Script `smb-enum-processes`

Script types: hostrule
Categories: discovery, intrusive
Download: https://svn.nmap.org/nmap/scripts/smb-enum-processes.nse

Script Summary

Pulls a list of processes from the remote server over SMB. This will determine all running processes, their process IDs, and their parent processes. It is done by querying the remote registry service, which is disabled by default on Vista; on all other Windows versions, it requires Administrator privileges.

Since this requires administrator privileges, it isn't especially useful for a penetration tester, since they can effectively do the same thing with metasploit or other tools. It does, however, provide for a quick way to get process lists for a bunch of systems at the same time.

WARNING: I have experienced crashes in regsvc.exe while making registry calls against a fully patched Windows 2000 system; I've fixed the issue that caused it, but there's no guarantee that it (or a similar vulnerability in the same code) won't show up again. Since the process automatically restarts, it doesn't negatively impact the system, besides showing a message box to the user.

Script Arguments

randomseed, smbbasic, smbport, smbsign: See the documentation for the smb library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.

Example Usage

nmap --script smb-enum-processes.nse -p445 <host>
sudo nmap -sU -sS --script smb-enum-processes.nse -p U:137,T:139 <host>

Script Output

Host script results:
|  smb-enum-processes:
|_ |_ Idle, System, smss, csrss, winlogon, services, logon.scr, lsass, spoolsv, msdtc, VMwareService, svchost, alg, explorer, VMwareTray, VMwareUser, wmiprvse

--
Host script results:
|  smb-enum-processes:
|  `+-Idle
|   | `-System
|   |   `-smss
|   |     `+-csrss
|   |      `-winlogon
|   |        `+-services
|   |         | `+-spoolsv
|   |         |  +-msdtc
|   |         |  +-VMwareService
|   |         |  +-svchost
|   |         |  `-alg
|   |         +-logon.scr
|   |         `-lsass
|   +-explorer
|   | `+-VMwareTray
|   |  `-VMwareUser
|_  `-wmiprvse

--
Host script results:
|  smb-enum-processes:
|   PID  PPID  Priority Threads Handles
|  ----- ----- -------- ------- -------
|      0     0        0       1       0 `+-Idle
|      4     0        8      49     395  | `-System
|    252     4       11       3      19  |   `-smss
|    300   252       13      10     338  |     `+-csrss
|    324   252       13      18     513  |      `-winlogon
|    372   324        9      16     272  |        `+-services
|    872   372        8      12     121  |         | `+-spoolsv
|    896   372        8      13     151  |         |  +-msdtc
|   1172   372       13       3      53  |         |  +-VMwareService
|   1336   372        8      20     158  |         |  +-svchost
|   1476   372        8       6      90  |         |  `-alg
|    376   324        4       1      22  |         +-logon.scr
|    384   324        9      23     394  |         `-lsass
|   1720  1684        8       9     259  +-explorer
|   1796  1720        8       1      42  | `+-VMwareTray
|   1808  1720        8       1      44  |  `-VMwareUser
|_  1992   580        8       7     179  `-wmiprvse

Requires

Author:

Ron Bowes