Re: [NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010 (smb-vuln-ms17-010)

Hey everyone,

Thanks a lot for your feedback and help debugging the problem. (Specially to Tinkerfairy! ) The attached patch seems to make the script work in Windows 8.1 and Windows 10 too. Please report any problems you see in your environments. 

I’ve also added an error check to determine conclusively if a system is patched. I’ve observed that patched systems return the error STATUS_ACCESS_DENIED so I’ve incorporated that into the script.

Files:
smb.lua: https://github.com/cldrn/nmap-nse-scripts/blob/master/nselib/smb.lua
smb-vuln-ms17-010: https://github.com/cldrn/nmap-nse-scripts/blob/master/scripts/smb-vuln-ms17-010.nse

I posted a few notes (mostly common questions) about this script here: 
https://github.com/cldrn/nmap-nse-scripts/wiki/Notes-about-smb-vuln-ms17-010



Paulino Calderon Pale || @calderpwn on Twitter || http://www.calderonpale.com



> On May 14, 2017, at 8:37 PM, Paulino Calderon <[email protected]> wrote:
> 
> Hey list,
> 
> I need some help testing the script smb-vuln-ms17-010. I tested it on a vulnerable win7 machine and it works as expected but I suspect there might be some issues with newer Windows versions and certain smb configurations (v2 authentication protocols with signing enabled).
> 
> Don't forget to send me packet captures if you run into servers that are incorrectly marked as not vulnerable. 
> 
> Cheers!
> 
> smb-vuln-ms17-010: https://github.com/cldrn/nmap-nse-scripts/blob/master/scripts/smb-vuln-ms17-010.nse 
> description = [[
> Attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote code
> execution vulnerability (ms2017-010).
> 
> The script connects to the $IPC tree, executes a transaction on FID 0 and
> checks if the error "STATUS_INSUFF_SERVER_RESOURCES" is returned to
> determine if the target is not patched against CVE2017-010.
> 
> Tested on a vulnerable Windows 7. We might have some issues with v2 protocols with
> signing enabled.
> 
> References:
> * https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
> * https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
> * https://msdn.microsoft.com/en-us/library/ee441489.aspx
> * https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb 
> ]]
> 
> 
> 
> Paulino Calderon Pale || @calderpwn on Twitter || http://www.calderonpale.com
> 
> 
>

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/