Possible detection of CVE: 2023-01-09T09:08:23.5000000Z Additional Information: 2023-01-08T19:56:29.1492612Z This Event is generated when an attempt to exploit a known vulnerability (2023-01-09T09:08:23.5000000Z) is detected. This Event is raised by a User mode process.
It raises some questions and you may feel insecure and that you’ve a security incident π¦
Solution
False alarm !
Get-Help Get-EventLog -Online
The help of the cmdlet clearly states the following:
Get-EventLogΒ uses a Win32 API that is deprecated. The results may not be accurate.Β
I was about to change the software by deploying its new major version from the same release channel but I encountered an undesired end-user experience. The deployment has been stopped because of the following behavior.
Issue
The Reader 2017 is being successfully replaced by the Reader 2020. If there’s a standard user logged on the computer, his pdf file association is broken.
Yes, I pulled the carpet under his feet but neither Microsoft, nor Adobe offer a decent solution to handle it and update it smoothly.
The end-user is being prompted.
Easy, it’s documented on this page. This great but it doesn’t fix the broken pdf file association.
I remembered a similar issue that I posted here in 2018.
Unfortunately it doesn’t help anymore. The security mechanism still sees that there’s something wrong under the UserChoice key. It’s reported in the event log and there’s a reset.
The irony here is that it’s Adobe Reader that resets it but to MSEdgePDF (D’Oh!)
Solution
My solution consists in not allowing a reset to be performed.
I’m setting a temporary Deny rule on the .pdf registry key.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The key is deleted by a logoff script (using reg.exe import to avoid an access denied) and the computer GPO that handles file association using the official guidance from Microsoft and Adobe restores everything beautifully at next logon.
I wondered how I could get the same in a grid view with PowerShell…
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
I’ve just started working with the DellBIOSProvider module available on the PowerShell Gallery and had to see how to integrate it smoothly in the environment so that it’s compatible with the Constrained language mode.
What could go wrong? π Well, it depends on what you do. If you go down to the Applocker rules path, it depends on the rules, their type, on what’s missing. I’ve listed below a few common road blocks you may encounter:
psd1 or psm1 has a dedicated rule trusting/allowing it while the other doesn’t:
there is/are rule(s) to allow both .psd1 and psm1, but when it loads the dll (listed in the .psd1 manifest file), it fails because there’s a missing rule:
Import-Module : Could not load file or assembly ‘file:///C:\Program Files\WindowsPowerShell\Modules\DellBIOSProvider\2.6.0\DellBIOSProvider.dll’ or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
there is/are rule(s) to allow both .psd1 and psm1, but the .psm1 uses dot sourcing and tries to load single .ps1 file that don’t have an allow rule:
this is what happens when you’ve rule(s) allowing it to load and it’s a 100% success
Solution
It appears that there are 2 solutions.
The 1rst one and the longest is about declaring rules that will allow any file contained in the module. Let’s have a look at the content of the module with the following command:
We can see above that the dll, ps1, psd1, psm1 and cat files are all signed π Only the txt and pdf files are unsigned. These 2 files are not loaded so we don’t care.
At this step, we can choose either to add either: – a single Applocker rule for the Path or – a single Applocker rule containing all the files’ hashes or – a single Applocker rule trusting the Publisher O=DELL INC, L=ROUND ROCK, S=TEXAS, C=US or – a mix of files’ hashes and publisher based rules
I’ve chosen the latest option because it’s the most precise. I’ve listed the rules in this XML policy file.
The Applocker GUI will allow you to create rules for dll, .psd1 and psm1 files if you copy them with a .ps1 file extension π
Let’s see the 2nd solution and the shortest one:
Dell provided a signed catalog file. It contains all the files’ hashes. To trust it, I only have to copy it to its system location. There are various ways of doing this listed on this page.
I was testing group policies, adding, removing them and using gpupdate.exe to apply changes. I messed with the Applocker gpo and set the PC in an unstable state.
I still had my PowerShell console opened but couldn’t use gpupdate.exe anymore. The Start menu wasn’t working anymore… π¦
Here’s what it looks like:
Usually, I’d just restart the computer and the transient state is cleared: either Applocker would work normally or would be disabled.
In this case, I couldn’t restart the computer because of Bitlocker. I was remote and the next time the laptop restarts it’d ask for a PIN. I couldn’t also suspend bitlocker for the next restart or simply disable it. Bad situation actually for Bitlocker, no UI, no cmdlet, no manage-bde.exe… (maybe I could have tried WMI/CIM).
Question: how would you refresh group policies when you cannot use gpupdate.exe
Solution:
I can still type some PowerShell in the opened console but bitlocker cmdlets don’t work.
It appears that there are 2 super hidden scheduled tasks responsible for refreshing group policies in the background.
Yes, super hidden because you cannot see them in the UI as an administrator even though you’ve enabled the “show hidden tasks” option:
Fortunately, the cmdlets of the ScheduledTasks module can interact with these super hidden tasks π
They publish a json version of the catalog. So I wanted a PowerShell function able to get the list of recently added vulnerabilities, the same way it’s presented in this news article from bleepingcomputer.com or this one.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Let’s say you use an advanced feature – ParameterSetName – in your PowerShell code.
Let’s say you don’t specify a default ParameterSetName in the CmdletBinding and that some parameters don’t have an explicitly defined ParameterSetName.
Let’s execute some code and see what we can uncover:
# Execute the function to see that it works
Test-Param
# Check the DefaultParameterSetName specified in the CmdletBinding
(gcm Test-Param).DefaultParameterSet
# Get the properties of the first parameter of the function
(gcm Test-Param).Parameters['Param1']
Everything looks good and is expected so far. Now, let’s have a look at the 3rd parameter that doesn’t have any ParameterSetName defined
(gcm Test-Param).Parameters['Common']
Got it. It seems that when there’s no ParameterSetName defined, its name is: __AllParameterSets
Let’s say, I change the above function and omit the DefaultParameterSetName in the CmdletBinding:
At runtime, there’s an error thrown saying that the parameterSet is ambiguous. Get-Command is still able to see the syntax although the function will fail at runtime.
Let’s use the default parameter name __AllParameterSets instead of Set1 and compare the syntax of the functions
Set1 syntax:
Set1
__AllParameterSets syntax:
__AllParameterSets
Conclusion
Using the default parameter name __AllParameterSets gives us a 3rd way to execute with the Common parameter alone. That parameter is valid and used as well by the 2 other ParameterSetNames I specified in the Param block.
Microsoft recently published the following vulnerability cve-2021-43890 that is currently exploited by malware like Emotet/Trickbot/Bazaloader.
If your computer doesn’t have access to the store, it may not be that straightforward to install the fixed universal app to all users of a Windows 10 computer.
If the computer is not vulnerable, it’ll tell you the above message.
If it installed the required patched universal app, it’ll say “Successfully provisionned Microsoft.DesktopAppInstaller”.
You can run the code in a scheduled tasked running under the System account. Any user that has an interactive session opened will get the new Appx in his account.
If there’s a local user profile but the user is not logged on, it’ll automatically get the updated appx after an interactive logon.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters