Skip to content

Instantly share code, notes, and snippets.

@MHaggis
Created May 19, 2023 16:29
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save MHaggis/76c71de1f206c18531429851baad8e6b to your computer and use it in GitHub Desktop.
Save MHaggis/76c71de1f206c18531429851baad8e6b to your computer and use it in GitHub Desktop.
it works - but use with caution :) it's a bit noisy and I think it's broken
function Scan-LOLDrivers {
param(
[Parameter(Mandatory=$true)]
[string]$path
)
Add-Type -TypeDefinition @"
using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.IO;
using System.Text;
public class FileHashScanner {
public static string ComputeSha256(string path) {
try {
using (FileStream stream = File.OpenRead(path)) {
SHA256Managed sha = new SHA256Managed();
byte[] checksum = sha.ComputeHash(stream);
return BitConverter.ToString(checksum).Replace("-", String.Empty);
}
} catch (Exception) {
return null;
}
}
public static string GetAuthenticodeHash(string path) {
try {
X509Certificate2 cert = new X509Certificate2(path);
return BitConverter.ToString(cert.GetCertHash()).Replace("-", String.Empty);
} catch (Exception) {
return null;
}
}
}
"@
Write-Host "Downloading drivers.json..."
$driversJsonUrl = "https://www.loldrivers.io/api/drivers.json"
$driversJsonContent = Invoke-WebRequest -Uri $driversJsonUrl
$driverData = $driversJsonContent.Content | ConvertFrom-Json
Write-Host "Download complete."
function Scan-Directory {
param([string]$directory)
Get-ChildItem -Path $directory -Recurse -File | ForEach-Object {
$filePath = $_.FullName
Write-Verbose "Computing hash for $filePath..."
$fileHash = [FileHashScanner]::ComputeSha256($filePath)
$fileAuthenticodeHash = [FileHashScanner]::GetAuthenticodeHash($filePath)
foreach ($sample in $driverData.KnownVulnerableSamples) {
if ($fileHash -eq $sample.SHA256) {
Write-Host "SHA256 hash match found: $filePath with hash $fileHash"
}
if ($fileAuthenticodeHash -eq $sample.Authentihash) {
Write-Host "Authenticode hash match found: $filePath with hash $fileAuthenticodeHash"
}
}
}
}
Write-Host "Starting scan..."
Scan-Directory -directory $path
Write-Host "Scan complete."
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment