[NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010 (smb-vuln-ms17-010)

Hello,

While my testing using VM's worked with the new smb.lua and the
updated smb-vuln-ms17-010.nse files it is not behaving the same in the
Domain environment.


I am still getting the Could not connect to 'IPC$' message when connecting
to Server 2012 systems.

I have tried the following command lines

nmap -d -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse
 --script-args=smbusername=<adminuser>,smbpassword=<password> <target>

nmap -d -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse
 --script-args=smbusername=<adminuser>,smbpassword=<password>,smbbasic=1,smbsign=force
<target>

nmap -d -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse
 --script-args=smbusername=<adminuser>,smbpassword=<password>,smbbasic=1
<target>

I also tried both the short domain name (NETBIOS) and the FQDN domain name.

All with the same results.Text file with scan results attached.

Any comments / suggests / help will be greatly appreciated.

Thanks,

Robert


On Mon, May 22, 2017 at 10:03 PM, <[email protected]> wrote:

> Send dev mailing list submissions to
>         [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://nmap.org/mailman/listinfo/dev
> or, via email, send a message with subject or body 'help' to
>         [email protected]
>
> You can reach the person managing the list at
>         [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of dev digest..."
>
>
> Today's Topics:
>
>    1. Wai Tuck's GSOC status report #2 of 17 (Wong Wai Tuck)
>    2. Vinamra Bhatia - GSoC Status Report #2 of 17 (Vinamra Bhatia)
>    3. Re: [NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010
>       (smb-vuln-ms17-010) (Paulino Calderon)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 22 May 2017 19:20:13 +0000
> From: Wong Wai Tuck <[email protected]>
> To: "[email protected]" <[email protected]>
> Subject: Wai Tuck's GSOC status report #2 of 17
> Message-ID:
>         <[email protected].
> com>
> Content-Type: text/plain; charset="utf-8"
>
> Hey all,
>
> Finally back home in Singapore!
>
> Accomplishments:
> * Signed copyright assignment
> * Read Programming in Lua book as recommended by my mentor, got a much
> better understanding of the language and its history
> * Read NSE chapter of the Nmap book, watched Fyodor's Black Hat 2010
> presentation on NSE - I have a clearer idea on how NSE fits into the whole
> Nmap ecosystem!
> * Skimmed through the MS17-010 script (I realize there's a number of people
> working on this already so I didn't focus on this)
>
> Priorities:
> * Finish reading other resources - SVN, the NSE book, current NSE scripts
> * Make small improvements to current scripts as I read them, get used to
> the development cycle
> * Propose exploit scripts to be developed on the dev mailing list and
> elicit feedback
> * Discuss design plan and final timeline with mentor
>
> Thank you all and have a great week ahead.
>
> With Regards
> Wong Wai Tuck
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://nmap.org/mailman/private/dev/attachments/
> 20170522/e49e65b4/attachment.html>
>
> ------------------------------
>
> Message: 2
> Date: Tue, 23 May 2017 05:29:52 +0530
> From: Vinamra Bhatia <[email protected]>
> To: [email protected]
> Subject: Vinamra Bhatia - GSoC Status Report #2 of 17
> Message-ID:
>         <CAP+gV2x4_4NTpV6_k6YmGRZ3em+_mJ2ez9o6H6G9+dhjfkNmFA@mail.
> gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hi all,
>
> This is my second status report for GSoC 2017.
>
> Accomplishments :
>
> * Completed the copyright assignment.
> * Read the book "Mastering the NMAP Scripting Engine".
> * Solved a minor bug
> * Had a meeting with the mentor and discussed further on the project.
>
> Priorities:
>
> * Read up about SMB ( I just have a basic idea right now).
> * Solve open issues in HTTP and SMB.
> * Check optimization in existing vulnerabilites.
> * Read about SVN and fork the SVN repository.
>
> That's all for now. Thank you all.
>
> Cheers,
> Vinamra
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://nmap.org/mailman/private/dev/attachments/
> 20170523/f345425a/attachment.html>
>
> ------------------------------
>
> Message: 3
> Date: Tue, 23 May 2017 00:03:42 -0500
> From: Paulino Calderon <[email protected]>
> To: Nmap-dev <[email protected]>
> Subject: Re: [NSE] smb-vuln-ms17-010.nse: Script to detect ms17-010
>         (smb-vuln-ms17-010)
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset="utf-8"
>
> Hey everyone,
>
> Thanks a lot for your feedback and help debugging the problem. (Specially
> to Tinkerfairy! ) The attached patch seems to make the script work in
> Windows 8.1 and Windows 10 too. Please report any problems you see in your
> environments.
>
> I?ve also added an error check to determine conclusively if a system is
> patched. I?ve observed that patched systems return the error
> STATUS_ACCESS_DENIED so I?ve incorporated that into the script.
>
> Files:
> smb.lua: https://github.com/cldrn/nmap-nse-scripts/blob/master/
> nselib/smb.lua
> smb-vuln-ms17-010: https://github.com/cldrn/nmap-nse-scripts/blob/master/
> scripts/smb-vuln-ms17-010.nse
>
> I posted a few notes (mostly common questions) about this script here:
> https://github.com/cldrn/nmap-nse-scripts/wiki/Notes-about-
> smb-vuln-ms17-010
>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smb.lua
> Type: application/octet-stream
> Size: 177647 bytes
> Desc: not available
> URL: <https://nmap.org/mailman/private/dev/attachments/
> 20170523/7cff42ee/attachment.obj>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smb-vuln-ms17-010.nse
> Type: application/octet-stream
> Size: 6439 bytes
> Desc: not available
> URL: <https://nmap.org/mailman/private/dev/attachments/
> 20170523/7cff42ee/attachment-0001.obj>
> -------------- next part --------------
>
>
> Paulino Calderon Pale || @calderpwn on Twitter ||
> http://www.calderonpale.com
>
>
>
> > On May 14, 2017, at 8:37 PM, Paulino Calderon <[email protected]>
> wrote:
> >
> > Hey list,
> >
> > I need some help testing the script smb-vuln-ms17-010. I tested it on a
> vulnerable win7 machine and it works as expected but I suspect there might
> be some issues with newer Windows versions and certain smb configurations
> (v2 authentication protocols with signing enabled).
> >
> > Don't forget to send me packet captures if you run into servers that are
> incorrectly marked as not vulnerable.
> >
> > Cheers!
> >
> > smb-vuln-ms17-010: https://github.com/cldrn/nmap-
> nse-scripts/blob/master/scripts/smb-vuln-ms17-010.nse
> > description = [[
> > Attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote
> code
> > execution vulnerability (ms2017-010).
> >
> > The script connects to the $IPC tree, executes a transaction on FID 0 and
> > checks if the error "STATUS_INSUFF_SERVER_RESOURCES" is returned to
> > determine if the target is not patched against CVE2017-010.
> >
> > Tested on a vulnerable Windows 7. We might have some issues with v2
> protocols with
> > signing enabled.
> >
> > References:
> > * https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
> > * https://blogs.technet.microsoft.com/msrc/2017/05/12/
> customer-guidance-for-wannacrypt-attacks/
> > * https://msdn.microsoft.com/en-us/library/ee441489.aspx
> > * https://github.com/rapid7/metasploit-framework/blob/
> master/modules/auxiliary/scanner/smb/smb_ms17_010.rb
> > ]]
> >
> >
> >
> > Paulino Calderon Pale || @calderpwn on Twitter ||
> http://www.calderonpale.com
> >
> >
> >
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> dev mailing list
> [email protected]
> https://nmap.org/mailman/listinfo/dev
>
>
> ------------------------------
>
> End of dev Digest, Vol 146, Issue 20
> ************************************
>

