#CVE-2013-3900 是微软 WinVerifyTrust 函数处理 Windows Authenticode 签名验证方式中的一个远程代码执行漏洞。此缺陷允许攻击者修改已签名的可执行文件，通过在文件未经验证的部分添加恶意代码而不使其签名失效。

#此漏洞的缓解措施是一项需要特定注册表设置的可选功能。启用后，Windows 将对 Authenticode 签名执行更严格的验证，确保签名文件中不存在无关数据。

-WinVerifyTrust-签名验证-CVE-2013-3900-缓解

Define the registry key paths

$regPath32 = "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" $regPath64 = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" $valueName = "EnableCertPaddingCheck" $valueData = 1

Check and create the registry key for 64-bit systems

if (-not (Test-Path $regPath64)) { New-Item -Path $regPath64 -Force | Out-Null Write-Host "Created registry path: $regPath64" }

Set the registry value for 64-bit systems

Set-ItemProperty -Path $regPath64 -Name $valueName -Value $valueData -Type DWord -Force | Out-Null Write-Host "Set $valueName to $valueData in $regPath64"

Check and create the registry key for 32-bit systems

if (-not (Test-Path $regPath32)) { New-Item -Path $regPath32 -Force | Out-Null Write-Host "Created registry path: $regPath32" }

Set the registry value for 32-bit systems

Set-ItemProperty -Path $regPath32 -Name $valueName -Value $valueData -Type DWord -Force | Out-Null Write-Host "Set $valueName to $valueData in $regPath32"

Write-Host "`nMitigation script complete."