Como detectar si tu Windows server están protegidos frente Wannacry

Buenas,

Este post no pretende explicar al detalle que es el ransomware Wannacry ni tampoco los devastadores efectos que este malware está creando en números empresas del el pasado viernes 12 de mayo de 2017 asumiendo que los lectores de este post ya se han pegado la pechada de trabajar en el parcheo de sus servidores con las actualización de seguridad MS17-010 la cual protege nuestros sistemas frente a este malware y que se puede encontrar en la siguiente página:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Una vez hemos estado mucho de nosotros parcheando y reiniciando servidores como locos durante el fin de semana, toca hacer el ejercicio de analizar cuales de nuestros sistemas tienen el parche de seguridad y por lo tanto están protegidos y en cuales tenemos que instalarlo.

A fin de automatizar esta tarea Mahesh Chandraiah ha creado el script de powershell detallado a continuación el cual parte de una modificación de siguiente script, el cual está públicado en la Microsoft script gallery y nos permite detectar si una determinada una update está instalada en un sistema remoto haciendo un query de WMI.

Las modificaciones que he realizado en el script por mi parte son minimas, tan solo he añadido los kbs de los parches que protegen de esta vulnerabilidad en las distintas versiones de Windows server y he modificado un poco la lógica para preguntar por un kb u otro dependiendo del sistema operativo de servidor.

Este script sigue usando un fichero de texo como entrada el cual por defecto será c:\temp\computers para leer el hostname de los equipos a chequear.

Y genera una salida en formato Excel, la cual nos permite identificar fácilmente si nuestros sistemas están protegidos o no.

Los requisitos para correr el script son dos y bastante básicos.
– Ejecutar powershell en el equipo que realizamos la comprobación con una cuenta de servicio que pueda enviar querys wmi a los servidores en los que pretendemos detectar si el parche están instalado o no
– Tener Excel instalado en la máquina que ejecutamos el script.

Una vez explicado todo esto solo me queda pegaros el código del script.

#### Spreadsheet Location
$DirectoryToSaveTo = "c:\temp\"
$date=Get-Date -format "yyyy-MM-d"
$Filename="WannaCry_Servers_Patches_status_report"

###InputLocation
$Computers = Get-Content "c:\temp\computers.txt"
# Enter KB to be checked here
$Patchw2k8R2 = "KB4012212"
$Patchw2k8R2MRMAR = "KB4012215"
$Patchw2k8R2MRAPR = "KB4015549"
$Patchw2k8R2MRMAY = "KB4019264"
$Patchw2k12R2 = "KB4012213"
$Patchw2k12R2MRMAR = "KB4012216"
$Patchw2k12R2MRAPR = "KB4015550"
$Patchw2k12R2MRMAY = "KB4019215"
$Patchw2k8 = "KB4012598"
$Patchw2k12 = "KB4012214"
$Patchw2k12MRMAR = "KB4012217"
$Patchw2k12MRAPR = "KB4011551"
$Patchw2k12MRMAY = "KB4019216"
$Patchw2k3 = "KB4012598"

# before we do anything else, are we likely to be able to save the file?
# if the directory doesn't exist, then create it
if (!(Test-Path -path "$DirectoryToSaveTo")) #create it if not existing
{
New-Item "$DirectoryToSaveTo" -type directory | out-null
}

#Create a new Excel object using COM
$Excel = New-Object -ComObject Excel.Application
$Excel.visible = $True
$Excel = $Excel.Workbooks.Add()
$Sheet = $Excel.Worksheets.Item(1)

$sheet.Name = 'Patch status - '
#Create a Title for the first worksheet
$row = 1
$Column = 1
$Sheet.Cells.Item($row,$column)= 'Patch status'

$range = $Sheet.Range("a1","f2")
$range.Merge() | Out-Null
$range.VerticalAlignment = -4160

#Give it a nice Style so it stands out
$range.Style = 'Title'

#Increment row for next set of data
$row++;$row++

#Save the initial row so it can be used later to create a border
#Counter variable for rows
$intRow = $row
$xlOpenXMLWorkbook=[int]51

#Read thru the contents of the Servers.txt file

$Sheet.Cells.Item($intRow,1) ="Name"
$Sheet.Cells.Item($intRow,2) ="status"
$Sheet.Cells.Item($intRow,3) ="Patch status"
$Sheet.Cells.Item($intRow,4) ="OS"
$Sheet.Cells.Item($intRow,5) ="SystemType"
$Sheet.Cells.Item($intRow,6) ="Last Boot Time"

for ($col = 1; $col –le 6; $col++)
{
$Sheet.Cells.Item($intRow,$col).Font.Bold = $True
$Sheet.Cells.Item($intRow,$col).Interior.ColorIndex = 48
$Sheet.Cells.Item($intRow,$col).Font.ColorIndex = 34
}

$intRow++

Function GetStatusCode
{
Param([int] $StatusCode)
switch($StatusCode)
{
0 {"Success"}
11001 {"Buffer Too Small"}
11002 {"Destination Net Unreachable"}
11003 {"Destination Host Unreachable"}
11004 {"Destination Protocol Unreachable"}
11005 {"Destination Port Unreachable"}
11006 {"No Resources"}
11007 {"Bad Option"}
11008 {"Hardware Error"}
11009 {"Packet Too Big"}
11010 {"Request Timed Out"}
11011 {"Bad Request"}
11012 {"Bad Route"}
11013 {"TimeToLive Expired Transit"}
11014 {"TimeToLive Expired Reassembly"}
11015 {"Parameter Problem"}
11016 {"Source Quench"}
11017 {"Option Too Big"}
11018 {"Bad Destination"}
11032 {"Negotiating IPSEC"}
11050 {"General Failure"}
default {"Failed"}
}
}

Function GetUpTime
{
param([string] $LastBootTime)
$Uptime = (Get-Date) - [System.Management.ManagementDateTimeconverter]::ToDateTime($LastBootTime)
"Days: $($Uptime.Days); Hours: $($Uptime.Hours); Minutes: $($Uptime.Minutes); Seconds: $($Uptime.Seconds)"
}

foreach ($Computer in $Computers)
{

TRY {
$OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Computer -ErrorAction SilentlyContinue
$sheetS = Get-WmiObject -Class Win32_ComputerSystem -ComputerName $Computer -ErrorAction SilentlyContinue
$sheetPU = Get-WmiObject -Class Win32_Processor -ComputerName $Computer -ErrorAction SilentlyContinue
$drives = Get-WmiObject -ComputerName $Computer Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} -ErrorAction SilentlyContinue
$pingStatus = Get-WmiObject -Query "Select * from win32_PingStatus where Address='$Computer'"
$OSRunning = $OS.caption + " " + $OS.OSArchitecture + " SP " + $OS.ServicePackMajorVersion
$systemType=$sheetS.SystemType
$date = Get-Date
$uptime = $OS.ConvertToDateTime($OS.lastbootuptime)

#Check patch for windows server 2008 R2
if ($OSRunning -like "*2008 R2*")
{
if
($kb=get-hotfix -id $Patchw2k8r2 -ComputerName $computer -ErrorAction SilentlyContinue )
{
$kbinstall="$Patchw2k8r2 is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k8r2MRMAR -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k8r2MRMAR is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k8r2MRAPR -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k8r2MRAPR is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k8r2MRMAY -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k8r2MRMAY is installed"
}
else
{
$kbinstall="Not installed $Patchw2k8r2 , $Patchw2k8r2MRMAR , $Patchw2k8r2MRAPR or $Patchw2k8r2MRMAY "
}
}
#Check patch for windows server 2012 R2
elseif($OSRunning -like "*2012 R2*")
{
if
($kb=get-hotfix -id $Patchw2k12r2 -ComputerName $computer -ErrorAction SilentlyContinue )
{
$kbinstall="$Patchw2k12r2 is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k12r2MRMAR -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k12r2MRMAR is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k12r2MRAPR -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k12r2MRAPR is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k12r2MRMAY -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k12r2MRMAY is installed"
}
else
{
$kbinstall="Not installed $Patchw2k12r2 , $Patchw2k12r2MRMAR , $Patchw2k12r2MRAPR or $Patchw2k12r2MRMAY "
}
}
#Check patch for windows server 2012
elseif($OSRunning -like "*2012*" -and $OSRunning -notlike '*R2*' )
{
if
($kb=get-hotfix -id $Patchw2k12 -ComputerName $computer -ErrorAction SilentlyContinue )
{
$kbinstall="$Patchw2k12 is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k12MRMAR -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k12MRMAR is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k12MRAPR -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k12MRAPR is installed"
}
elseif ($kb=get-hotfix -id $Patchw2k12MRMAY -ComputerName $computer -ErrorAction SilentlyContinue)
{
$kbinstall="$Patchw2k12MRMAY is installed"
}
else
{
$kbinstall="Not installed $Patchw2k12 , $Patchw2k12MRMAR , $Patchw2k12MRAPR or $Patchw2k12MRMAY "
}
}
#Check patch for windows server 2008
elseif($OSRunning -like "*2008*" -and $OSRunning -notlike '*R2*' )
{
if
($kb=get-hotfix -id $Patchw2k8 -ComputerName $computer -ErrorAction SilentlyContinue )
{
$kbinstall="$Patchw2k8 is installed"
}
else
{
$kbinstall="Not installed $Patchw2k8"
}
}
#Check patch for windows server 2003
elseif($OSRunning -like "*2003*")
{
if
($kb=get-hotfix -id $Patchw2k3 -ComputerName $computer -ErrorAction SilentlyContinue )
{
$kbinstall="$Patchw2k3 is installed"
}
else
{
$kbinstall="Not installed $Patchw2k3"
}
}
else
{
$kbinstall="Operating system not covered for this script"
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

#### Spreadsheet Location

$DirectoryToSaveTo = "c:\temp\"

$date=Get-Date -format "yyyy-MM-d"

$Filename="WannaCry_Servers_Patches_status_report"

###InputLocation

$Computers = Get-Content "c:\temp\computers.txt"

# Enter KB to be checked here

$Patchw2k8R2 = "KB4012212"

$Patchw2k8R2MRMAR = "KB4012215"

$Patchw2k8R2MRAPR = "KB4015549"

$Patchw2k8R2MRMAY = "KB4019264"

$Patchw2k12R2 = "KB4012213"

$Patchw2k12R2MRMAR = "KB4012216"

$Patchw2k12R2MRAPR = "KB4015550"

$Patchw2k12R2MRMAY = "KB4019215"

$Patchw2k8 = "KB4012598"

$Patchw2k12 = "KB4012214"

$Patchw2k12MRMAR = "KB4012217"

$Patchw2k12MRAPR = "KB4011551"

$Patchw2k12MRMAY = "KB4019216"

$Patchw2k3 = "KB4012598"

# before we do anything else, are we likely to be able to save the file?

# if the directory doesn't exist, then create it

if (!(Test-Path -path "$DirectoryToSaveTo")) #create it if not existing

{

New-Item "$DirectoryToSaveTo" -type directory | out-null

}

#Create a new Excel object using COM

$Excel = New-Object -ComObject Excel.Application

$Excel.visible = $True

$Excel = $Excel.Workbooks.Add()

$Sheet = $Excel.Worksheets.Item(1)

$sheet.Name = 'Patch status - '

#Create a Title for the first worksheet

$row = 1

$Column = 1

$Sheet.Cells.Item($row,$column)= 'Patch status'

$range = $Sheet.Range("a1","f2")

$range.Merge() | Out-Null

$range.VerticalAlignment = -4160

#Give it a nice Style so it stands out

$range.Style = 'Title'

#Increment row for next set of data

$row++;$row++

#Save the initial row so it can be used later to create a border

#Counter variable for rows

$intRow = $row

$xlOpenXMLWorkbook=[int]51

#Read thru the contents of the Servers.txt file

$Sheet.Cells.Item($intRow,1) ="Name"

$Sheet.Cells.Item($intRow,2) ="status"

$Sheet.Cells.Item($intRow,3) ="Patch status"

$Sheet.Cells.Item($intRow,4) ="OS"

$Sheet.Cells.Item($intRow,5) ="SystemType"

$Sheet.Cells.Item($intRow,6) ="Last Boot Time"

for ($col = 1; $col –le 6; $col++)

{

$Sheet.Cells.Item($intRow,$col).Font.Bold = $True

$Sheet.Cells.Item($intRow,$col).Interior.ColorIndex = 48

$Sheet.Cells.Item($intRow,$col).Font.ColorIndex = 34

}

$intRow++

Function GetStatusCode

{

Param([int] $StatusCode)

switch($StatusCode)

{

0 {"Success"}

11001 {"Buffer Too Small"}

11002 {"Destination Net Unreachable"}

11003 {"Destination Host Unreachable"}

11004 {"Destination Protocol Unreachable"}

11005 {"Destination Port Unreachable"}

11006 {"No Resources"}

11007 {"Bad Option"}

11008 {"Hardware Error"}

11009 {"Packet Too Big"}

11010 {"Request Timed Out"}

11011 {"Bad Request"}

11012 {"Bad Route"}

11013 {"TimeToLive Expired Transit"}

11014 {"TimeToLive Expired Reassembly"}

11015 {"Parameter Problem"}

11016 {"Source Quench"}

11017 {"Option Too Big"}

11018 {"Bad Destination"}

11032 {"Negotiating IPSEC"}

11050 {"General Failure"}

default {"Failed"}

}

Function GetUpTime

{

param([string] $LastBootTime)

