x_ops

‍Powershell Setting an execution policy

PoC video

Description

📜This PowerShell script manages the execution policy settings, ensuring proper security measures while allowing necessary scripts to run. It includes logging, error handling, and security checks to prevent unauthorized changes.

🛠️ How to Use It

Run the script with administrator privileges.

1. The script checks the current execution policy and logs its status.
2. If a change is needed, it backs up the current policy.
3. The execution policy is updated based on the specified parameters.
4. The script verifies the change and logs the results.
5. Any errors encountered are logged for debugging.

⚠️ Why It’s Important

Managing execution policies in PowerShell is crucial for security and operational efficiency. This script helps administrators enforce policies, prevent unauthorized script execution, and maintain compliance with security standards. Logging and error handling ensure transparency and traceability of changes.

Extract Linux System Logs

‍Description

📜 This script retrieves and analyzes system logs from /var/log/syslog and systemd journal logs (journalctl). It ensures visibility into system activities, helping administrators monitor logs, troubleshoot issues, and maintain security oversight. The script includes error handling to accommodate different logging mechanisms across Linux distributions.

🛠️ How to Use It

Run the script with standard user or root privileges.

1. It checks if /var/log/syslog exists and retrieves the latest 20 log entries.
2. If the system uses systemd, it fetches the latest 20 log entries via journalctl.
3. The output is structured for readability, making log analysis easier.
4. If neither syslog nor journal logs are found, the script provides a warning.

⚠️ Why It’s Important

System logs are critical for diagnosing errors, auditing security events, and monitoring system health. This script provides a quick, structured way to access logs across both older (SysVinit) and modern (systemd) Linux distributions. By ensuring visibility into key log sources, it helps maintain system integrity, security, and operational efficiency. 🚀

x_detection

Windows Telephony Service Remote Code Execution Vulnerability - Detection Script

PoC video

Description

❗ CVE-2025-21371 is a remote code execution vulnerability affecting the Windows Telephony Service (TapiSrv). This flaw arises due to improper memory handling, allowing attackers to execute arbitrary code on affected systems. If successfully exploited, this vulnerability could grant an attacker the same privileges as the logged-in user. If the compromised user has elevated permissions, the attacker could completely take over the system, potentially leading to unauthorized access, data theft, or system compromise.

ℹ️ This detection script works as follows:

Service Status Check:

• Identifies whether the Telephony Service (TapiSrv) is installed on the system.
• Determines if the service is currently running, as an active service could indicate vulnerability.
• If the service is disabled or stopped, the system is less likely to be at risk.

Error Handling:

• Ensures the script does not break if the service is missing.
• Provides clear status updates about potential vulnerability.

Color-Coded Reporting:

• 🔴 Red indicates the system is potentially vulnerable (service is running).
• 🟢 Green confirms the system is likely not affected (service is disabled or not installed).
• 🔵 Cyan provides general information.

✅ By running this detection script, you can assess whether your system is potentially vulnerable to CVE-2025-21371 based on the status of the Telephony Service.

CVE-2025-21391: Detect Microsoft Storage Vulnerability

Description

🔒 CVE-2025-21391 Detection Script

Detect the Windows Storage Elevation of Privilege Vulnerability (CVE-2025-21391) and get informed about potential system risks.

🔍 How it works:

This script checks if the Windows Storage service (storSvc) is running. If the service is active, the system may be vulnerable to CVE-2025-21391. The script will also recommend applying the latest Microsoft security patches to fully mitigate the vulnerability.

⚠️ Why it matters:

CVE-2025-21391 is a serious vulnerability that can lead to unauthorized file deletions, potentially disrupting system services. Detecting this service activity is critical to identifying and addressing potential risks before exploitation.

x_remediation

Windows Telephony Service Remote Code Execution Vulnerability - Mitigation Script

PoC video

Description

❗ CVE-2025-21371 is a remote code execution vulnerability affecting the Windows Telephony Service (TapiSrv). This flaw arises due to improper memory handling, allowing attackers to execute arbitrary code on affected systems. If successfully exploited, this vulnerability could grant an attacker the same privileges as the logged-in user. If the compromised user has elevated permissions, the attacker could completely take over the system, potentially leading to unauthorized access, data theft, or system compromise.

ℹ️ This mitigation script works as follows:

Disabling the Vulnerable Service:

• Stops the Telephony Service (TapiSrv) if it is currently running.
• Ensures the service cannot restart on system reboot by setting it to disabled.

Error Handling & Verification:

• Detects if the service is missing and avoids unnecessary errors.

Color-Coded Reporting:

🟢 Green confirms successful mitigation.

🟡 Yellow indicates an action was performed (e.g., service stopped).

🔴 Red highlights errors or failed mitigation attempts.

✅ By running this mitigation script, you can reduce the risk of exploitation by disabling the vulnerable service.

CVE-2025-21391: Mitigate Microsoft Storage Vulnerability

Description

🔒 CVE-2025-21391 Mitigation Script

Mitigate the Windows Storage Elevation of Privilege Vulnerability (CVE-2025-21391) without patching, temporarily reducing the risk of exploitation.

🔍 How it works:

This script disables the Windows Storage service (storSvc) to prevent exploitation of the vulnerability. While this doesn’t patch the issue, it reduces the likelihood of attack and provides temporary protection until a patch is applied.

⚠️ Why it matters:

CVE-2025-21391 can lead to file deletion and service disruptions. While this script disables the vulnerable service as a temporary workaround, it is crucial to apply official security patches as soon as possible to fully mitigate the vulnerability and secure your system.

CVE-2024-12754: AnyDesk Mitigation Vulnerability

PoC video

Description

📜This script addresses CVE-2024-12754, a security vulnerability in AnyDesk. The vulnerability may allow unauthorized access, privilege escalation, or remote code execution due to improper security configurations in the application.

The script applies basic security measures to mitigate the risk by:

• Stopping and disabling the AnyDesk service
• Adjusting file permissions on the AnyDesk configuration folder to prevent unauthorized modifications

Affected Systems:

• Windows systems running AnyDesk
• Users with administrative privileges

Potential Impact:

• If left unpatched, the vulnerability could be exploited by attackers to gain remote access, modify settings, or escalate privileges.

🚀 This vulnerability is critical because AnyDesk is widely used for remote desktop access, making it a prime target for attackers. If exploited:

• Remote attackers may gain control over affected machines.
• Malware or persistence mechanisms could be deployed using AnyDesk as a backdoor.
• Confidential information and credentials may be exposed.

By implementing this script, users can temporarily mitigate the risk while waiting for an official patch from AnyDesk.

I hope you enjoy this week's roundup! See you next time.