# VulnerabilityScanner.ps1 - Scan for known Windows Server 2003 vulnerabilities
$vulnerabilities = @(
    @{CVE="CVE-2017-0144"; Name="EternalBlue"; Service="SMBv1"; Critical=$true},
    @{CVE="CVE-2019-0708"; Name="BlueKeep"; Service="RDP"; Critical=$true},
    @{CVE="CVE-2021-34527"; Name="PrintNightmare"; Service="Spooler"; Critical=$true},
    @{CVE="CVE-2020-1472"; Name="Zerologon"; Service="Netlogon"; Critical=$true},
    @{CVE="CVE-2021-42287"; Name="sAMAccountName"; Service="KDC"; Critical=$true}
)

$results = @()
foreach($vuln in $vulnerabilities) {
    $status = "Unknown"
    $mitigated = $false

    # Check service status
    $service = Get-Service -Name $vuln.Service -ErrorAction SilentlyContinue
    if($service) {
        if($service.Status -eq "Running") {
            $status = "VULNERABLE - Service Running"
        } else {
            $status = "Mitigated - Service Disabled"
            $mitigated = $true
        }
    }

    $results += [PSCustomObject]@{
        CVE = $vuln.CVE
        Name = $vuln.Name
        Service = $vuln.Service
        Status = $status
        Critical = $vuln.Critical
        Mitigated = $mitigated
    }
}

$results | Format-Table -AutoSize
$results | Export-Csv -Path "VulnerabilityReport_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Count critical unmitigated vulnerabilities
$criticalCount = ($results | Where-Object {$_.Critical -and -not $_.Mitigated}).Count
Write-Host "`nCRITICAL: $criticalCount unmitigated critical vulnerabilities found!" -ForegroundColor Red

@echo off
:: MissingPatchAnalysis.bat - Analyze missing patches since EOL

echo Windows Server 2003 Missing Patch Analysis > MissingPatches.txt
echo ========================================== >> MissingPatches.txt
echo. >> MissingPatches.txt

:: Last installed updates
echo Last Installed Updates: >> MissingPatches.txt
wmic qfe list brief /format:table >> MissingPatches.txt

:: Calculate days since last patch
echo. >> MissingPatches.txt
echo Days Since End of Support: >> MissingPatches.txt
powershell -Command "(New-TimeSpan -Start '2015-07-14' -End (Get-Date)).Days" >> MissingPatches.txt

:: Estimate missing patches (average 10 critical/month)
echo. >> MissingPatches.txt
echo Estimated Missing Security Patches: >> MissingPatches.txt
powershell -Command "[math]::Round((New-TimeSpan -Start '2015-07-14' -End (Get-Date)).Days / 30 * 10)" >> MissingPatches.txt

type MissingPatches.txt

@echo off
:: CriticalServiceLockdown.bat - Disable vulnerable services

echo EMERGENCY SERVICE LOCKDOWN
echo =========================
echo.
echo This will disable critical vulnerable services.
echo Only proceed if you understand the impact!
echo.
pause

:: Disable SMBv1 (EternalBlue)
echo Disabling SMBv1...
sc config lanmanserver start= disabled
sc stop lanmanserver
reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /v SMB1 /t REG_DWORD /d 0 /f

:: Disable Print Spooler (PrintNightmare)
echo Disabling Print Spooler...
sc stop spooler
sc config spooler start= disabled

:: Restrict RDP (BlueKeep)
echo Securing RDP...
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 2 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t REG_DWORD /d 3 /f

:: Disable unnecessary protocols
echo Disabling vulnerable protocols...
netsh int ipv6 set global randomizeidentifiers=disabled
netsh int tcp set global autotuninglevel=disabled

echo.
echo Lockdown complete. Some services may need manual restart.

