There are sometimes hidden gems on twitter in a single picture.
This guy shared a one liner that Lee Holmes showed at the PowerShell Summit 2015.
It’s still relevant. An IP subnet of 255 IP addresses can be pinged in about 458ms 🙂
Here’s how I’ve been taking advantage of this super fast way of pinging computers
Enjoy 😎
The KB4093118 page has just been updated and states:
Note:
- This update replaces update 4100480, Windows kernel update for CVE-2018-1038.
- Resync is required to get newer revision of this KB for WSUS environment
What changed?
(Get-WsusServer).SearchUpdates('2018-04 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4093118)') |
Select PublicationState,@{l='UpdateId';e={$_.Id.UpdateId}},
@{l='RevisionNumber';e={$_.Id.RevisionNumber}},CreationDate,isApproved,isSuperseded |
ft -AutoSize
(Get-WsusServer).SearchUpdates('2018-04 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4093118)') |
ForEach-Object {
$_.GetInstallableItems().Files|
Select Name,Modified,Type,@{l='Size';e={'{0:N2} MB'-f($_.TotalBytes/1MB)}},
@{l='SHA1Hash';e={-join ($_.Hash | ForEach-Object { '{0:X2}' -f $_ })}},
@{l='URI';e={$_.OriginURI.ToString()}}
}
Using the code from this post,
$SyncUpdates | Select Title,
@{l='UpdateId';e={$_.Id.UpdateId}},
@{l='RevisionNumber';e={$_.Id.RevisionNumber}},
CreationDate,PublicationState,isApproved,isDeclined,isSuperseded,has* |
Out-GridView
Notice that a file PCIClearStaleCache.exe has been added and the other files didn’t change (same hashes).
Using this MSDN page to find out the UpdateRelationship value
[Microsoft.UpdateServices.Administration.UpdateRelationship]::UpdatesSupersededByThisUpdate.value__ -eq 6
It’s possible to list what this new patch has susperseded:
(Get-WsusServer).SearchUpdates('2018-04 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4093118)') |
Where-Object { -not($_.isSuperseded)} |
ForEach-Object {
$_ | Add-Member -MemberType ScriptProperty -Name UpdatesSupersededByThisUpdate -Value {
($this.GetRelatedUpdates(6)).Title
} -Force -PassThru
} | Select -Expand UpdatesSupersededByThisUpdate
Conclusion:
It seems for sure that Microsoft has added another binary in the new patch to address the NIC card issue:
Fingers crossed 🙄
I’ve been using Windows 10 and Applocker in ‘Allow mode’ for some time and I need to filter the noise left by the Constrained Mode from the event log.
Windows 10 and PowerShell 5.x introduce a way to protect the interactive shell from copy/paste. If you configure Applocker in ‘Allow mode’ (don’t use default rules when proposed by the GUI), your interactive shell starts in a different LanguageMode named ‘Constrained mode’. Want to read more, start with PowerShell ♥ the Blue Team and about_Language_Modes.
Here’s a quick demo in a picture is worth a thousand words:
Although I’m running an interactive shell with administrative privileges, I cannot use the ToXML() method. I get the symptomatic error message Cannot invoke method. Method invocation is supported only on core types in this language mode.
What’s the challenge here?
It should work in constrained mode and I should figure out the correct XML query 🙄
In other words, I need to find 8007 events from the ‘Microsoft-Windows-AppLocker/MSI and Script’ event log but not those that have the filehash (SHA256) set to: 6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
This hash is well known, it’s a file with only 1 as content.
Here’s the tip:
Bonus:
If you use the GUI, you can copy/paste the above XML query in the eventvwr
Last week I made a private demo about how to discover CIM based modules.
At first, I did:
Get-Module -ListAvailable | Where ModuleType -eq 'CIM'
Based on what’s installed on a workstation or if it’s on a server, either there’s 0 result or the following:
…and that’s not what I really expected and wanted to illustrate.
I wanted actually to show how Microsoft has extended the number of cmdlets using CDXML (cmdlet definition XML).
If I do the following:
Get-NetAdapter | Get-Member
I can see the Get-NetAdapter cmldet returned a CIM instance of the ROOT/StandardCimv2/MSFT_NetAdapter class.
Now, if I query the type of module the Get-NetAdapter cmdlet comes from
Get-Command -Name Get-NetAdapter Get-Module -Name NetAdapter
It’s clear that the NetAdapter module uses a manifest module type instead of CIM based type.
If I continue and show more properties of this NetAdapter module,
Get-Module -Name NetAdapter | Format-List
Nothing really relevant is shown except the fact that this module has nested modules.
Let’s investigate that NestedModules property:
Get-Module -Name NetAdapter | Select -Expand NestedModules
Using the ExpandProperty parameter reveals what I was looking for: the CIM module type.
