MS10-041: XML签名HMAC截断绕过漏洞

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

$PathToILDASM = “C:\Program Files\Microsoft.NET\SDK\2.0\Bin”
$FilesToScan = get-childitem -Filter *.exe -Recurse
$FilesToScan += get-childitem -Filter *.dll -Recurse
“Found " + $FilesToScan.Count + " EXE and DLL file(s) to scan”
""
“Binaries that contain calls to System.Security.Cryptography.Xml.SignedXml.CheckSignature(KeyedHashAlgorithm macAlg):”
foreach($File in $FilesToScan)
{
$FileName = $File.FullName
if (([string]$FileName).Length -gt 0)
{
$Process = New-Object -typeName System.Diagnostics.Process
$Process.StartInfo.WorkingDirectory = (get-location).Path
$Process.StartInfo.UseShellExecute = $false
$Process.StartInfo.RedirectStandardOutput = $true
$Process.StartInfo.RedirectStandardError = $true
$Process.StartInfo.FileName = [System.IO.Path]::Combine($PathToILDASM, “ildasm.exe”)
$Process.StartInfo.Arguments = “/OUT=temp.txt `"$FileName`” /NOBAR"
$Process.Start() | out-null
$Process.WaitForExit()
if (Test-Path temp.txt)
{
$Disassembly = Get-Content temp.txt
del temp.txt
if (([string]$Disassembly).Contains(“callvirt instance bool [System.Security]System.Security.Cryptography.Xml.SignedXml::CheckSignature(class [mscorlib]System.Security.Cryptography.KeyedHashAlgorithm)”))
{
$File.FullName
}
}
}
}