[技术讨论] PowerShell检查NSA永恒之蓝MS17-010漏洞补丁

ShowCode

# Windows XP, Windows Vista, Windows 8, Windows Server 2008
Get-HotFix | Where-Object { $_.HotfixID -eq 'KB4012598' } | Format-Table -AutoSize
 
# Windows 7 SP1, Windows Server 2008 R2 SP1
Get-HotFix | Where-Object { $_.HotfixID -eq 'KB4012212' -or $_.HotfixID -eq 'KB4012215' } | Format-Table -AutoSize
 
# Windows 8.1, Windows Server 2012 R2
Get-HotFix | Where-Object { $_.HotfixID -eq 'KB4012213' -or $_.HotfixID -eq 'KB4012216' } | Format-Table -AutoSize
 
# Windows Server 2012
Get-HotFix | Where-Object { $_.HotfixID -eq 'KB4012214' -or $_.HotfixID -eq 'KB4012217' } | Format-Table -AutoSize
 
# Windows 10
Get-HotFix | Where-Object { $_.HotfixID -eq 'KB4012606' -or $_.HotfixID -eq 'KB4013198' -or $_.HotfixID -eq 'KB4013429' } | Format-Table -AutoSizeCOPY

参考信息：
https://technet.microsoft.com/zh-cn/library/security/MS17-010
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

ShowCode

回复 10# xxbdh


    我的Win7安装KB4012212之后用这个方法查不出来

xxbdh

命令行下用 systeminfo | find "KB4012606" 是不是更简单些？

ShowCode

回复 5# codegay


    6.0现在是Beta版吧，不知道将来GA的版本会怎样。

codegay

回复 7# 老刘1号


    不是我不知道没有。
而是我不知道为什么没有。

老刘1号

回复 5# codegay


    Get-WmiObject和Get-HotFix这俩个Cmdlet都没有……

老刘1号

表示端口全部关了……

codegay

6.0是在官方的github下载安装的。。

PS C:\Program Files\PowerShell\6.0.0.17> Get-WmiObject -Query "Select * from Win32_QuickFixEngineering where HotFixID= 'KB4012212'"
Get-WmiObject : The term 'Get-WmiObject' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the s
pelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ Get-WmiObject -Query "Select * from Win32_QuickFixEngineering where H ...
+ ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-WmiObject:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundExceptionCOPY

对PS不懂。不知道是怎么回事了。

ShowCode

回复 3# codegay


你的版本好高，我的 Win 7 + PS 4.0 没问题。试试这个呢：

Get-WmiObject -Query "Select * from Win32_QuickFixEngineering where HotFixID= 'KB4012212'"COPY

codegay

ps 6.0
windows 7

codegay

Get-HotFix : The term 'Get-HotFix' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spellin
g of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ Get-HotFix | Where-Object { $_.HotfixID -eq 'KB4012606' -or $_.Hotfix ...
+ ~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-HotFix:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundExceptionCOPY