关联漏洞
标题:Microsoft Windows 输入验证错误漏洞 (CVE-2013-3900)Description:Microsoft Windows是美国微软（Microsoft）公司的一套个人设备使用的操作系统。 Microsoft Windows WinVerifyTrust 函数处理可移植可执行文件(PE)的Windows Authenticode签名验证的方式中存在输入验证错误漏洞。匿名攻击者可以通过修改经过签名的现有可执行文件以利用文件的未验证部分来利用此漏洞，从而向文件添加恶意代码，而无需使签名无效。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完
介绍
#CVE-2013-3900 is a remote code execution vulnerability in the way Microsoft's WinVerifyTrust function handles Windows Authenticode signature verification. This flaw allows an attacker to modify a signed executable file by adding malicious code to an unverified portion #of the file without invalidating its signature.
#The mitigation for this vulnerability is an opt-in feature that requires a specific registry setting. Once enabled, Windows will perform a stricter verification of Authenticode signatures, ensuring that no extraneous data is present in the signed file.
# -WinVerifyTrust-Signature-Validation-CVE-2013-3900-Mitigation
# Define the registry key paths
$regPath32 = "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config"
$regPath64 = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config"
$valueName = "EnableCertPaddingCheck"
$valueData = 1
# Check and create the registry key for 64-bit systems
if (-not (Test-Path $regPath64)) {
New-Item -Path $regPath64 -Force | Out-Null
Write-Host "Created registry path: $regPath64"
}
# Set the registry value for 64-bit systems
Set-ItemProperty -Path $regPath64 -Name $valueName -Value $valueData -Type DWord -Force | Out-Null
Write-Host "Set $valueName to $valueData in $regPath64"
# Check and create the registry key for 32-bit systems
if (-not (Test-Path $regPath32)) {
New-Item -Path $regPath32 -Force | Out-Null
Write-Host "Created registry path: $regPath32"
}
# Set the registry value for 32-bit systems
Set-ItemProperty -Path $regPath32 -Name $valueName -Value $valueData -Type DWord -Force | Out-Null
Write-Host "Set $valueName to $valueData in $regPath32"
Write-Host "`nMitigation script complete."
文件快照
[4.0K] /data/pocs/e2c3c9797efc388c824ac2975d2d3a8fd6dc1962
└── [1.7K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。