5

Is there a ready way with nmap's scripting option to find machines with SMB 1 still enabled server side? It'd be a whole lot faster for me to monitor my remediation if it is available.

I'd rather not have to run a complete OpenVAS scan for this one piece of information.

Improve this question
4
  • you can't just run the SMB plugin for OpenVAS?
    – schroeder ♦
    Commented Apr 5, 2017 at 18:34
  • @schroeder I'm using Alienvault's OSSIM, and their staff haven't figured out how to make scans only using specific plugins even after several requests over the years.
    – Tim Brigham
    Commented Apr 5, 2017 at 18:36
  • Ok, then have you looked at nmap's options? Does it need to be nmap? There are tons of SMB enum scanners that will do this.
    – schroeder ♦
    Commented Apr 5, 2017 at 18:38
  • @schroeder ideally I'd like it to be an nmap script but it strictly isn't necessary.
    – Tim Brigham
    Commented Apr 5, 2017 at 18:39

4 Answers 4

Reset to default
9

There is not currently a script to check for this. It would be a trivial change to the existing smbv2-enabled script. Currently, the script has three possible outputs:

  • No output: SMB of any version failed.
  • "Server supports SMBv2 protocol": Server supports at least SMBv2, possibly also SMBv1.
  • "Server doesn't support SMBv2 protocol": Server supports SMBv1 but not SMBv2.

As you can see, there's some ambiguity about whether a SMBv2-enabled host would also support SMBv1. But modifying the script to test each dialect in turn would be pretty simple.

EDIT: This is coming to Nmap soon. https://github.com/nmap/nmap/pull/943

EDIT 2: This is now supported in Nmap 7.60 by the smb-protocols script.

Improve this answer
4
  • 2
    I can't believe someone downvoted one of the core developers of nmap, giving a complete and informative answer to the question.
    – Royce Williams
    Commented May 19, 2017 at 17:48
  • 1
    This answer is complete & accurate, can someone let us know if this still is the same & no modules released yet other than that of SMB detection etc.??
    – Shritam Bhowmick
    Commented May 22, 2017 at 6:27
  • 2
    @ShritamBhowmick Made a note to implement this and update this answer when done: secwiki.org/w/Nmap/Script_Ideas#smb-version
    – bonsaiviking
    Commented May 22, 2017 at 13:43
  • 1
    Nmap 7.60 now includes this feature. nmap.org/nsedoc/scripts/smb-protocols.html
    – bonsaiviking
    Commented Aug 2, 2017 at 0:01
2

There's a script called smb-vuln-ms08-067 & smb-vuln-cve2009-3103 contrary to what other answers were. You can use this via nmap -sU --script smb-vuln-ms08-067.nse -p U:137 <host> or nmap --script smb-vuln-ms08-067.nse -p445 <host>

nmap --script smb-os-discovery.nse -p445 127.0.0.1 will detect the host & protocol, you would just need to use grep to see if it's still smbv1 supported.

For the Latest SMBv2 Exploit Detection, use: https://github.com/countercept/doublepulsar-c2-traffic-decryptor

Example Usage

nmap --script smb-vuln-ms08-067.nse -p445 nmap -sU --script smb-vuln-ms08-067.nse -p U:137

Requires

msrpc nmap smb stdnse string table vulns

Reference: https://nmap.org/nsedoc/scripts/smb-vuln-ms08-067.html

Improve this answer
1
2

I was able to make a semi-functional smbv1-enabled.nse by taking the smbv2-enabled script and removing all the other dialects, leaving only NT LM .12

Remember that SMBv1 is really NT LM .12

Once you do that, you will get one of two results. If SMBv1 is enabled on the server, you'll get a bogus error that the server does not support smbv2; if SMBv1 is disabled, you won't get any message at all (because the SMB handshake fails).

Improve this answer
0 
nmap -p139,445 --script smb-protocols IP-target
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .