search

Ryan2065 / Log4ShellDetection

MIT License
5 stars 1 forks source link

feedback on v1.4.1 #2

Closed MaartenPauchet closed 2 years ago

MaartenPauchet commented 2 years ago

Hi Ryan,

thanks for the significant update. Do have a couple of questions and remarks. Hope you have some time look into this as you did before. (take your time, family comes first!)

couple of small bugs I found:

  1. You added a new outputtype 'CountVulnerable' per my request to be able to use the script in a CI in MECM. The problem is that if you use it together with the "TatooRegistry" flag parameter it will not return the number of vulnerable files to the system because the
    elseif($OutputType -eq "Registry" -or $TatooRegistry){ comes first and because it's executed all other "elseif's " are passed over. Thus no number is returned. Since I need the CI to do the checks, but I also need the regTattoo for the hw inventory this should be able to work together. I fixed it by moving the Registry -or $TatooRegistry elseif to its own seperate "if". There's probably other ways to do this but it works now.

  2. Another small typo I think is around line 771: $Result.DetectedVersion += @($hashCheckResult.Version) Since the "version" was removed from the Log4ShellIds array, should this not be "mavenversion"?

As a remark, I also added an extra regkey with the date/time of detection in there. That propagates to the reporting so if we get an old dat in there we just know that the machine has not been re-running the detection script since then...

Thanks again for the hard work! Maarten

Ryan2065 commented 2 years ago

Thanks for the feedback! I incorporated all of this into an update 1.4.2. The new registry property is "LastScanTime" and is UTC format of yyyyMMddhhmmss