# NetworkMitigations.ps1 - Apply network-level security mitigations

# Block vulnerable ports at Windows Firewall
$vulnerablePorts = @(
    @{Port=135; Protocol="TCP"; Name="RPC Endpoint Mapper"},
    @{Port=139; Protocol="TCP"; Name="NetBIOS Session"},
    @{Port=445; Protocol="TCP"; Name="SMB"},
    @{Port=3389; Protocol="TCP"; Name="RDP"; AllowFrom="10.0.0.0/8"},
    @{Port=1433; Protocol="TCP"; Name="SQL Server"},
    @{Port=5985; Protocol="TCP"; Name="WinRM"}
)

Write-Host "Applying network mitigations..." -ForegroundColor Yellow

foreach($rule in $vulnerablePorts) {
    # Block by default
    netsh advfirewall firewall add rule name="Block_$($rule.Name)" `
        dir=in action=block protocol=$($rule.Protocol) localport=$($rule.Port)

    # Add exception if specified
    if($rule.AllowFrom) {
        netsh advfirewall firewall add rule name="Allow_$($rule.Name)_Internal" `
            dir=in action=allow protocol=$($rule.Protocol) localport=$($rule.Port) `
            remoteip=$($rule.AllowFrom)
    }

    Write-Host "Blocked port $($rule.Port) ($($rule.Name))"
}

# Enable Windows Firewall if disabled
netsh advfirewall set allprofiles state on
Write-Host "Windows Firewall enabled on all profiles" -ForegroundColor Green

Windows Registry Editor Version 5.00

; Emergency Security Hardening for Windows Server 2003
; Apply with: regedit /s EmergencyHardening.reg

; Disable LLMNR
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient]
"EnableMulticast"=dword:00000000

; Disable NBT-NS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
"NodeType"=dword:00000002

; Disable Autorun
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

; Restrict Anonymous Access
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"RestrictAnonymous"=dword:00000002
"RestrictAnonymousSAM"=dword:00000001
"EveryoneIncludesAnonymous"=dword:00000000

; Disable LM Hash Storage
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"NoLMHash"=dword:00000001

; Enable UAC-like Elevation Prompt
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000002
"EnableLUA"=dword:00000001

; Disable Admin Shares
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareWks"=dword:00000000
"AutoShareServer"=dword:00000000

# Install0patch.ps1 - Install and configure 0patch for micro-patches
$0patchURL = "https://0patch.com/download/0patchSetup.exe"
$installerPath = "$env:TEMP\0patchSetup.exe"

Write-Host "Downloading 0patch..." -ForegroundColor Yellow
Invoke-WebRequest -Uri $0patchURL -OutFile $installerPath

Write-Host "Installing 0patch..." -ForegroundColor Yellow
Start-Process -FilePath $installerPath -ArgumentList "/VERYSILENT" -Wait

# Configure 0patch
$0patchConfig = @{
    AutoUpdate = $true
    SilentMode = $true
    ReportingEnabled = $true
}

# Apply configuration
$configPath = "${env:ProgramFiles}\0patch\Agent\Config"
$0patchConfig | ConvertTo-Json | Out-File "$configPath\settings.json"

Write-Host "0patch installed and configured" -ForegroundColor Green
Write-Host "Note: This provides LIMITED protection only!" -ForegroundColor Red

@echo off
:: VirtualPatching.bat - Configure IPS rules for virtual patching

echo Configuring Virtual Patching Rules
echo ==================================

:: Create Snort rules for known exploits
mkdir C:\VirtualPatch 2>nul

echo # Snort Rules for Windows Server 2003 Virtual Patching > C:\VirtualPatch\local.rules

:: EternalBlue detection
echo alert tcp any any -> any 445 (msg:"EXPLOIT EternalBlue Attempt"; >> C:\VirtualPatch\local.rules
echo content:"|ff 53 4d 42 72 00 00 00 00 18 53 c8|"; >> C:\VirtualPatch\local.rules
echo flow:to_server,established; sid:1000001; rev:1;) >> C:\VirtualPatch\local.rules

:: BlueKeep detection
echo alert tcp any any -> any 3389 (msg:"EXPLOIT BlueKeep Attempt"; >> C:\VirtualPatch\local.rules
echo content:"|03 00 00 13 0e e0|"; depth:6; >> C:\VirtualPatch\local.rules
echo flow:to_server,established; sid:1000002; rev:1;) >> C:\VirtualPatch\local.rules

