Skip to content
HackIndex logo

HackIndex

Detecting Known SMB Vulnerabilities

4 min read May 15, 2026

Nmap NSE scripts fingerprint exploitable SMB issues on Windows and Samba. Most checks safe; some legacy ones risk DoS or crash on vulnerable hosts. Positive hits confirm exploit paths.

SMB Vulnerability Scan

All SMB vuln scripts:

┌──(kali㉿kali)-[~]
└─$ nmap -p 139,445 --script "smb-vuln-*" $TARGET_IP

Reports vulnerable CVEs with details. High noise on broad scans.

Safer subset excludes DoS:

┌──(kali㉿kali)-[~]
└─$ nmap -p 139,445 --script "smb-vuln-* and not intrusive" $TARGET_IP

EternalBlue (MS17-010)

Standard safe check:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms17-010 $TARGET_IP 
Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Confirms RCE potential without crash risk. For exploitation, see EternalBlue MS17-010 SMB RCE.

Legacy Windows RCE Vulnerabilities

MS08-067

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms08-067 $TARGET_IP 
| smb-vuln-ms08-067:
|   VULNERABLE:
|   Microsoft Windows system vulnerable to remote code execution (MS08-067)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2008-4250
|           The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
|           Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
|           code via a crafted RPC request that triggers the overflow during path canonicalization.
|
|     Disclosure date: 2008-10-23
|     References:
|       https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250

SMBv2 negotiation (CVE-2009-3103)

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-cve2009-3103 $TARGET_IP 
Host script results:
| smb-vuln-cve2009-3103:
|   VULNERABLE:
|   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2009-3103
|           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
|           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
|           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
|           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
|           aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.
|
|     Disclosure date: 2009-09-08
|     References:
|       http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms10-061 --script-args printer=<share> $TARGET_IP 
PORT    STATE SERVICE      REASON
445/tcp open  microsoft-ds syn-ack

Requires known printer share. For modern Print Spooler exploitation, see PrintNightmare.

Samba Writable Share RCE

CVE-2017-7494:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-cve-2017-7494 $TARGET_IP 
| smb-vuln-cve-2017-7494:
|   VULNERABLE:
|   SAMBA Remote Code Execution from Writable Share
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-7494
|     Risk factor: HIGH  CVSSv3: 7.5 (HIGH) (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
|       All versions of Samba from 3.5.0 onwards are vulnerable to a remote
|       code execution vulnerability, allowing a malicious client to upload a
|       shared library to a writable share, and then cause the server to load
|       and execute it.
|
|     Disclosure date: 2017-05-24
|     Check results:
|       Samba Version: 4.3.9-Ubuntu
|       Writable share found.
|        Name: \\192.168.15.131\test
|       Exploitation of CVE-2017-7494 succeeded!
|     Extra information:
|       All writable shares:
|        Name: \\192.168.15.131\test
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494
|_      https://www.samba.org/samba/security/CVE-2017-7494.html

Detects loadable pipe vulnerability on unpatched Samba.

Protocol and Configuration Risks

Supported dialects:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-protocols $TARGET_IP 
| smb-protocols:
|   dialects:
|     NT LM 0.12 (SMBv1) [dangerous, but default]
|     2.0.2
|     2.1
|     3.0
|     3.0.2
|_    3.1.1

SMBv1 presence flags broad attack surface.

Signing enforcement:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-security-mode $TARGET_IP 
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Disabled signing enables NTLM relay.

References