1

I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more.

Most of PCs are on WSUS and all of them on a Windows domain. I was looking for tools to detect the problem (either Linux or Windows) and so far I only found the PoC for the exploit:

  • Original exploit here.

This is the microsoft page with the patches released and the information on the vulnerability here

Any ideas, pointers?

Improve this question
4
  • You can write a script that scans your network and once you have the IPs you can use the original exploit to verify if is vulnerable or not
    – camp0
    Aug 8, 2019 at 7:01
  • That will be my solution if I can't find anything else, I'd prefer something less agressive because I'd like to recheck it periodically (in case computers were off)
    – aseques
    Aug 8, 2019 at 7:12
  • 1
    You can filter the results of the network scanner (nmap for example) and filter by operating system and keeps that IPS on a DB(database) so the exploits will be only targeting valid windows hosts.
    – camp0
    Aug 8, 2019 at 7:14
  • Yes, that needs definitely to be done (plus a mechanism to udpate those host lists)
    – aseques
    Aug 9, 2019 at 7:43

1 Answer 1

Reset to default
3

One solution would be to run a Powershell script that uses psremote to iterate all Windows 7 machines in your network and checks if the Microsoft patch is applied with:

wmic qfe list

It will produce an output like this, which shows installed patches with their associated KB number:

Caption                                     Description      FixComments
http://support.microsoft.com/?kbid=4506998  Update           KB4506998
http://support.microsoft.com/?kbid=4465065  Update           KB4465065

Then you check if the KB number you want to check for is in the list. If it's not, you'll have to push the patch to that machine. Also, note that Windows 7 is out of support by January 2020 ( about 4 months while writing this post) and should be upgraded.

The above does not really scale so perhaps you should consider setting up a vulnerability scanning tool. There are many commercial options but also some good free alternatives, check them out here: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools

Improve this answer
3
  • I like your idea a lot, I will try to find a tool that can store detected os for my network so I can reuse this information. Thanks
    – aseques
    Aug 9, 2019 at 6:25
  • 2
    OS is stored as an attribute in your computer objects in Active Directory already :)
    – QuantumSec
    Aug 9, 2019 at 6:47
  • I'm a linux guy, not getting used to the easy path :), gonna check it out.
    – aseques
    Aug 9, 2019 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .