Skip to content

Instantly share code, notes, and snippets.

@werybigmonk

werybigmonk/check_vulnerabledrivers.ps1

Forked from api0cradle/check_vulnerabledrivers.ps1
Last active May 31, 2023 10:56
Show Gist options
  • Save werybigmonk/9fea236f4c6fa1a81e99dec7f0025bb5 to your computer and use it in GitHub Desktop.
Save werybigmonk/9fea236f4c6fa1a81e99dec7f0025bb5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. werybigmonk revised this gist May 31, 2023. 1 changed file with 7 additions and 3 deletions.
    10 changes: 7 additions & 3 deletions check_vulnerabledrivers.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,18 +1,22 @@
    # Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
    # Author: Oddvar Moe - @oddvar.moe

    $drivers = get-childitem -Path c:\windows\system32\drivers
    # Fork changes:
    # Drivers can also reside in driverstore\filerepository subdir
    # To check them also, $drivers should be with -recurse and get-filehash from real file $drivers file rather than assumed system32 path with filename

    $drivers = get-childitem -Path c:\windows\system32\drivers -recurse
    $web_client = new-object system.net.webclient
    $loldrivers = $web_client.DownloadString(" https://www.loldrivers.io/api/drivers.json") | ConvertFrom-Json

    Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)
    Write-output("Checking {0} drivers in C:\windows\system32\drivers\* against loldrivers.io json file" -f $drivers.Count)
    foreach ($lol in $loldrivers.KnownVulnerableSamples)
    {
    # Check for matching driver name
    if($drivers.Name -contains $lol.Filename)
    {
    #CHECK HASH
    $Hash = Get-FileHash -Path "c:\windows\system32\drivers\$($lol.Filename)"
    $Hash = ( $drivers | where Name -eq $lol.Filename | Get-FileHash )
    if($lol.Sha256 -eq $Hash.Hash)
    {
    write-output("The drivername {0} is vulnerable with a matching SHA256 hash of {1}" -f $lol.Filename, $lol.SHA256)
  2. @api0cradle api0cradle created this gist May 19, 2023.
    21 changes: 21 additions & 0 deletions check_vulnerabledrivers.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    # Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
    # Author: Oddvar Moe - @oddvar.moe

    $drivers = get-childitem -Path c:\windows\system32\drivers
    $web_client = new-object system.net.webclient
    $loldrivers = $web_client.DownloadString(" https://www.loldrivers.io/api/drivers.json") | ConvertFrom-Json

    Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)
    foreach ($lol in $loldrivers.KnownVulnerableSamples)
    {
    # Check for matching driver name
    if($drivers.Name -contains $lol.Filename)
    {
    #CHECK HASH
    $Hash = Get-FileHash -Path "c:\windows\system32\drivers\$($lol.Filename)"
    if($lol.Sha256 -eq $Hash.Hash)
    {
    write-output("The drivername {0} is vulnerable with a matching SHA256 hash of {1}" -f $lol.Filename, $lol.SHA256)
    }
    }
    }