CVE-2020-1350-checker.ps1

<#
.SYNOPSIS
    Checks if your DNS Server is vulnerable for the Remote Code Execution in the Windows DNS Service.
.DESCRIPTION
    Script is checking if the CVE-2020-1350 is applicable to your Windows Server and whether the proper Windows Update(s) is installed or not.
.EXAMPLE
    PS C:\> .\CVE-2020-1350-checker.ps1
.NOTES
    Created by: T13nn3s
    Date: 15-07-2020
    Check my blog: https://binsec.nl
    Last update: 18-07-2020
#>

If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {   
    $arguments = "& '" + $myinvocation.mycommand.definition + "'"
    Start-Process powershell -Verb runAs -ArgumentList $arguments
    Break
}

function CheckForDNSServer {
    Write-Host "[*] Checking for the Windows DNS Service..."
    $DNSService = Get-Service | where-object { $_.name -like "DNS" } -ErrorAction SilentlyContinue
    if ($DNSService.Status -eq "Running") {
        Write-Host "[+] This server is acting as an Windows DNS Server. CVE-2020-1350 is applicable to this Windows Server." -ForegroundColor Green
    }
    Else {
        Write-Host "[+] This server is not acting as an Windows DNS Server. CVE-2020-1350 is not applicable to this Windows Server." -ForegroundColor Green
        Pause
        break
    } 
}# End CheckForDNSServer function
function CheckIfUpdateIsInstalled {
    

    Write-Host "[*] Checking Windows Version..."
    $OSVersion = (Get-Itemproperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ProductName).ProductName

    if (($OSVersion -eq "Windows Server 2012 Standard") -or ($OSVersion -eq "Windows Server 2012 Datacenter")) {
        Write-Host "[*] Windows Server 2012 detected..."
        Write-Host "[*] Check if security update or monthley rollup is installed..."
        $monthley_W2K2 = Get-HotFix -Id KB4565537 -ErrorAction SilentlyContinue
        $security_W2K2 = Get-HotFix -Id KB4565535 -ErrorAction SilentlyContinue

        if ($monthley_W2K2) {
            Write-Host "[*] *** Windows Update $($monthley_W2K2.HotFixID) is installed on $($monthley_W2K2.InstalledOn). You're not vulnerable ***"
            Write-Host "[+] No workaround needed."
            break
        }
        elseif ($security_W2K2) {
            Write-Host "[*] *** Windows Update $($security_W2K2.HotFixID) is installed on $($security_W2K2.InstalledOn). You're not vulnerable ***"
            Write-Host "[+] No workaround needed."
            break
        }
    }
    elseif ($OSVersion -like "Windows Server 2012 R2*") {
        "[*] Windows Server 2012 R2 detected..."
        Write-Host "[*] Check if security update or monthley rollup is installed..."
        $monthley_W2K2R2 = Get-HotFix -Id KB4565541 -ErrorAction SilentlyContinue
        $security_W2K2R2 = Get-HotFix -Id KB4565540 -ErrorAction SilentlyContinue

        if ($monthley_W2K2R2) {
            Write-Host "[*] *** Windows Update $($monthley_W2K2R2.HotFixID) is installed on $($monthley_W2K2R2.InstalledOn). You're not vulnerable ***"
            Write-Host "[+] No workaround needed."
            break
        }
        elseif ($security_W2K2R2) {
            Write-Host "[*] *** Windows Update $($security_W2K2R2.HotFixID) is installed on $($security_W2K2R2.InstalledOn). You're not vulnerable ***"
            Write-Host "[+] No workaround needed."
            break
        }
    }
    elseif ($OSVersion -like "Windows Server 2016*") {
        "[*] Windows Server 2016 detected..."
        Write-Host "[*] Check if security update or monthley rollup is installed..."
        $security_W2K16 = Get-HotFix -Id KB4565511 -ErrorAction SilentlyContinue

        if ($security_W2K16) {
            Write-Host "[*] *** Windows Update $($security_W2K16.HotFixID) is installed on $($security_W2K16.InstalledOn). You're not vulnerable ***"
            Write-Host "[+] No workaround needed."
            break
        }
        elseif ($OSVersion -like "Windows Server 2019*") {
            "[+] Windows Server 2019 detected..."
            Write-Host "[*] Check if security update or monthley rollup is installed..."
            $security_W2K16 = Get-HotFix -Id KB4558998 -ErrorAction SilentlyContinue
    