:: PrintNightmare detection
echo alert tcp any any -> any 445 (msg:"EXPLOIT PrintNightmare Attempt"; >> C:\VirtualPatch\local.rules
echo content:"RpcAddPrinterDriverEx"; nocase; >> C:\VirtualPatch\local.rules
echo flow:to_server,established; sid:1000003; rev:1;) >> C:\VirtualPatch\local.rules

echo.
echo Virtual patching rules created in C:\VirtualPatch\local.rules
echo Deploy these to your IPS/IDS system

' PatchIIS6.vbs - Apply emergency mitigations to IIS 6.0
On Error Resume Next

' Disable dangerous ISAPI extensions
Set objIIS = GetObject("IIS://localhost/W3SVC")
dangerousExtensions = Array(".printer", ".htw", ".ida", ".idq", ".htr", ".idc", ".shtm", ".shtml", ".stm")

For Each ext In dangerousExtensions
    objIIS.ScriptMaps.Remove(ext)
    WScript.Echo "Removed mapping for: " & ext
Next

objIIS.SetInfo()

' Configure URLScan
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.CreateTextFile("C:\WINDOWS\system32\inetsrv\urlscan\urlscan.ini", True)

objFile.WriteLine "[Options]"
objFile.WriteLine "UseAllowVerbs=1"
objFile.WriteLine "UseAllowExtensions=1"
objFile.WriteLine "NormalizeUrlBeforeScan=1"
objFile.WriteLine "VerifyNormalization=1"
objFile.WriteLine "AllowHighBitCharacters=0"
objFile.WriteLine "AllowDotInPath=0"
objFile.WriteLine "RemoveServerHeader=1"
objFile.WriteLine ""
objFile.WriteLine "[AllowVerbs]"
objFile.WriteLine "GET"
objFile.WriteLine "HEAD"
objFile.WriteLine "POST"
objFile.WriteLine ""
objFile.WriteLine "[DenyExtensions]"
For Each ext In dangerousExtensions
    objFile.WriteLine ext
Next

objFile.Close
WScript.Echo "IIS 6.0 emergency patches applied"

-- SQLServerMitigations.sql - Emergency security for SQL Server

-- Disable xp_cmdshell
EXEC sp_configure 'show advanced options', 1
RECONFIGURE
EXEC sp_configure 'xp_cmdshell', 0
RECONFIGURE

-- Disable SQL Agent proxies
EXEC msdb.dbo.sp_enum_proxy
-- Drop any unnecessary proxies

-- Remove sample databases
IF EXISTS (SELECT * FROM sys.databases WHERE name = 'Northwind')
    DROP DATABASE Northwind
IF EXISTS (SELECT * FROM sys.databases WHERE name = 'pubs')
    DROP DATABASE pubs

-- Disable unnecessary network protocols
-- Run in command prompt:
-- svrnetcn.exe - Disable all except TCP/IP

-- Create login trigger for monitoring
CREATE TRIGGER connection_limit_trigger
ON ALL SERVER
FOR LOGON
AS
BEGIN
    IF ORIGINAL_LOGIN() NOT IN ('sa', 'DOMAIN\SQLService', 'DOMAIN\DBAs')
    BEGIN
        -- Log suspicious connection
        INSERT INTO master.dbo.SecurityLog (EventTime, Login, IPAddress)
        VALUES (GETDATE(), ORIGINAL_LOGIN(), CONNECTIONPROPERTY('client_net_address'))
    END
END

PRINT 'SQL Server emergency mitigations applied'

# ThreatMonitor.ps1 - Real-time monitoring for exploit attempts
$logFile = "C:\SecurityLogs\ThreatMonitor.log"
$alertEmail = "security@company.com"

# Event IDs to monitor
$suspiciousEvents = @(
    @{ID=4625; Description="Failed login attempt"},
    @{ID=4672; Description="Special privileges assigned"},
    @{ID=4720; Description="User account created"},
    @{ID=4732; Description="Member added to security group"},
    @{ID=7045; Description="New service installed"},
    @{ID=4657; Description="Registry value modified"},
    @{ID=4688; Description="New process created"}
)

