Nmap Scan Params for CVE-2017-0143 MS17-010 Scanning

nmap-cmdline

# Scan for CVE-2017-0143 MS17-010
# The vulnerability used by WannaCry Ransomware
# 
# 1. Use @calderpwn's script
#    http://seclists.org/nmap-dev/2017/q2/79
# 
# 2. Save it to Nmap NSE script directory
#    Linux - /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
#    OSX - /opt/local/share/nmap/scripts/
# 
# Note: 
# I had to use "--max-hostgroup 3", otherwise the script misses vulnerable hosts using nmap 7.30 on OS X
# Don't use "-T4", this also caused the script to miss vulnerable hosts
# 
# Find a test range via ShodanHQ
# https://www.shodan.io/search?query=port%3A445+os%3A%22Windows+Server+2003%22

nmap -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse X.X.X.X/X

I am currently doing this in a local lab and experienced the "could not connect to ipc$" error. To confirm that my system was indeed patched I executed the following steps (NOT recommended if you are running a production instance) -

1. Enable file and printer sharing
2. Disable firewall
3. Allowed Guest logon for SMB share
4. Enabled SMB v1 (this is disabled by default). Run the following command to enable it.

Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol

That helped me the following result:

smb-vuln-ms17-010: This system is patched.