7-Zip App Vulnerability CVE-2022-29072

By -

 

In the last day or so CVE-2022-29072 was released. This is a vulnerability that allows an attacker to use a malformed 7zip archive to gain local administrator rights to a computer. Until an official patch is released one of the recommended ways to resolve this is to remove the 7-zip.chm file as it is the Windows help system. We have put together a script to do just that.  




$Vols = Get-Volume | Where-Object -Property DriveType -NE "CD-ROM" | Where-Object -Property DriveLetter -ne $null
foreach ($V in $Vols) {
    $Files = (Get-ChildItem -Path $($V.DriveLetter + ":\") -Recurse -Filter "7-zip.chm").FullName
    foreach ($F in $Files) {
        Remove-Item $F -Force
    }
}

You can plug this script into an SCCM package to deploy to all your systems. Since 7zip offers a portable version and some software uses 7zip as a built-in utility we made the script scan all volumes on the computer that are not CD-ROM drives and that have a drive letter for the 7zip help file then delete it. The script will take quite a bit of time to run so you will want to be sure to set the allowed run time for the package to something like 3 hours. 

More comprehensive information on this vulnerability can be found at Toms Hardware. 

Comments

  1. AnonymousApril 26, 2022 at 5:48 AM

    Hello,

    The following error message is displayed to me.
    What could I ruin?

    Method invocation failed because [Microsoft.Management.Infrastructure.CimInstance] does not contain a method named 'op_Addi
    tion'.
    At line:3 char:37
    + $Files = (Get-ChildItem -Path $($V + ":\") -Recurse -Filter "7-zi ...
    + ~~~~~~~~~
    + CategoryInfo : InvalidOperation: (op_Addition:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

    I ran PowerShell in ISE.

    Thanks
    Rhinestone

    ReplyDelete
    Replies
    1. Kris GrossApril 26, 2022 at 6:02 AM

      Yes, there is a typo change $($V + ":\") to $($V.Driveletter + ":\") I have updated the script above too

      Delete

Post a Comment

Popular posts from this blog

SCCM Task Sequence GUI - How to set up the TS to work with a GUI

By -
Image
Before I have posted how you can create a TS for windows 10 , add a GUI to your TS and run a script to configure your windows 10 install . However all of this has become out dated and so I wanted to update all of that. This how to will walk you through how to create a TS that will allow you to choose a windows 10 or windows 7 image, name the computer, add the computer description to AD, Choose form a list what applications you want to install, Choose to enable BitLocker and set the PIN as well as create a local account. Prerequisites: MDT integrated to SCCM A boot image with the following components added Windows Powershell(WinPE-DismCmdlest) HTML(WinPE-HTA) Microsoft .NET (WinPE-NetFx) Windows Powershell (WinPE-Powershell) A windows 10 and windows 7 image  1. Download the package I have put together containing the scripts you will need https://github.com/sccmtst/SCCM-Management-Scripts/tree/master/TSGUI 2. If you have not already done so download and instal
Read more

SCCM Applications vs. SCCM Packages: Understanding the Key Differences

By -
Microsoft System Center Configuration Manager (SCCM) is a versatile and powerful tool for managing devices, applications, and updates in an organization's IT environment. Among its many features, SCCM allows you to deploy software to your end-users in two primary ways: Applications and Packages. Although both methods have a similar goal, they have some key differences that IT administrators should understand when choosing the appropriate deployment method. In this blog post, we will explore these differences and help you decide which option is best for your organization. Definition and Deployment Scenarios SCCM Applications: An SCCM Application is a high-level, user-centric deployment method that focuses on providing the desired user experience. Applications are designed to be state-based, meaning they can detect if the application is already installed and only perform the necessary actions if the application is not present or if a newer version is available. Applications are suita
Read more

How to Deploy a Windows 10 Servicing update as a Application

By -
Image
 When a little after windows 10 build updates started coming out Microsoft released a new feature in SCCM called Windows 10 Serving. This feature is used to deploy windows 10 build to devices, However the deployment status and some of the reporting are not always the most accurate. So I will show you away that you can deploy the update using a standard application deployment. You will need to enable the windows 10 serving feature in your SCCM environment or have access to a SCCM setup that has windows 10 serving enabled.  If you dont have it enabled here is a good way to do so  Download the Windows 10 Serving Update, to do so find the update and right click Download  Once you have the update downloaded navigate to the path you downloaded the update to and copy the content of the GUID folder to a folder in your content library source. You should see a esd file and a WindowsUpdateBox.exe file in the folder. In the folder you copied the content to create a bat file with the following sta
Read more