diff --git a/Vulnerability Scripts/Compromised Host Files/VULN - Compromised Windows Host File – Google.ps1 b/Vulnerability Scripts/Compromised Host Files/VULN - Compromised Windows Host File – Google.ps1 new file mode 100644 index 0000000..d239799 --- /dev/null +++ b/Vulnerability Scripts/Compromised Host Files/VULN - Compromised Windows Host File – Google.ps1 @@ -0,0 +1,47 @@ +<# +Author: Gabe Kerntke +Date: 04-26-2024 + +.Synopsis + +.Modified +2024-04-26 (GabeK) - Original script created + +#> + +#Region Variables +$URL = "play.google.com" +$HostFileTest = Get-Content "C:\Windows\System32\drivers\etc\hosts" | Where-Object { $_ -like "*$URL*" } +$HostFilePath = "C:\Windows\System32\drivers\etc\hosts" +$HostFile = Get-Content "C:\Windows\System32\drivers\etc\hosts" + +#Region Script Start + +#If the $URL exists in the host file it continues with the fix +If ($null -ne $HostFileTest) { + #Makes copy of Host file before making changes + Copy-Item $HostFilePath -Destination "C:\Windows\System32\drivers\etc\hosts - backup" -Force + #Makes the change to the Host file + $NewFile = $HostFile -replace "127.0.0.1", "#" -replace "play.google.com", "#" + + Try { + #Sees if the changes to the Host file can saved + Set-Content -Value $NewFile -Path $HostFilePath -Force -ErrorAction Stop + } + + catch { + #If error occurs with saving new Host file, revert to backup Host file + Copy-Item "C:\Windows\System32\drivers\etc\hosts - backup" -Destination $HostFilePath -Force + Write-Host "Failed to modify host file, exiting script" + Break + } + + Write-Host "Host file has been modified" + #Removes backup Host file + Remove-Item "C:\Windows\System32\drivers\etc\hosts - backup" +} + +Else { + Write-Host "$URL does not exist in host file, exiting script." +} +#Region Script End \ No newline at end of file