autoplay-removable-media-enabled: AutoPlay Enabled for Removable Media

漏洞描述

Checks if AutoPlay is enabled for removable media, which can automatically execute malicious software.

PoC代码[已公开]

id: autoplay-removable-media-enabled

info:
  name: AutoPlay Enabled for Removable Media
  author: princechaddha
  severity: medium
  description: Checks if AutoPlay is enabled for removable media, which can automatically execute malicious software.
  impact: |
    Enabling AutoPlay may allow the automatic execution of malware from external devices, increasing the attack surface.
  remediation: |
    Disable AutoPlay for all removable media to mitigate potential security threats.
  tags: windows,autoplay,removable-media,code,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers' -Name 'DisableAutoplay'

    matchers:
      - type: word
        words:
          - "DisableAutoplay : 0"
# digest: 4a0a00473045022100947f6dea98ccb89cabb2f070d43377c6b37010ff0d726546ed164bb2f38b5cea022025d13b95c10e846ef4c0d02ca47d01d48d6fac5cb7beb41e6d46e33111e4c411:922c64590222798bb761d5b6d8e72950

来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/./code/windows/audit/autoplay-removable-media-enabled.yaml