Rapid7 Vulnerability & Exploit Database

MS17-010 SMB RCE Detection

Back to Search

MS17-010 SMB RCE Detection

Created
05/30/2018

Description

Uses information disclosure to determine if MS17-010 has been patched or not. Specifically, it connects to the IPC$ tree and attempts a transaction on FID 0. If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does not have the MS17-010 patch. If the machine is missing the MS17-010 patch, the module will check for an existing DoublePulsar (ring 0 shellcode/malware) infection. This module does not require valid SMB credentials in default server configurations. It can log on as the user "\" and connect to IPC$.

Author(s)

  • Sean Dillon <sean.dillon@risksense.com>
  • Luke Jennings

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(smb_ms17_010) > show actions
    ...actions...
msf auxiliary(smb_ms17_010) > set ACTION < action-name >
msf auxiliary(smb_ms17_010) > show options
    ...show and set options...
msf auxiliary(smb_ms17_010) > run

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;