Detecting Windows hosts vulnerable to MS08-067 and MS17-010

Two of the most infamous remote code execution vulnerabilities affecting outdated systems are MS08-067 and MS17-010. They have been exploited by attackers for years now as there are public exploits available for most platforms.

This recipe shows how to detect Windows machines vulnerable to MS08-067 or MS17-010 with Nmap.

How to do it...

Open your terminal and enter the following Nmap command:

$ nmap -p445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 <target>

If the target is vulnerable, the scan results will include a report similar to the following:

Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|    ...