Suscríbase a esta página de la wiki para estar al tanto (botón "Seguir(W)" en la barra de arriba).

# Función para obtener versiones instaladas desde el registro
function Get-DotNetVersions {
    $dotNetVersions = @()
    $ndpBaseKey = "HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP"

    Get-ChildItem -Path $ndpBaseKey -Recurse |
    Where-Object { $_.GetValue("Version") -or $_.GetValue("Release") } |
    ForEach-Object {
        $version = $_.GetValue("Version")
        $release = $_.GetValue("Release")
        $installPath = $_.PSPath
        $keyName = $_.Name -replace '.*\\NDP\\', ''

        if ($version) {
            $dotNetVersions += [PSCustomObject]@{
                Key        = $keyName
                Version    = $version
                Release    = $release
                Path       = $installPath
            }
        }
    }

    return $dotNetVersions
}

# Comprobación contra rangos vulnerables
function Check-VulnerableVersion($versionObj) {
    $results = @()
    $ver = [version]$versionObj.Version

    switch -Wildcard ($versionObj.Key) {
        "v2.0*" {
            if ($ver -ge [version]"2.0.0" -and $ver -lt [version]"3.0.50727.8976") {
                $results += "❌ $($versionObj.Key) versión $ver es vulnerable (rango: 2.0.0 - 3.0.50727.8976)"
            }
        }
        "v3.0*" {
            if ($ver -ge [version]"2.0.0" -and $ver -lt [version]"3.0.50727.8976") {
                $results += "❌ $($versionObj.Key) versión $ver es vulnerable (rango: 2.0.0 - 3.0.50727.8976)"
            }
        }
        "v3.5" {
            if ($ver -ge [version]"10.0.0" -and $ver -lt [version]"10.0.10240.20402") {
                $results += "❌ .NET 3.5 versión $ver es vulnerable (rango: 10.0.0 - 10.0.10240.20402)"
            } elseif ($ver -lt [version]"3.0.30729.8959") {
                $results += "❌ .NET 3.5.1 versión $ver es vulnerable (< 3.0.30729.8959)"
            }
        }
        "v4\Full" {
            # Usar Release para versiones 4.x
            $release = $versionObj.Release
            if ($release) {
                # Obtener versión por Release
                $versionInfo = switch ($release) {
                    { $_ -ge 533325 } { "4.8.1" }
                    { $_ -ge 528040 } { "4.8" }
                    { $_ -ge 461814 } { "4.7.2" }
                    { $_ -ge 461308 } { "4.7.1" }
                    { $_ -ge 460798 } { "4.7" }
                    { $_ -ge 394802 } { "4.6.2" }
                    default { "Desconocida" }
                }

                # Rango 4.7.0 a 4.7.04081.03
                if ($release -ge 460798 -and $release -lt 528040) {
                    $results += "❌ .NET Framework 4.x (Release $release) versión $versionInfo es vulnerable (rango 4.7.0 a 4.8 sin parche)"
                }

                # Rango 4.8.0 a 4.8.04690.02
                if ($versionInfo -eq "4.8" -and $release -lt 528040) {
                    $results += "❌ .NET 4.8 versión $versionInfo (release $release) es vulnerable (< 4.8.04690.02)"
                }

                # Rango 4.8.0 a 4.8.09214.01
                if ($versionInfo -eq "4.8.1" -and $release -lt 533325) {
                    $results += "❌ .NET 4.8.1 versión $versionInfo (release $release) es vulnerable (< 4.8.09214.01)"
                }
            }
        }
    }

    if ($results.Count -eq 0) {
        return "✅ $($versionObj.Key) versión $($versionObj.Version) no es vulnerable"
    } else {
        return $results
    }
}

# Ejecutar comprobación
Write-Host "🔎 Comprobando versiones de .NET Framework instaladas..." -ForegroundColor Cyan
$versions = Get-DotNetVersions

foreach ($v in $versions) {
    $results = Check-VulnerableVersion -versionObj $v
    if ($results -is [array]) {
        $results | ForEach-Object { Write-Host $_ -ForegroundColor Red }
    } else {
        Write-Host $results -ForegroundColor Green
    }
}

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
                   HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
     Where-Object { $_.DisplayName -match ".NET Framework" } |
     Select-Object DisplayName, DisplayVersion | Sort-Object DisplayVersion