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/

Winpcap present, dynamic linked to: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)

Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-24 10:52 US Mountain Standard Time
--------------- Timing report ---------------
  hostgroups: min 1, max 3
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.3.
NSE: Arguments from CLI: smbusername=adminuser,smbdomain=short_domain_name,smbpassword=password,smbbasic=1,smbsign=force
NSE: Arguments parsed: smbusername=adminuser,smbdomain=short_domain_name,smbpassword=password,smbbasic=1,smbsign=force
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 10:52
Completed NSE at 10:52, 0.00s elapsed
Initiating ARP Ping Scan at 10:52
Scanning TARGET.FQDN.local (10.xx.xxx.xxx) [1 port]
Packet capture filter (device eth1): arp and arp[18:4] = 0x005056BE and arp[22:2] = 0x5493
Completed ARP Ping Scan at 10:52, 0.30s elapsed (1 total hosts)
Overall sending rates: 3.38 packets / s, 141.89 bytes / s.
mass_rdns: Using DNS server 10.xx.xxx.xx
mass_rdns: Using DNS server 10.xx.xxx.xx
Initiating Parallel DNS resolution of 1 host. at 10:52
mass_rdns: 0.67s 0/1 [#: 2, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 10:52, 0.02s elapsed
DNS resolution of 1 IPs took 0.67s. Mode: Async [#: 2, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 10:52
Scanning TARGETFQDN.local (10.xx.xxx.xxx) [1 port]
Packet capture filter (device eth1): dst host 10.xx.xxx.xx and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.xx.xxx.xxx)))
Discovered open port 445/tcp on 10.xx.xxx.xxx
Completed SYN Stealth Scan at 10:52, 0.00s elapsed (1 total ports)
Overall sending rates: 0.00 packets / s, 0.00 bytes / s.
NSE: Script scanning 10.xx.xxx.xxx.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 10:52
NSE: Starting smb-vuln-ms17-010 against TARGET.FQDN.local (10.xx.xxx.xxx).
NSE: [smb-vuln-ms17-010 10.xx.xxx.xxx] SMB: Added account '' to account list
NSE: [smb-vuln-ms17-010 10.xx.xxx.xxx] SMB: Added account 'guest' to account list
NSE: [smb-vuln-ms17-010 10.xx.xxx.xxx] SMB: Added account 'adminuser' to account list
NSE: [smb-vuln-ms17-010 10.xx.xxx.xxx] LM Password: 5025524d454a3f2e454b43354c6yt5439mhd53
NSE: [smb-vuln-ms17-010 10.xx.xxx.xxx] Could not connect to 'IPC$'
NSE: Finished smb-vuln-ms17-010 against TARGET.FQDN.local (10.xx.xxx.xxx).
Completed NSE at 10:52, 1.01s elapsed
Nmap scan report for TARGET.FQDN.local (10.xx.xxx.xxx)
Host is up, received arp-response (0.00s latency).
Scanned at 2017-05-24 10:52:02 US Mountain Standard Time for 2s
PORT    STATE SERVICE      REASON
445/tcp open  microsoft-ds syn-ack ttl 128
MAC Address: 00:50:56:BE:48:8C (VMware)

Host script results:
|_smb-vuln-ms17-010: Could not connect to 'IPC$'
Final times for host: srtt: 0 rttvar: 3750  to: 100000

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 10:52
Completed NSE at 10:52, 0.00s elapsed
Read from C:\Program Files (x86)\Nmap: nmap-mac-prefixes nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 3.67 seconds
           Raw packets sent: 2 (72B) | Rcvd: 2 (72B)