            if ($security_W2K16) {
                Write-Host "[*] *** Windows Update $($security_W2K16.HotFixID) is installed on $($security_W2K16.InstalledOn). You're not vulnerable ***"
                Write-Host "[+] No workaround needed."
                break
            }
        }
        Else {
            Write-Host "[-] Windows Update $($kb) is not installed."
        }
    }
} # End function CheckIfUpdateIsInstalled

function Get-Menu {
    param (
        [string]$title = "Workaround for CVE-2020-1350"
    )
    Write-Host ""
    Write-Host "================ $title ================"

    Write-Host "1: Press '1' for check if this service is vulnerable for CVE-2020-1350" 
    Write-Host "2: Press '2' to apply the CVE-2020-1350 workaround to this server (NOTICE: THe Windows DNS Service will be restarted!)"
    Write-Host "Q: Press 'Q' to quit."
} # End function Get-Menu


function Get-RegistryValue {
    param
    (
        [Parameter(Mandatory = $true)]
        $RegistryKey
    )

    $key = Get-Item -Path "Registry::$RegistryKey"
    $key.GetValueNames() |
    ForEach-Object {
        $name = $_
        $rv = 1 | Select-Object -Property Name, Type, Value
        $rv.Name = $name
        $rv.Type = $key.GetValueKind($name)
        $rv.Value = $key.GetValue($name)
        $rv
  
    }
} # End function Get-RegistryValue

function CheckRegDNS {
    param (
        [string]$reg = "HKLM:\SYSTEM\CurrentControlSet\Services\DNS\Parameters\"
    )
    $size = "0xFF00"
    $check = Get-ItemProperty -Path $reg -Name "TcpReceivePacketSize" -ErrorAction SilentlyContinue
    $check_dword = Get-RegistryValue "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\" | Where-Object { $_.name -eq "TcpReceivePacketSize" } -ErrorAction SilentlyContinue


    if (($check.TcpReceivePacketSize -eq $size) -and ($check_dword.type -eq "DWORD")) {
        Write-Host "[+] TcpReceivePacketSize size is set to $($size) and is DWORD"
        Write-Host "[+] You're not vulnerable." -ForegroundColor Green
        break
    }
    elseif ($check.TcpReceivePacketSize -eq $null) {
        Write-Host "[+] TcpReceivePacketSize size is not existing..."
        Write-Host "[-] You're vulnerable." -f yellow 
    }
    Else {
        Write-Host "[*] Workaround is not applied. Please apply workaround (DNS Service is being restarted!) or install the Security Update."
        Write-Host "[-] You're vulnerable." -f yellow
    }
} # End function CheckRegDNS

function SetDNSRegWorkaround {
    Write-Host "[*] Setting the workaround in the registry..."
    $reg = "HKLM:\SYSTEM\CurrentControlSet\Services\DNS\Parameters"
    $value = "0xFF00"

    try {
        Set-ItemProperty -Path $reg -name TcpReceivePacketSize -Type DWORD -value $value -Force
        Write-Host "[+] Setting the workaround in the registry...Done"
    }
    Catch {
        $err = $_.Exception.Message
        Write-Error $err
    }

    # Restarting DNS Service
    Write-Host "[*] Restarting Windows DNS Service..."
    try {
        restart-service DNS
        Write-Host "[+] DNS Service is restarted"
    }
    Catch {
        $err = $_.Exception.Message
        Write-Error $err
    }
    CheckRegDNS
} # End SetDNSRegWorkaround

CheckForDNSServer
CheckIfUpdateIsInstalled

Do {
    Get-Menu
    $HumanInput = Read-Host "Please make a selection"
    switch ($HumanInput) {
        '1' {
            Write-Host 'You chose option #1'
            CheckRegDNS
        } '2' {
            Write-Host 'You chose option #2'
            SetDNSRegWorkaround
        } 'Q' {
            return
        }
    }
    pause
}
until ($HumanInput -eq 'q')