$Uptime = (Get-Date) - [System.Management.ManagementDateTimeconverter]::ToDateTime($LastBootTime)

"Days: $($Uptime.Days); Hours: $($Uptime.Hours); Minutes: $($Uptime.Minutes); Seconds: $($Uptime.Seconds)"

}

foreach ($Computer in $Computers)

{

TRY {

$OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Computer -ErrorAction SilentlyContinue

$sheetS = Get-WmiObject -Class Win32_ComputerSystem -ComputerName $Computer -ErrorAction SilentlyContinue

$sheetPU = Get-WmiObject -Class Win32_Processor -ComputerName $Computer -ErrorAction SilentlyContinue

$drives = Get-WmiObject -ComputerName $Computer Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} -ErrorAction SilentlyContinue

$pingStatus = Get-WmiObject -Query "Select * from win32_PingStatus where Address='$Computer'"

$OSRunning = $OS.caption + " " + $OS.OSArchitecture + " SP " + $OS.ServicePackMajorVersion

$systemType=$sheetS.SystemType

$date = Get-Date

$uptime = $OS.ConvertToDateTime($OS.lastbootuptime)

#Check patch for windows server 2008 R2

if ($OSRunning -like "*2008 R2*")

{

($kb=get-hotfix -id $Patchw2k8r2 -ComputerName $computer -ErrorAction SilentlyContinue )

{

$kbinstall="$Patchw2k8r2 is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k8r2MRMAR -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k8r2MRMAR is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k8r2MRAPR -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k8r2MRAPR is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k8r2MRMAY -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k8r2MRMAY is installed"

}

else

{

$kbinstall="Not installed $Patchw2k8r2 , $Patchw2k8r2MRMAR , $Patchw2k8r2MRAPR or $Patchw2k8r2MRMAY "

}

#Check patch for windows server 2012 R2

elseif($OSRunning -like "*2012 R2*")

{

($kb=get-hotfix -id $Patchw2k12r2 -ComputerName $computer -ErrorAction SilentlyContinue )

{

$kbinstall="$Patchw2k12r2 is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k12r2MRMAR -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k12r2MRMAR is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k12r2MRAPR -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k12r2MRAPR is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k12r2MRMAY -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k12r2MRMAY is installed"

}

else

{

$kbinstall="Not installed $Patchw2k12r2 , $Patchw2k12r2MRMAR , $Patchw2k12r2MRAPR or $Patchw2k12r2MRMAY "

}

#Check patch for windows server 2012

elseif($OSRunning -like "*2012*" -and $OSRunning -notlike '*R2*' )

{

($kb=get-hotfix -id $Patchw2k12 -ComputerName $computer -ErrorAction SilentlyContinue )

{

$kbinstall="$Patchw2k12 is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k12MRMAR -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k12MRMAR is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k12MRAPR -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k12MRAPR is installed"

}

elseif ($kb=get-hotfix -id $Patchw2k12MRMAY -ComputerName $computer -ErrorAction SilentlyContinue)

{

$kbinstall="$Patchw2k12MRMAY is installed"

}

else

{

$kbinstall="Not installed $Patchw2k12 , $Patchw2k12MRMAR , $Patchw2k12MRAPR or $Patchw2k12MRMAY "

}

#Check patch for windows server 2008

elseif($OSRunning -like "*2008*" -and $OSRunning -notlike '*R2*' )

{

($kb=get-hotfix -id $Patchw2k8 -ComputerName $computer -ErrorAction SilentlyContinue )

{

$kbinstall="$Patchw2k8 is installed"

}

else

{

$kbinstall="Not installed $Patchw2k8"

}

#Check patch for windows server 2003

elseif($OSRunning -like "*2003*")

{

($kb=get-hotfix -id $Patchw2k3 -ComputerName $computer -ErrorAction SilentlyContinue )

{

$kbinstall="$Patchw2k3 is installed"

}

else

{

$kbinstall="Not installed $Patchw2k3"

}

else

{

$kbinstall="Operating system not covered for this script"

}

Espero que os resulte útil

Un saludo

Samuel López posted at 2017-5-16 Category: Articulos IT

El Baúl Del ITPRO