Checks for vulnerabilities:
- MS08-067, a Windows RPC vulnerability
- Conficker, an infection by the Conficker worm
- Unnamed regsvc DoS, a denial-of-service vulnerability I accidentally found in Windows 2000
- SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
- MS06-025, a Windows Ras RPC service vulnerability
- MS07-029, a Windows Dns Server RPC service vulnerability
WARNING: These checks are dangerous, and are very likely to bring down a server. These should not be run in a production environment unless you (and, more importantly, the business) understand the risks!
As a system administrator, performing these kinds of checks is crucial, because a lot more damage can be done by a worm or a hacker using this vulnerability than by a scanner. Penetration testers, on the other hand, might not want to use this script -- crashing services is not generally a good way of sneaking through a network.
If you set the script parameter
unsafe, then scripts will run that are almost
(or totally) guaranteed to crash a vulnerable system; do NOT specify
in a production environment! And that isn't to say that non-unsafe scripts will
not crash a system, they're just less likely to.
If you set the script parameter
safe, then script will run that rarely or never
crash a vulnerable system. No promises, though.
MS08-067. Checks if a host is vulnerable to MS08-067, a Windows RPC vulnerability that can allow remote code execution. Checking for MS08-067 is very dangerous, as the check is likely to crash systems. On a fairly wide scan conducted by Brandon Enright, we determined that on average, a vulnerable system is more likely to crash than to survive the check. Out of 82 vulnerable systems, 52 crashed. At the same time, MS08-067 is extremely critical to fix. Metasploit has a working and stable exploit for it, and any system vulnerable can very easily be compromised. Conficker. Checks if a host is infected with a known Conficker strain. This check is based on the simple conficker scanner found on this page: http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker. Thanks to the folks who wrote that scanner!
regsvc DoS. Checks if a host is vulnerable to a crash in regsvc, caused
by a null pointer dereference. I inadvertently discovered this crash while working
smb-enum-sessions, and discovered that it was repeatable. It's been
reported to Microsoft (case #MSRC8742).
This check WILL crash the service, if it's vulnerable, and requires a guest account
or higher to work. It is considered
SMBv2 DoS. Performs a denial-of-service against the vulnerability disclosed in CVE-2009-3103. Checks if the server went offline. This works against Windows Vista and some versions of Windows 7, and causes a bluescreen if successful. The proof-of-concept code at http://seclists.org/fulldisclosure/2009/Sep/39 was used, with one small change.
MS06-025. Vulnerability targets the
RasRpcSumbitRequest() RPC method which is
a part of RASRPC interface that serves as a RPC service for configuring and
getting information from the Remote Access and Routing service. RASRPC can be
accessed using either "\ROUTER" SMB pipe or the "\SRVSVC" SMB pipe (usually on Windows XP machines).
This is in RPC world known as "ncan_np" RPC transport.
method is a generic method which provides different functionalities according
RequestBuffer structure and particularly the
RegType field within that
RegType field is of
enum ReqTypes type. This enum type lists all
the different available operation that can be performed using the
RPC method. The one particular operation that this vuln targets is the
request to get device information on the RRAS.
MS07-029. Vulnerability targets the
R_DnssrvQuery2() RPC method which is
a part of DNS Server RPC interface that serves as a RPC service for configuring and
getting information from the DNS Server service. DNS Server RPC service can be
accessed using "\dnsserver" SMB named pipe. The vulnerability is triggered when
a long string is send as the "zone" parameter which causes the buffer overflow which
crashes the service.
(Note: if you have other SMB/MSRPC vulnerability checks you'd like to see added, and you can show me a tool with a license that is compatible with Nmap's, post a request on the nmap-dev mailing list and I'll add it to my list [Ron Bowes].)
If set, this script will only run checks that are known (or at least suspected) to be safe.
If set, this script will run checks that, if the system isn't patched, are basically guaranteed to crash something. Remember that non-unsafe checks aren't necessarily safe either)
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusernameSee the documentation for the smbauth library.
randomseed, smbbasic, smbport, smbsignSee the documentation for the smb library.
unittest.runSee the documentation for the unittest library.
nmap --script smb-check-vulns.nse -p445 <host> sudo nmap -sU -sS --script smb-check-vulns.nse -p U:137,T:139 <host>
Host script results: | smb-check-vulns: | MS08-067: NOT VULNERABLE | Conficker: Likely CLEAN | regsvc DoS: regsvc DoS: NOT VULNERABLE | SMBv2 DoS (CVE-2009-3103): NOT VULNERABLE | MS06-025: NO SERVICE (the Ras RPC service is inactive) |_ MS07-029: NO SERVICE (the Dns Server RPC service is inactive)
Author: Ron Bowes
License: Same as Nmap--See http://nmap.org/book/man-legal.html