) { $_.LocalOnly } else { '<default=true/unspecified>' }
    Write-Output ("[{0}] Site='{1}' App='{2}' Enabled='{3}' LocalOnly='{4}' Config='{5}' Note='{6}'" -f $_.State, $_.Site, $_.AppPath, $enabledText, $localOnlyText, $_.ConfigPath, $_.Note)
}

if ($findings.State -contains 'VULNERABLE') {
    Write-Output 'VULNERABLE'
    exit 1
}
elseif (($findings | Where-Object { $_.State -eq 'PATCHED' }).Count -gt 0 -and -not ($findings.State -contains 'UNKNOWN')) {
    Write-Output 'PATCHED'
    exit 0
}
else {
    Write-Output 'UNKNOWN'
    exit 2
}