I've been working on remediation of some known security issues on some servers. This is one of the first times I've attempted this in a registry, so please excuse the sloppiness of the attempt. One of the issues involves remediating SSL encryption issues involving keys containing 3DES and RC4 located inside a multi-string key named 'Function' at the following location:
HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002
What I'm attempting to do (I'm going to severely shorten the list), if the initial value were as follows:
TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_RC4_128_SHA
After running the script, the desired result would be the new value of this key would be:
TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Among the different approaches I've tried, was the following script which is based on some Powershell script code I found here. Problem is, it isn't getting me anywhere, as it errored out. Ideally, I'd like to be able to search for anything with 3DES and RC4, but I focused initially on one of the two before complicating with multiple values.
#get the MultiLine String Array from the registry
$regArry = (Get-Itemproperty "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -name "Functions").("Functions")
#Create a new String Array
[String[]]$tempArry = @()
#Create an ArrayList from the Registry Array so I can edit it
$tempArryList = New-Object System.Collections.Arraylist(,$regArry)
# remove an entry from the list
if ( $tempArryList -contains "TLS_RSA_WITH_3DES_EDE_CBC_SHA" )
{
$tempArryList.Remove("TLS_RSA_WITH_3DES_EDE_CBC_SHA")
}
# Remove the old Array from the Registry
(Remove-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -name "Functions"). ("Functions")
# Add the new one
New-itemproperty "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" -name "Functions" -PropertyType MultiString -Value "$tempArry"