Microsoft

# check-dotnet-unsupported.ps1

# Exit codes:

#   0 = PATCHED

#   1 = VULNERABLE

#   2 = UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-RegValue {
    param(
        [Microsoft.Win32.RegistryView]$View,
        [string]$SubKey,
        [string]$ValueName
    )
    try {
        $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $View)
        $key = $base.OpenSubKey($SubKey)
        if ($null -eq $key) { return $null }
        return $key.GetValue($ValueName, $null)
    } catch {
        return $null
    }
}

function Test-KeyPresent {
    param(
        [Microsoft.Win32.RegistryView]$View,
        [string]$SubKey
    )
    try {
        $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $View)
        $key = $base.OpenSubKey($SubKey)
        return ($null -ne $key)
    } catch {
        return $false
    }
}

$views = @([Microsoft.Win32.RegistryView]::Registry64, [Microsoft.Win32.RegistryView]::Registry32)
$reasons = New-Object System.Collections.Generic.List[string]
$checkedSomething = $false

# Detect .NET 3.5 SP1 (supported runtime for 1.0-3.5 apps on supported OSes)

$net35Installed = $false
foreach ($view in $views) {
    $v35Install = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5' -ValueName 'Install'
    if ($v35Install -eq 1) {
        $net35Installed = $true
        $checkedSomething = $true
        break
    }
}

# Detect .NET 4.x using Release key

$release = $null
foreach ($view in $views) {
    $tmp = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' -ValueName 'Release'
    if ($null -ne $tmp) {
        $release = [int]$tmp
        $checkedSomething = $true
        break
    }
}

if ($null -ne $release) {
    # 4.6.2 minimum supported baseline for 4.x branches

    if ($release -lt 394802) {
        $reasons.Add("Unsupported .NET 4.x detected (Release=$release, below 4.6.2 minimum)")
    }
} else {
    # No 4.5+ release key. Check for older 4.0 installs.

    foreach ($view in $views) {
        $v4ClientInstall = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client' -ValueName 'Install'
        $v4FullInstall   = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full'   -ValueName 'Install'
        if ($v4ClientInstall -eq 1 -or $v4FullInstall -eq 1) {
            $checkedSomething = $true
            $reasons.Add('Unsupported .NET 4.0/4.5-era installation detected without supported 4.5+ Release key')
            break
        }
    }
}

# Detect standalone 2.0 / 3.0. If 3.5 SP1 is installed, those app runtimes are serviced under 3.5 support.

foreach ($view in $views) {
    $v20 = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727' -ValueName 'Install'
    if ($v20 -eq 1) {
        $checkedSomething = $true
        if (-not $net35Installed) {
            $reasons.Add('Standalone .NET 2.0 detected without .NET 3.5 SP1 support context')
        }
        break
    }
}

foreach ($view in $views) {
    $v30 = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.0\Setup' -ValueName 'InstallSuccess'
    if ($v30 -eq 1) {
        $checkedSomething = $true
        if (-not $net35Installed) {
            $reasons.Add('Standalone .NET 3.0 detected without .NET 3.5 SP1 support context')
        }
        break
    }
}

# Detect very old 1.1

foreach ($view in $views) {
    $v11 = Get-RegValue -View $view -SubKey 'SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322' -ValueName 'Install'
    if ($v11 -eq 1) {
        $checkedSomething = $true
        $reasons.Add('Unsupported .NET 1.1 detected')
        break
    }
}

# Report

if ($reasons.Count -gt 0) {
    Write-Output 'VULNERABLE'
    $reasons | ForEach-Object { Write-Output $_ }
    exit 1
}

if ($checkedSomething) {
    Write-Output 'PATCHED'
    if ($null -ne $release) {
        Write-Output ("Supported .NET 4.x Release key detected: {0}" -f $release)
    } elseif ($net35Installed) {
        Write-Output 'Supported .NET 3.5 SP1 runtime detected and no unsupported standalone legacy branches found'
    } else {
        Write-Output 'No unsupported .NET Framework branches detected by registry inspection'
    }
    exit 0
}

Write-Output 'UNKNOWN'
Write-Output 'Could not determine installed .NET Framework state from expected registry keys'
exit 2