Write-Host "Starting threat monitoring..." -ForegroundColor Green

while($true) {
    foreach($event in $suspiciousEvents) {
        $events = Get-EventLog -LogName Security -InstanceId $event.ID -After (Get-Date).AddMinutes(-5) -ErrorAction SilentlyContinue

        foreach($e in $events) {
            $alert = "$((Get-Date).ToString()): ALERT - $($event.Description) detected!"
            $alert | Out-File $logFile -Append

            # Check for known exploit patterns
            if($e.Message -match "ANONYMOUS LOGON" -or $e.Message -match "NT AUTHORITY\\SYSTEM") {
                $critical = "CRITICAL: Possible exploit attempt detected!"
                Write-Host $critical -ForegroundColor Red
                $critical | Out-File $logFile -Append

                # Send alert
                Send-MailMessage -To $alertEmail -Subject "Security Alert on $env:COMPUTERNAME" `
                                -Body "$critical`n`n$($e.Message)" -SmtpServer "mail.company.com"
            }
        }
    }

    Start-Sleep -Seconds 300 # Check every 5 minutes
}

@echo off
:: FileIntegrityMonitor.bat - Monitor critical system files

set BaselinePath=C:\SecurityBaseline
set MonitorPath=C:\SecurityLogs

:: Create baseline if not exists
if not exist %BaselinePath% (
    mkdir %BaselinePath%
    echo Creating system file baseline...

    :: Hash critical system files
    fciv -add C:\Windows\System32 -r -type *.exe -sha1 -xml %BaselinePath%\system32_baseline.xml
    fciv -add C:\Windows\System32 -r -type *.dll -sha1 -xml %BaselinePath%\system32_dll_baseline.xml

    echo Baseline created.
)

:: Compare current state to baseline
echo Checking file integrity...
fciv -v -sha1 -xml %BaselinePath%\system32_baseline.xml > %MonitorPath%\integrity_check.log 2>&1

:: Check for modifications
findstr /i "FAILED" %MonitorPath%\integrity_check.log > nul
if %errorlevel% equ 0 (
    echo CRITICAL: System file modifications detected!
    type %MonitorPath%\integrity_check.log | findstr /i "FAILED"

    :: Alert administrator
    msg * "SECURITY ALERT: System file integrity violation detected!"
) else (
    echo File integrity check passed.
)

# IncidentResponse.ps1 - Automated response to security incidents
param(
    [string]$IncidentType = "Unknown"
)

$incidentID = (Get-Date -Format "yyyyMMddHHmmss")
$incidentPath = "C:\IncidentResponse\$incidentID"
New-Item -ItemType Directory -Path $incidentPath -Force

Write-Host "Incident Response Initiated: $incidentID" -ForegroundColor Red

# Step 1: Isolate system
Write-Host "Isolating system..." -ForegroundColor Yellow
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

# Step 2: Capture evidence
Write-Host "Capturing evidence..." -ForegroundColor Yellow

# Memory dump
$memoryDump = "$incidentPath\memory.dmp"
& "C:\Tools\DumpIt.exe" /O $memoryDump

# Network connections
netstat -anob > "$incidentPath\network_connections.txt"

# Running processes
Get-Process | Export-Csv "$incidentPath\processes.csv"
tasklist /v > "$incidentPath\tasklist.txt"

# Registry snapshot
reg export HKLM "$incidentPath\HKLM.reg"
reg export HKCU "$incidentPath\HKCU.reg"

# Event logs
wevtutil epl Security "$incidentPath\Security.evtx"
wevtutil epl System "$incidentPath\System.evtx"
wevtutil epl Application "$incidentPath\Application.evtx"

# Step 3: Kill suspicious processes
$suspiciousProcesses = @("nc", "ncat", "powercat", "meterpreter", "mimikatz", "psexec")
foreach($proc in $suspiciousProcesses) {
    Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force
}

# Step 4: Disable compromised accounts
if($IncidentType -eq "AccountCompromise") {
    # Disable all non-system accounts temporarily
    Get-LocalUser | Where-Object {$_.Name -ne "Administrator"} | Disable-LocalUser
}

Write-Host "Incident response completed. Evidence saved to: $incidentPath" -ForegroundColor Green

@echo off
:: EmergencyRecovery.bat - Recover from security incident

echo Emergency Recovery Procedure
echo ===========================
echo.