Using a loop, I can now list the modules that have at least 1 CIM based nested module
Get-Module -ListAvailable |
ForEach-Object {
if ('CIM' -in $_.NestedModules.ModuleType) {
$_
}
}
After that I can do some calculation:
# How many modules have at least 1 CIM based nested module?
Get-Module -ListAvailable |
ForEach-Object {
if ('CIM' -in $_.NestedModules.ModuleType) {
$_
}
} | Measure
# How many cmdlets were added using these "CIM" modules
Get-Module -ListAvailable |
ForEach-Object {
if ('CIM' -in $_.NestedModules.ModuleType) {
Get-Command -Module $_.Name
}
} | Measure
# Over a total of how many cmdlets, regardless modules types? Get-Command | Measure
The MSRC published the following details about CVE-2018-0875 | .NET Core Denial of Service Vulnerability
The .Net Core vulnerability is documented on https://github.com/dotnet/announcements/issues/62. Fine, no problem with that.
But, the version 1.0 of the advisory for CVE-2018-0875 is wrong about PowerShell Core because it just lists 6.0.0 as affected.
It appears actually that both PowerShell Core 6.0.0 and 6.0.1 are affected by CVE-2018-0875.
The CVE-2018-0875 vulneralbility is a Hash Collision issue that can cause a Denial of Service.
If you’ve got PowerShell Core, you need to update to version 6.0.2 using this link
Why?
PowerShell Core is a self contained application that has coreclr embedded as well as other assemblies.
PowerShell Core has been updated to target the updated .NET Core runtime, recompiled and released on this page.
I’ve shown how to get the latest release note in the previous blog post
I’ll now show what can be done with the main “Security Updates” dashboard without the API key available on this page: Security Update Guide > Dashboard
I’ve published two functions: a private one named Get-MSRCDashBoardPage and a public one named Get-MSRCDashBoard
The first private function Get-MSRCDashBoardPage aims at downloading a specific dashboard page based on a time frame. By default, without giving parameters, if there are data published based on the current date, the function gets the first page. There are 3 parameters that can be passed to the function to get another page number and specify another After and Before date. It’s a private function because it’s used by its public counterpart where it’s called recursively for every page found in a specified time range.
As you can see, we get many properties back, much more than what’s displayed by the web interface. 🙄
The second public function Get-MSRCDashBoard aims at doing the same thing as its private counterpart. The difference is that there isn’t a “Page” parameter. It downloads the first page based on the time range specified, it then gets the total number of pages available and calls recursively its private counterpart to download each page.
Now, let’s see this function in action with some examples:
Get-MSRCDashBoard -After 01/01/2018 -Before 01/31/2018
# Save every page to a CSV file
Get-MSRCDashBoard |
Export-Csv -Path ~/Documents/MSRCDashBoard.$((Get-Date).ToString('yyyy-MM')).csv
# Read the CSV and use Out-GridView to look and filter data
Import-CSV ~/Documents/MSRCDashBoard.$((Get-Date).ToString('yyyy-MM')).csv |
Out-GridView
The first command saves every page to a CSV file and the second one reads the CSV file and sends the data to Out-GridView so that you can look and filter data.
Get-MSRCDashBoard -After 02/01/2018 -Before 02/28/2018 | Select publishedDate,cveNumber,Name,Platform,articleTitle1, downloadTitle1,articleTitle2,downloadTitle2,severity,impact | Out-Gridview
Get-MSRCDashBoard | Select publishedDate,cveNumber,Name,Platform,articleTitle1, downloadTitle1,articleTitle2,downloadTitle2,severity,impact | Out-Gridview
Let’s compare the Out-Gridview and the web interface:
PS: The two functions work in PowerShell Core but the “Out-Gridview” cmdlet used in examples isn’t available in PowerShell Core.
I’ve recently talked about a shortcoming of release notes published on the Security Update Guide > Dashboard in the following blog post
As you can see, there’s only the latest release note available. You cannot see previous ones.
If you want to read any release note ever published, you can.
I’ve kept a list of these on this page.
The same shortcoming also exists if you want to retrieve data using some automation.
Whatever date values you submit in a post request, you always get only the latest release note 😦
I’ve started a new project about the MSRC Microsoft Security Updates API in this github repository. I’ve documented why I started this project.
The last point is about to showcase some functions to get data from the portal without using an API key.
Here’s the first example with release notes:
I’ve published so far two functions: Get-MsrcReleaseNoteId and Get-MsrcReleaseNotePage
The first function Get-MsrcReleaseNoteId uses a post request to retrieve the latest release note available and doesn’t have any parameter.
Get-MSRCReleaseNoteId
It shows the release note Id (a GUID) that can be passed to the second function Get-MsrcReleaseNotePage by property name in order to retrieve the release note content as a json object.
Get-MSRCReleaseNoteId | Get-MSRCReleaseNotePage | fl
Notice that the note property is somehow html formatted and would need to be sanitized.
These are not the only functions I’ll showcase, stay tuned 🙂
You know what would be great about release notes:
