Re: dev Digest, Vol 146, Issue 16

I have added the suggested line to the smb.lua file as seen below

  -- check what kind of security blob we were given in the negotiate
protocol request
  local sp_nego = false
  if ( smb['security_blob'] and #smb['security_blob'] > 11 ) then
    local pos, oid = bin.unpack(">A6", smb['security_blob'], 5)
     sp_nego=true
--    sp_nego = ( oid == "\x2b\x06\x01\x05\x05\x02" ) -- check for SPNEGO
OID 1.3.6.1.5.5.2
  end

I have a Server 2016 VM that is only patched to 11/2016 that I am using as
a test system. I have turned off the firewall on all profiles, I am using
the system name, not the IP address, and I have added the
DisableStrictNameChecking
registry key entry (just as a final test) -
https://support.microsoft.com/en-us/help/3181029/smb-file-server-share-access-is-unsuccessful-through-dns-cname-alias

I am still getting the Could not connect to 'IPC$' response.

Did I miss something? Do somethihng wrong?

Thanks,

Robert

On Sat, May 20, 2017 at 12:00 PM, <[email protected]> wrote:

> Send dev mailing list submissions to
>         [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://nmap.org/mailman/listinfo/dev
> or, via email, send a message with subject or body 'help' to
>         [email protected]
>
> You can reach the person managing the list at
>         [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of dev digest..."
>
>
> Today's Topics:
>
>    1. [NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010
>       (Tinker Fairy)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 19 May 2017 19:17:16 -0500
> From: Tinker Fairy <[email protected]>
> To: [email protected]
> Subject: [NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010
> Message-ID: <[email protected]>
> Content-Type: text/plain;       charset=us-ascii
>
> Robert,
>
> I have encountered two difficulties that cause the behavior you are
> describing:
> 1) newer windows versions default to DisableStrictNameChecking = false
> which requires the server name on SMB requests.
>
> I have opened a pull request with a feature addition to be compatible with
> this new default. https://github.com/cldrn/nmap-nse-scripts/pull/7
>
> 2) there is some kind of bug with newer Windows and the SPNEGO code in the
> SMB library. As a temporary workaround you can set sp_nego=true on line
> 1319 of nselib/smb.lua
>
> With both of those issues taken care of, I've scanned tens of thousands of
> mixed version windows servers from 2003 to 2016.
>
> Good luck!
>
> -TinkerFairy
>
> >
> > Date: Fri, 19 May 2017 16:03:59 -0700
> > From: Robert Strom <[email protected]>
> > To: [email protected]
> > Subject: [NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010
> > Message-ID:
> >    <CAACgKan3CnGT0gOvTvb5yT=A9FA8Nhz8xfNzhsdxSc24G7B36Q@mail.gmail.com>
> > Content-Type: text/plain; charset="utf-8"
> >
> > Hello,
> >
> > I've been playing around with the smb-vuln-ms17-010.nse script and found
> > some strange results for Server 2012 systems.
> >
> > All 2012, regardless of whether or not they are patched, firewall on or
> off
> > I get this message
> >
> > Could not connect to 'IPC$'
> >
> > which does not tell me whether or not the system is vulnerable or not.
> >
> > I have also checked whether or not these systems are running SMBv1, they
> > definitely are.
> >
> > Any explanation for this behavior?
> >
> > See attached files of Nmap scan using v 7.40 on Windows against Server
> 2012
> > with FW on and FW off.
> >
> > Thanks,
> >
> > Robert
> >
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> dev mailing list
> [email protected]
> https://nmap.org/mailman/listinfo/dev
>
>
> ------------------------------
>
> End of dev Digest, Vol 146, Issue 16
> ************************************
>

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/

Winpcap present, dynamic linked to: Npcap version 0.78 r5, based on libpcap version 1.8.1

Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-21 08:55 US Mountain Standard Time
--------------- Timing report ---------------
  hostgroups: min 1, max 3
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.3.
NSE: Arguments from CLI: 
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 08:55
Completed NSE at 08:55, 0.00s elapsed
Initiating ARP Ping Scan at 08:55
Scanning WIN-RDHFOA4C1MD (192.168.19.132) [1 port]
Packet capture filter (device eth2): arp and arp[18:4] = 0x005056C0 and arp[22:2] = 0x0001
Completed ARP Ping Scan at 08:55, 0.47s elapsed (1 total hosts)
Overall sending rates: 2.12 packets / s, 89.17 bytes / s.
mass_rdns: Using DNS server 192.168.1.1
Initiating Parallel DNS resolution of 1 host. at 08:55
mass_rdns: 1.60s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 08:55, 0.16s elapsed
DNS resolution of 1 IPs took 1.60s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:55
Scanning WIN-RDHFOA4C1MD (192.168.19.132) [1 port]
Packet capture filter (device eth2): dst host 192.168.19.1 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 192.168.19.132)))
Discovered open port 445/tcp on 192.168.19.132
Completed SYN Stealth Scan at 08:55, 0.00s elapsed (1 total ports)
Overall sending rates: 1000.00 packets / s, 44000.00 bytes / s.
NSE: Script scanning 192.168.19.132.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 08:55
NSE: Starting smb-vuln-ms17-010 against WIN-RDHFOA4C1MD (192.168.19.132).
NSE: [smb-vuln-ms17-010 192.168.19.132] SMB: Added account '' to account list
NSE: [smb-vuln-ms17-010 192.168.19.132] SMB: Added account 'guest' to account list
NSE: [smb-vuln-ms17-010 192.168.19.132] LM Password: 
NSE: [smb-vuln-ms17-010 192.168.19.132] SMB: Extended login to 192.168.19.132 as WIN-RDHFOA4C1MD\guest failed (NT_STATUS_ACCOUNT_DISABLED)
NSE: [smb-vuln-ms17-010 192.168.19.132] LM Password: 
NSE: [smb-vuln-ms17-010 192.168.19.132] SMB: Extended login to 192.168.19.132 as WIN-RDHFOA4C1MD\<blank> failed (NT_STATUS_ACCESS_DENIED)
NSE: [smb-vuln-ms17-010 192.168.19.132] Could not connect to 'IPC$'
NSE: Finished smb-vuln-ms17-010 against WIN-RDHFOA4C1MD (192.168.19.132).
Completed NSE at 08:55, 0.03s elapsed
Nmap scan report for WIN-RDHFOA4C1MD (192.168.19.132)
Host is up, received arp-response (0.00s latency).
Scanned at 2017-05-21 08:55:53 US Mountain Standard Time for 2s
PORT    STATE SERVICE      REASON
445/tcp open  microsoft-ds syn-ack ttl 128
MAC Address: 00:0C:29:CA:AC:88 (VMware)

Host script results:
|_smb-vuln-ms17-010: Could not connect to 'IPC$'
Final times for host: srtt: 0 rttvar: 3750  to: 100000

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 08:55
Completed NSE at 08:55, 0.00s elapsed
Read from C:\Program Files (x86)\Nmap: nmap-mac-prefixes nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 3.94 seconds
           Raw packets sent: 2 (72B) | Rcvd: 2 (72B)