Detecting Windows hosts vulnerable to MS08-067 and MS17-010
Two of the most infamous remote code execution vulnerabilities affecting outdated systems are MS08-067 and MS17-010. They have been exploited by attackers for years now as there are public exploits available for most platforms.
This recipe shows how to detect Windows machines vulnerable to MS08-067 or MS17-010 with Nmap.
How to do it...
Open your terminal and enter the following Nmap command:
$ nmap -p445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 <target>
If the target is vulnerable, the scan results will include a report similar to the following:
Host script results: | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | ...