Detecting Windows hosts vulnerable to MS08-067 and MS17-010
Two of the most infamous remote code execution vulnerabilities affecting outdated systems are MS08-067 and MS17-010. They have been exploited by attackers for years now as there are public exploits available for most platforms.
This recipe shows how to detect Windows machines vulnerable to MS08-067 or MS17-010 with Nmap.
How to do it...
Open your terminal and enter the following Nmap command:
$ nmap -p445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 <target>
If the target is vulnerable, the scan results will include a report similar to the following:
Host script results: | smb-vuln-ms17-010: |Â Â Â VULNERABLE: |Â Â Â Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) |Â Â Â Â Â State: VULNERABLE |Â Â Â Â Â IDs:Â Â CVE:CVE-2017-0143 |Â Â Â Â Â Risk factor: HIGH |Â Â Â Â ...