:: Check system integrity
echo Checking system files...
sfc /scannow

:: Reset security policies
echo Resetting security policies...
secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

:: Reset services to default
echo Resetting critical services...
sc config EventLog start= auto
sc config PlugPlay start= auto
sc config RpcSs start= auto
sc config CryptSvc start= auto

:: Clear suspicious scheduled tasks
echo Clearing scheduled tasks...
schtasks /delete /tn * /f 2>nul

:: Reset network configuration
echo Resetting network configuration...
netsh int ip reset
netsh winsock reset

:: Re-enable necessary services
echo Re-enabling services...
sc config lanmanserver start= auto
sc start lanmanserver

echo.
echo Recovery complete. System restart required.
echo Review security logs before bringing system back online.
pause

# ComplianceReport.ps1 - Generate compliance report for unsupported system
$report = @{
    SystemInfo = Get-WmiObject Win32_OperatingSystem
    LastPatch = (Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1).InstalledOn
    DaysSinceEOL = (New-TimeSpan -Start "2015-07-14" -End (Get-Date)).Days
    ComplianceStatus = "Non-Compliant - Unsupported OS"
    Mitigations = @()
}

# Check mitigations
$mitigations = @(
    @{Control="Firewall Enabled"; Status=(Get-NetFirewallProfile).Enabled -contains $true},
    @{Control="SMBv1 Disabled"; Status=(Get-SmbServerConfiguration).EnableSMB1Protocol -eq $false},
    @{Control="RDP Secured"; Status=(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp").SecurityLayer -eq 2},
    @{Control="Isolated Network"; Status=$true}, # Manually verify
    @{Control="Third-party Patches"; Status=Test-Path "${env:ProgramFiles}\0patch"},
    @{Control="IPS/IDS Deployed"; Status=$true} # Manually verify
)

foreach($mitigation in $mitigations) {
    $report.Mitigations += [PSCustomObject]@{
        Control = $mitigation.Control
        Status = if($mitigation.Status) {"Implemented"} else {"Missing"}
        Effectiveness = if($mitigation.Status) {"Partial"} else {"None"}
    }
}

# Generate report
$html = @"
<html>
<head><title>Windows Server 2003 Compliance Report</title></head>
<body>
<h1>Compliance Report - $($env:COMPUTERNAME)</h1>
<h2 style='color:red'>CRITICAL: System is running unsupported Windows Server 2003</h2>
<p>Days since end of support: $($report.DaysSinceEOL)</p>
<h3>Compensating Controls:</h3>
<table border='1'>
<tr><th>Control</th><th>Status</th><th>Effectiveness</th></tr>
$(foreach($m in $report.Mitigations) {
    "<tr><td>$($m.Control)</td><td>$($m.Status)</td><td>$($m.Effectiveness)</td></tr>"
})
</table>
<p><strong>Recommendation:</strong> Immediate migration to supported platform required for compliance.</p>
</body>
</html>
"@

$html | Out-File "Compliance_Report_$(Get-Date -Format 'yyyyMMdd').html"
Write-Host "Compliance report generated" -ForegroundColor Green

# Windows Server 2003 Security Emergency Contacts

## Immediate Threats
1. Disconnect network cable immediately
2. Take photo of screen if ransomware message
3. Do NOT power off if encryption in progress

## Contact Priority:
1. **Tyler on Tech Louisville**: (202) 948-8888
2. **Security Hotline**: Available 24/7
3. **Email**: emergency@tylerontechlouisville.com

## Information to Provide:
- Server name and IP address
- Time incident detected
- Symptoms observed
- Last known good state
- Business impact

## While Waiting for Support:
1. Run: C:\EmergencyResponse\CaptureEvidence.bat
2. Document all actions taken
3. Preserve all logs
4. Do not attempt fixes without guidance