sharoue / chinawareblock Goto Github PK

    public static void Main(string[] args)
    {
        string baseFolder = @"!!!SOMEPATH";
        foreach (FileInfo fileInfo in new DirectoryInfo(baseFolder).EnumerateFiles("*.exe"))
        {
            try
            {
                X509Certificate cert = X509Certificate.CreateFromSignedFile(fileInfo.FullName);
                string certInBase64 = ExportToPEM(cert);

                string hash = cert.GetCertHashString();
                string issueTo = cert.Subject.Split(new string[] { ", " }, StringSplitOptions.None).FirstOrDefault(x => x.StartsWith("CN=")).Substring(3);
                string validTo = DateTime.Parse(cert.GetExpirationDateString()).ToString("yyyy-MM-dd");
                string certFileName = hash + "-" + issueTo + "-" + validTo + ".cer";

                File.WriteAllText(Path.Combine(baseFolder, removeInvalidCharInPath(certFileName)), certInBase64);
            }
            catch (CryptographicException)
            {
                continue;
            }
        }
    }

    private static string removeInvalidCharInPath(string path)
    {
        foreach (char c in invalidChar)
        {
            path = path.Replace(c.ToString(), "");
        }
        return path;
    }

    private static string ExportToPEM(X509Certificate cert)
    {
        StringBuilder builder = new StringBuilder();

        builder.AppendLine("-----BEGIN CERTIFICATE-----");
        builder.AppendLine(Convert.ToBase64String(cert.Export(X509ContentType.Cert), Base64FormattingOptions.InsertLineBreaks));
        builder.AppendLine("-----END CERTIFICATE-----");

        return builder.ToString();
    }

}

# Self-Elevating script
If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))
{
  # Relaunch as an elevated process:
  Start-Process powershell.exe "-File",('"{0}"' -f $MyInvocation.MyCommand.Path) -Verb RunAs
  exit
}

# For each cert in the folder, delete it from the disallowed store
$certList = Get-ChildItem -Recurse $PSScriptRoot -Filter *.cer | Where { ! $_.PSIsContainer } | Select Name,FullName,Length
foreach ($cert in $certList) 
    {
        $certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
        $certPrint.Import($cert.FullName)
	certutil -user -delstore "Disallowed" $certPrint.Thumbprint
    }