CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/documentation/modules/auxiliary/scanner/smb/smb_ms17_010.md
Views: 11784

MS17-010 fixes RCE in SMBv1, but seems to also have inadvertently added a remote, uncredentialed patch check information disclosure.

This module can determine if MS17-010 has been patched or not. Specifically, it connects to the IPC$ tree and attempts a PeekNamedPipe transaction on FID 0.

If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does not have the MS17-010 patch. After the patch, Win10 returns "STATUS_ACCESS_DENIED" and other Windows versions "STATUS_INVALID_HANDLE". In case none of these are detected, the module says it was not able to detect the patch level.

This module does not require valid SMB credentials in default server configurations. It can log on as the user "" and connect to IPC$.

Vulnerable Application

To use smb_ms17_010, make sure you are able to connect to a SMB service that supports SMBv1.

Verification Steps

The following demonstrates a basic scenario of an unpatched system.

msf > use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(smb_ms17_010) > set RHOSTS 192.168.1.104
RHOSTS => 192.168.1.104
msf auxiliary(smb_ms17_010) > run

[*] 192.168.1.104:445    - Connected to \\192.168.1.104\IPC$ with TID = 2048
[*] 192.168.1.104:445    - Received STATUS_INSUFF_SERVER_RESOURCES with FID = 0
[!] 192.168.1.104:445    - Host is likely VULNERABLE to MS17-010!
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

If you run the same scan on the system after patching, you should see the following:

msf auxiliary(smb_ms17_010) > run

[*] 192.168.1.104:445    - Connected to \\192.168.1.104\IPC$ with TID = 2052
[*] 192.168.1.104:445    - Received STATUS_ACCESS_DENIED with FID = 0
[+] 192.168.1.104:445    - Host does NOT appear vulnerable.
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Options

By default, the smb_ms17_010 module only requires the RHOSTS option to run. In a default configuration, you will not need valid credentials to connect to the IPC$ share. But, if you have them, it can't hurt.

The SMBUser option

If you are testing a specific user, use this option.

set SMBUser [user name]

The SMBPass option

If you are testing a specific password, use this option.

set SMBPass [password]