File smb-check-vulns
Download: http://nmap.org/svn/scripts/smb-check-vulns.nse
User Summary
Check for vulnerabilities:
- MS08-067, a Windows RPC vulnerability
- Conficker, an infection by the Conficker worm
- Unnamed regsvc DoS, a denial-of-service vulnerability I accidentically found in Windows 2000
- SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
WARNING: These checks are dangerous, and are very likely to bring down a server. These should not be run in a production environment unless you (and, more importantly, the business) understand the risks!
As a system administrator, performing these kinds of checks is crucial, because a lot more damage can be done by a worm or a hacker using this vulnerability than by a scanner. Penetration testers, on the other hand, might not want to use this script -- crashing services is not generally a good way of sneaking through a network.
If you set the script parameter 'unsafe', then scripts will run that are almost
(or totally) guaranteed to crash a vulnerable system; do NOT specify unsafe
in a production environment! And that isn't to say that non-unsafe scripts will
not crash a system, they're just less likely to.
If you set the script parameter 'safe', then script will run that rarely or never crash a vulnerable system. No promises, though.
MS08-067 -- Checks if a host is vulnerable to MS08-067, a Windows RPC vulnerability that can allow remote code execution. Checking for MS08-067 is very dangerous, as the check is likely to crash systems. On a fairly wide scan conducted by Brandon Enright, we determined that on average, a vulnerable system is more likely to crash than to survive the check. Out of 82 vulnerable systems, 52 crashed.
At the same time, MS08-067 is extremely critical to fix. Metasploit has a working and stable exploit for it, and any system vulnerable can very easily be compromised.
Conficker -- Checks if a host is infected with a known Conficker strain. This check is based on the simple conficker scanner found on this page: http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker Thanks to the folks who wrote that scanner!
regsvc DoS -- Checks if a host is vulnerable to a crash in regsvc, caused
by a null pointer dereference. I inadvertently discovered this crash while working
on smb-enum-sessions, and discovered that it was repeatable. It's been
reported to Microsoft (case #MSRC8742).
This check WILL crash the service, if it's vulnerable, and requires a guest account
or higher to work. It is considered unsafe.
SMBv2 DoS -- performs a denial-of-service against the vulnerability disclosed in CVE-2009-3103. Checks if the server went offline. This works agianst Windows Vista and some versions of Windows 7, and causes a bluescreen if successful. The proof- of-concept code at <http://seclists.org/fulldisclosure/2009/Sep/0039.html> was used, with one small change.
(Note: if you have other SMB/MSRPC vulnerability checks you'd like to see added, and you can show me a tool with a license that is compatible with Nmap's, post a request on the Nmap-dev mailing list and I'll add it to my list [Ron Bowes]).
Script Arguments
safe
If set, this script will only run checks that are known (or at least suspected) to be safe.
unsafe
If set, this script will run checks that, if the system isn't patched, are basically guaranteed to crash something. Remember that non-unsafe checks aren't necessarily safe either)
randomseed, smbbasic, smbport, smbsign
See the documentation for the smb library.smbdomain, smbhash, smbpassword, smbtype, smbusername
See the documentation for the smbauth library.Example Usage
nmap --script smb-check-vulns.nse -p445 <host> sudo nmap -sU -sS --script smb-check-vulns.nse -p U:137,T:139 <host>
Script Output
Host script results: | smb-check-vulns: | | MS08-067: NOT VULNERABLE | | Conficker: Likely CLEAN | | regsvc DoS: NOT VULNERABLE |_ |_ SMBv2 DoS (CVE-2009-3103): NOT VULNERABLE
Requires
categories intrusive exploit dos vuln
author Ron Bowes
copyright © Same as Nmap--See http://nmap.org/book/man-legal.html
Functions
| check_conficker (host) | Check if the server is infected with Conficker. This can be detected by a modified MS08-067 patch, which rejects a different illegal string than the official patch rejects. |
| check_ms08_067 (host) | Check if the server is patched for MS08-067. This is done by calling NetPathCompare with an illegal string. If the string is accepted, then the server is vulnerable; if it's rejected, then you're safe (for now). |
| check_winreg_Enum_crash (host) |
While writing |
| get_response (check, message, description, minimum_verbosity, minimum_debug) | Returns the appropriate text to display, if any. |
Functions
- check_conficker (host)
-
Check if the server is infected with Conficker. This can be detected by a modified MS08-067 patch, which rejects a different illegal string than the official patch rejects.
Based loosely on the Simple Conficker Scanner, found here: http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker/
If there's a licensing issue, please let me (Ron Bowes) know so I can fix it
Parameters
- host: The host object.
Return value:
(status, result) If status is false, result is an error code; otherwise, result is eitherINFECTEDfor infected orCLEANfor not infected. - check_ms08_067 (host)
-
Check if the server is patched for MS08-067. This is done by calling NetPathCompare with an illegal string. If the string is accepted, then the server is vulnerable; if it's rejected, then you're safe (for now).
Based on a packet cap of this script, thanks go out to the author: http://labs.portcullis.co.uk/download/ms08-067_check.py
If there's a licensing issue, please let me (Ron Bowes) know so I can
NOTE: This CAN crash stuff (ie, crash svchost and force a reboot), so beware! In about 20 tests I did, it crashed once. This is not a guarantee.
Parameters
- host: The host object.
Return value:
(status, result) If status is false, result is an error code; otherwise, result is eitherVULNERABLEfor vulnerable,PATCHEDfor not vulnerable,UNKNOWNif there was an error (likely vulnerable),NOTRUNif this check was disabled, andINFECTEDif it was patched by Conficker. - check_winreg_Enum_crash (host)
-
While writing
smb-enum-sessionsI discovered a repeatable null-pointer dereference in regsvc. I reported it to Microsoft, but because it's a simple DoS (and barely even that, because the service automatically restarts), and because it's only in Windows 2000, it isn't likely that they'll fix it. This function checks for that crash (by crashing the process).The crash occurs when the string sent to winreg_enumkey() function is null.
Parameters
- host: The host object.
Return value:
(status, result) If status is false, result is an error code; otherwise, result is eitherVULNERABLEfor vulnerable orPATCHEDfor not vulnerable. If the check was skipped,NOTRUNis returned. - get_response (check, message, description, minimum_verbosity, minimum_debug)
-
Returns the appropriate text to display, if any.
Parameters
- check: The name of the check; for example, 'ms08-067'.
- message: The message to display, such as 'VULNERABLE' or 'PATCHED'.
- description: [optional] Extra details about the message. nil for a blank message.
- minimum_verbosity: The minimum verbosity level required before the message is displayed.
- minimum_debug: [optional] The minimum debug level required before the message is displayed (default: 0).
Return value:
A string with a textual representation of the error (or empty string, if it was determined that the message shouldn't be displayed).