Microsoft Office 및 SQL Server MSCOMCTL.OCX ActiveX 컨트롤 원격 코드 실행 취약점 (CVE-2012-0158)

# MSCOMCTL.OCX 파일 버전 확인 스크립트
$paths = @(
    'C:\Windows\System32\mscomctl.ocx',
    'C:\Windows\SysWOW64\mscomctl.ocx'
)
foreach ($path in $paths) {
    if (Test-Path $path) {
        $version = (Get-Item $path).VersionInfo.FileVersion
        Write-Host "[+] Found: $path (Version: $version)"
    } else {
        Write-Host "[-] Not Found: $path"
    }
}

:: ListView 및 TreeView ActiveX 컨트롤에 대한 Kill-Bit 설정 (Class ID 차단)
reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f

# 다운로드 폴더 내 의심스러운 RTF 파일에서 CVE-2012-0158 관련 CLSID 검색
$targetDir = "$env:USERPROFILE\Downloads"
$clsid = "BDD1F04B-858B-11D1-B16A-00C0F0283628"

Get-ChildItem -Path $targetDir -Filter *.rtf -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
    if ($content -and $content.Contains($clsid)) {
        Write-Warning "[!] Suspicious RTF file detected (Potential CVE-2012-0158 exploit): $($_.FullName)"
    }
}