1

I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more.

Most of PCs are on WSUS and all of them on a Windows domain. I was looking for tools to detect the problem (either Linux or Windows) and so far I only found the PoC for the exploit:

  • Original exploit here.

This is the microsoft page with the patches released and the information on the vulnerability here

Any ideas, pointers?

  • You can write a script that scans your network and once you have the IPs you can use the original exploit to verify if is vulnerable or not – camp0 Aug 8 at 7:01
  • That will be my solution if I can't find anything else, I'd prefer something less agressive because I'd like to recheck it periodically (in case computers were off) – aseques Aug 8 at 7:12
  • 1
    You can filter the results of the network scanner (nmap for example) and filter by operating system and keeps that IPS on a DB(database) so the exploits will be only targeting valid windows hosts. – camp0 Aug 8 at 7:14
  • Yes, that needs definitely to be done (plus a mechanism to udpate those host lists) – aseques Aug 9 at 7:43
3

One solution would be to run a Powershell script that uses psremote to iterate all Windows 7 machines in your network and checks if the Microsoft patch is applied with:

wmic qfe list

It will produce an output like this, which shows installed patches with their associated KB number:

Caption                                     Description      FixComments
http://support.microsoft.com/?kbid=4506998  Update           KB4506998
http://support.microsoft.com/?kbid=4465065  Update           KB4465065 

Then you check if the KB number you want to check for is in the list. If it's not, you'll have to push the patch to that machine. Also, note that Windows 7 is out of support by January 2020 ( about 4 months while writing this post) and should be upgraded.

The above does not really scale so perhaps you should consider setting up a vulnerability scanning tool. There are many commercial options but also some good free alternatives, check them out here: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools

  • I like your idea a lot, I will try to find a tool that can store detected os for my network so I can reuse this information. Thanks – aseques Aug 9 at 6:25
  • 2
    OS is stored as an attribute in your computer objects in Active Directory already :) – QuantumSec Aug 9 at 6:47
  • I'm a linux guy, not getting used to the easy path :), gonna check it out. – aseques Aug 9 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.