Nmap Scan Params for CVE-2017-0143 MS17-010 Scanning

nmap-cmdline

# Scan for CVE-2017-0143 MS17-010
# The vulnerability used by WannaCry Ransomware
# 
# 1. Use @calderpwn's script
#    http://seclists.org/nmap-dev/2017/q2/79
# 
# 2. Save it to Nmap NSE script directory
#    Linux - /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
#    OSX - /opt/local/share/nmap/scripts/
# 
# Note: 
# I had to use "--max-hostgroup 3", otherwise the script misses vulnerable hosts using nmap 7.30 on OS X
# Don't use "-T4", this also caused the script to miss vulnerable hosts
# 
# Find a test range via ShodanHQ
# https://www.shodan.io/search?query=port%3A445+os%3A%22Windows+Server+2003%22

nmap -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse X.X.X.X/X

Lua 5.2's string library doesn't support pack and unpack and that's why you get:

/usr/bin/../share/nmap/scripts/smb-vuln-ms17-010.nse:94: attempt to call field 'pack' (a nil value)

You can use string.char and string.byte to replace these with some work. Be careful with the number of bytes when packing.

Older versions of nmap don't have the stdnse.debug[12] calls:

smb-vuln-ms17-010.nse:88: variable 'debug1' is not declared

You can replace those with nmap.log_write("stdout", string.format calls.

I am currently doing this in a local lab and experienced the "could not connect to ipc$" error. To confirm that my system was indeed patched I executed the following steps (NOT recommended if you are running a production instance) -

1. Enable file and printer sharing
2. Disable firewall
3. Allowed Guest logon for SMB share
4. Enabled SMB v1 (this is disabled by default). Run the following command to enable it.

Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol

That helped me the following result:

smb-vuln-ms17-010: This system is patched.