nmap script "smb-os-discovery.nse" does not output information about the host OS?

Question

I was following this Lynda course.

https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1

The instructor used this script to detect the OS of the target system.

nmap --script /usr/share/nmap/scripts/smb-os-discovery.nse 192.168.56.3

I have a OWASP box vm and Kali Linux running in a host only network in VirtualBox.

192.168.56.3 is the IP of OWASP. I'm running the above command from the Kali linux.

The output is

Starting Nmap 7.70 ( https://nmap.org ) at 2020-04-21 01:00 CDT
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.56.3
Host is up (0.00045s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
139/tcp  open  netbios-ssn
143/tcp  open  imap
443/tcp  open  https
445/tcp  open  microsoft-ds
5001/tcp open  commplex-link
8080/tcp open  http-proxy
8081/tcp open  blackice-icecap
MAC Address: 08:00:27:FE:F6:AC (Oracle VirtualBox virtual NIC)

A port scan is done but the OS detection part in the script is not performed.

For example this is the output shown in the tutorial

Location of the script

Result with verbose mode turned on

nmap --script=/usr/share/nmap/scripts/smb-os-discovery.nse 192.168.56.5 -v

Starting Nmap 7.70 ( https://nmap.org ) at 2020-04-23 08:52 CDT
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 08:52
Completed NSE at 08:52, 0.00s elapsed
Initiating ARP Ping Scan at 08:52
Scanning 192.168.56.5 [1 port]
Completed ARP Ping Scan at 08:52, 0.03s elapsed (1 total hosts)
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Initiating SYN Stealth Scan at 08:52
Scanning 192.168.56.5 [1000 ports]
Completed SYN Stealth Scan at 08:53, 32.10s elapsed (1000 total ports)
NSE: Script scanning 192.168.56.5.
Initiating NSE at 08:53
Completed NSE at 08:53, 0.00s elapsed
Nmap scan report for 192.168.56.5
Host is up (0.031s latency).
All 1000 scanned ports on 192.168.56.5 are filtered
MAC Address: 08:00:27:E6:E5:59 (Oracle VirtualBox virtual NIC)

NSE: Script Post-scanning.
Initiating NSE at 08:53
Completed NSE at 08:53, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 32.37 seconds
           Raw packets sent: 2001 (88.028KB) | Rcvd: 1 (28B)

Answer 1

I have experienced the same "issues". If you take a look at smb-os-discovery.nse it states:

description = [[ Attempts to determine the operating system, computer name, domain, workgroup, and current time over the SMB protocol (ports 445 or 139).

Here's the most important part:

This is done by starting a session with the anonymous account (or with a proper user account, if one is given; it likely doesn't make a difference); in response to a session starting, the server will send back all this information.

Since you did not provide any user account to nmap, it will try a null session. Null session functionality within the SMB protocol enables anonymous access. Once a user is connected to a share through a null session they can enumerate information about the system. If nmap is not returning any information, then I guess it is not able to connect to gather the needed information. This can depend on SMB versions used, configuration, etc.

To collect further information, one would have to perform additional enumeration, such as fingerprinting the OS with the -O flag, enumerating the software versions using -sV and so on.

Answer 2

Script name doesn't need a full path. Try:

nmap --script=smb-os-discovery.nse 192.168.56.5 -v