Detecting vulnerabilities using the SMB2/3 boot-time field

Before the Windows Fall Creators Update, it was possible to use the boot-time field returned by SMB2/3 servers during protocol negotiation. Systems that return boot-time information can be fingerprinted for missing security patches. Because the response was part of a valid protocol negotiation before each SMB connection, IDS/IPS/AVs couldn't detect it.

This recipe shows how to detect missing security patches in Windows systems with SMB2/3.

How to do it...

Open your terminal and enter the following Nmap command:

$ nmap -p445 --script smb2-vuln-uptime <target>

The script will report if a system hasn't been rebooted since a critical patch got released:

| smb2-vuln-uptime:
|   VULNERABLE:
|   MS17-010: Security update for Windows SMB Server
|     State: LIKELY VULNERABLE
|     IDs:  ms:ms17-010  ...