Scan For MS08-067 With Nmap

by Paul Asadoorian
It has been a few weeks since the release of patches (and exploits) for MS08-067. We all should have had plenty of time to deploy patches to our systems and reboot for them to take effect.
How about we make sure?
Don’t have one of those expensive scanning tools? How about Nessus? Sure, Nessus is great, but how about something more lean and mean?
Nmap to the rescue!
Note: You must use the current svn version to make this work, so go get it with the following command:

svn co --username guest --password "" svn://

sonarscreen.jpgOk, now let’s make Nmap work for us! We’ll tell Nmap to output the results to a file named for our subnet (in all 3 file formats no less), perform a SYN Scan on port 445, and execute the SMB vulnerability checking NSE script against the discovered hosts on the network:

nmap -oA 192168-filename -sS -p445 --script smb-check-vulns.nse

Now we can take these results and verify which Windows hosts on our network require a little extra attention in the patch department.
You want fast? Fyodor will give you fast! In a live network, Nmap was able to perform the scan in just over a minute:

Nmap done: 256 IP addresses (156 hosts up) scanned in 83.53 seconds

[Editors note: Paul, what a great use of a free, simple to use tool. I’m really liking the focus on NSE expansion for Nmap! -Larry]

Larry Pesce

A self-professed, lifelong “tinkerer and explorer,” Larry always wanted to know how things work. “I found myself getting to engage in deep dives of technology from an early age: My dad built the family television from a kit, and I helped. It caught fire. Twice. I helped fix it both times.”

The help and advice received from the infosec community throughout his career inspired him to share what he had learned to help others secure their networks and improve their craft. Part of that ongoing sharing has been as the co-founder and co-host of the international award winning Paul’s Security Weekly podcast for more than 19 years.

Larry has spent the last 15 years as a penetration tester, spending lots of time focused on Healthcare, ICS/OT, Wireless, and IoT/IIoT/Embedded Devices, but now focuses his efforts on securing the software supply chain at Finite State.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.