TeamViewer 하드코딩된 공유 AES 키를 이용한 자격 증명 복호화 및 권한 상승 취약점 (CVE-2019-18988)

# 1. 기존 취약한 TeamViewer 프로세스 종료 및 제거
Stop-Process -Name 'TeamViewer' -Force -ErrorAction SilentlyContinue
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*TeamViewer*' }
if ($app) { $app.Uninstall() }

# 2. 최신 안전 버전 다운로드 및 자동 설치 (Silent Install)
Invoke-WebRequest -Uri 'https://download.teamviewer.com/download/TeamViewer_Setup.exe' -OutFile '$env:TEMP\TeamViewer_Setup.exe'
Start-Process -FilePath '$env:TEMP\TeamViewer_Setup.exe' -ArgumentList '/S' -Wait

# 레지스트리 내 취약한 암호화 비밀번호 항목 강제 삭제
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\TeamViewer' -Name 'OptionsPasswordAES' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\TeamViewer' -Name 'SecurityPasswordAES' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\TeamViewer' -Name 'OptionsPasswordAES' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\TeamViewer' -Name 'SecurityPasswordAES' -ErrorAction SilentlyContinue

# TeamViewer 설치 버전 및 취약한 레지스트리 키 존재 여부 점검
$tvPath = 'HKLM:\SOFTWARE\Wow6432Node\TeamViewer'
if (Test-Path $tvPath) {
    $version = (Get-ItemProperty -Path $tvPath -Name 'Version' -ErrorAction SilentlyContinue).Version
    Write-Host 'Detected TeamViewer Version: ' $version
    
    $hasOptionsPwd = (Get-ItemProperty -Path $tvPath -Name 'OptionsPasswordAES' -ErrorAction SilentlyContinue)
    if ($hasOptionsPwd) {
        Write-Warning '[WARNING] Vulnerable OptionsPasswordAES registry key is present! Immediate remediation required.'
    } else {
        Write-Host '[OK] No vulnerable OptionsPasswordAES key found in Wow6432Node.' -ForegroundColor Green
    }
} else {
    Write-Host '[OK] TeamViewer registry path not found.' -ForegroundColor Green
}