Fa\u00e7a o download do arquivo de script aqui<\/a>.
\n<#\r\n.SYNOPSIS\r\n This script will set the registry keys required to remediate CVE-2023-36884. Please note that these keys may effect regular functionality of Microsoft Office Products. \r\n These changes can be undone with the -Undo parameter or applied only to specific office products using the -OfficeProducts parameter.\r\n.DESCRIPTION\r\n This script will set the registry keys required to remediate CVE-2023-36884. Please note that these keys may effect regular functionality of Microsoft Office Products. \r\n These changes can be undone with the -Undo parameter or applied only to specific office products using the -OfficeProducts parameter.\r\n.EXAMPLE\r\n (No Parameters)\r\n \r\n Visio was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONVisio.exe to 1\r\n Success!\r\n Word was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWinWord.exe to 1\r\n Success!\r\n Wordpad was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWordpad.exe to 1\r\n Success!\r\n Project was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWinProj.exe to 1\r\n Success!\r\n PowerPoint was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONPowerPoint.exe to 1\r\n Success!\r\n Excel was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONExcel.exe to 1\r\n Success!\r\n Publisher was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONMsPub.exe to 1\r\n Success!\r\n Graph was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONGraph.exe to 1\r\n Success!\r\n Access was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONMSAccess.exe to 1\r\n Success!\r\n\u200b\r\nPARAMETER: -Undo\r\n Remove's the registry keys used for this fix (if they're set at all).\r\n.EXAMPLE\r\n -Undo\r\n \r\n Visio was selected for remediation.\r\n Succesfully removed registry key!\r\n Word was selected for remediation.\r\n Succesfully removed registry key!\r\n Wordpad was selected for remediation.\r\n Succesfully removed registry key!\r\n Project was selected for remediation.\r\n Succesfully removed registry key!\r\n PowerPoint was selected for remediation.\r\n Succesfully removed registry key!\r\n Excel was selected for remediation.\r\n Succesfully removed registry key!\r\n Publisher was selected for remediation.\r\n Succesfully removed registry key!\r\n Graph was selected for remediation.\r\n Succesfully removed registry key!\r\n Access was selected for remediation.\r\n Succesfully removed registry key!\r\n\u200b\r\nPARAMETER: -OfficeProducts \"Excel,Word\"\r\n Set's the registry key for only those products. Can be given an individual product or a comma seperated list. Can also be used in combination with the -Undo parameter Ex. \"Publisher\" or \"Word,Excel,Access\"\r\n.EXAMPLE\r\n -OfficeProducts \"Excel,Word\"\r\n \r\n Word was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWinWord.exe to 1\r\n Success!\r\n Excel was selected for remediation.\r\n Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONExcel.exe to 1\r\n Success!\r\n\u200b\r\n.OUTPUTS\r\n None\r\n.NOTES\r\n General notes\r\n#>\r\n[CmdletBinding()]\r\nparam (\r\n [Parameter()]\r\n [String]$OfficeProducts = \"All\",\r\n [Parameter()]\r\n [Switch]$Undo\r\n)\r\n\u200b\r\nbegin {\r\n\u200b\r\n # Test's if the script is running in an elevated fashion (required for HKLM edits)\r\n function Test-IsElevated {\r\n $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n }\r\n\u200b\r\n # This is just to make setting regkey's easier\r\n function Set-RegKey {\r\n param (\r\n $Path,\r\n $Name,\r\n $Value,\r\n [ValidateSet(\"DWord\", \"QWord\", \"String\", \"ExpandedString\", \"Binary\", \"MultiString\", \"Unknown\")]\r\n $PropertyType = \"DWord\"\r\n )\r\n if (-not $(Test-Path -Path $Path)) {\r\n # Check if path does not exist and create the path\r\n New-Item -Path $Path -Force | Out-Null\r\n }\r\n if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue)) {\r\n # Update property and print out what it was changed from and changed to\r\n $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name\r\n try {\r\n Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n }\r\n catch {\r\n Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n Write-Error $_\r\n exit 1\r\n }\r\n Write-Host \"$Path$Name changed from $CurrentValue to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)\"\r\n }\r\n else {\r\n # Create property with value\r\n try {\r\n New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n }\r\n catch {\r\n Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n Write-Error $_\r\n exit 1\r\n }\r\n Write-Host \"Set $Path$Name to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)\"\r\n }\r\n }\r\n\u200b\r\n # All the microsoft office products with their corresponding dword value\r\n $RemediationValues = @{ \"Excel\" = \"Excel.exe\"; \"Graph\" = \"Graph.exe\"; \"Access\" = \"MSAccess.exe\"; \"Publisher\" = \"MsPub.exe\"; \"PowerPoint\" = \"PowerPnt.exe\"; \"OldPowerPoint\" = \"PowerPoint.exe\" ; \"Visio\" = \"Visio.exe\"; \"Project\" = \"WinProj.exe\"; \"Word\" = \"WinWord.exe\"; \"Wordpad\" = \"Wordpad.exe\" }\r\n}\r\nprocess {\r\n\u200b\r\n # Error out when not elevated\r\n if (-not (Test-IsElevated)) {\r\n Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n exit 1\r\n }\r\n\u200b\r\n # If they have a smaller selection we'll want to filter our remediation list\r\n if ($OfficeProducts -notlike \"All\") {\r\n $OfficeProducts = $OfficeProducts.split(',') | ForEach-Object { $_.Trim() }\r\n $RemediationTargets = $RemediationValues.GetEnumerator() | ForEach-Object { $_ | Where-Object { $OfficeProducts -match $_.Key } }\r\n }\r\n else {\r\n $RemediationTargets = $RemediationValues.GetEnumerator()\r\n }\r\n\u200b\r\n # Path to all the registry keys\r\n $Path = \"Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION\"\r\n\u200b\r\n # We'll want to display an error if we don't have anything to do\r\n if ($RemediationTargets) { \r\n\u200b\r\n # For Each product we're targeting we'll set the regkey. The Set-RegKey function already checks if it was succesful and will display an error and exit if it fails\r\n $RemediationTargets | ForEach-Object { \r\n Write-Host \"$($_.Name) was selected for remediation.\"\r\n if (-not $Undo) {\r\n Set-RegKey -Path $Path -Name $_.Value -Value 1\r\n Write-Host \"Success!\"\r\n }\r\n else {\r\n # If you only applied it to certain products this will error so instead we'll hide the errors and check afterwards if the registry key is there.\r\n Remove-ItemProperty -Path $Path -Name $_.Value -ErrorAction SilentlyContinue | Out-Null\r\n if (Get-ItemProperty -Path $Path -Name $_.Value -ErrorAction SilentlyContinue) {\r\n Write-Error \"[Error] Unable to undo registry key $($_.Value)!\"\r\n exit 1\r\n }\r\n else {\r\n Write-Host \"Succesfully removed registry key!\"\r\n }\r\n }\r\n }\r\n\u200b\r\n Write-Warning \"A reboot may be required.\"\r\n exit 0\r\n }\r\n else {\r\n Write-Host $RemediationTargets\r\n Write-Warning \"No products were selected! The valid value's for -OfficeProducts is listed below you can also use a comma seperated list or simply put 'All'.\"\r\n $RemediationValues | Sort-Object Name | Format-Table | Out-String | Write-Host\r\n Write-Error \"ERROR: Nothing to do!\"\r\n exit 1\r\n }\r\n}<\/pre>\n <\/p>\n<\/p>\n","protected":false},"author":28,"featured_media":140561,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[12457],"class_list":["post-805170","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/script_hub\/805170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/comments?post=805170"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/media\/140561"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/media?parent=805170"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/operating_system?post=805170"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/use_cases?post=805170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.ninjaone.com\/wp-content\/uploads\/2023\/10\/kyle-bohlander.png\")
Autor do roteiro: Kyle Bohlander<\/a>, engenheiro de produtos de software da NinjaOne<\/strong><\/p><\/blockquote>\n