mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-02 08:43:27 +08:00
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
id: windows-dep-disabled
|
|
|
|
info:
|
|
name: Data Execution Prevention (DEP) Not Enabled
|
|
author: princechaddha
|
|
severity: high
|
|
description: Checks if Data Execution Prevention (DEP) is not fully enabled for all programs.
|
|
impact: |
|
|
Disabling DEP allows certain types of memory-based attacks, such as buffer overflows.
|
|
remediation: |
|
|
Enable DEP for all programs to enhance memory protection.
|
|
tags: windows,security,dep,code,windows-audit
|
|
|
|
self-contained: true
|
|
|
|
code:
|
|
- pre-condition: |
|
|
IsWindows();
|
|
engine:
|
|
- powershell.exe
|
|
args:
|
|
- -ExecutionPolicy
|
|
- Bypass
|
|
pattern: "*.ps1"
|
|
source: |
|
|
$EnableDEP = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'EnableDEP' -ErrorAction SilentlyContinue).EnableDEP
|
|
if ($EnableDEP -ne 2) {
|
|
Write-Output 'DEP not fully enabled'
|
|
}
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "DEP not fully enabled"
|
|
# digest: 490a0046304402200442e48a693e4ac8d598d48bc73db2e9fd3316570b77e2ab6d4fca68fcc19a67022030f9564b0744d513e383d781317d3d185e5f730b6b8ac4169108a7f8c40e9844:922c64590222798bb761d5b6d8e72950 |