Skip to content
HackIndex.io

Detecting Known SMB Vulnerabilities

7 min read Created Jan 4, 2026 Last updated Aug 11, 2026

Nmap NSE scripts fingerprint exploitable SMB issues on Windows and Samba. Most checks are safe. Some legacy scripts risk crashing vulnerable hosts. Positive hits confirm exploit paths. The wildcard matches all available SMB vulnerability scripts in Nmap's NSE library. Each script runs independently. A finding requires State: VULNERABLE in the output. Scripts that find nothing produce no output. No output from a script means the check passed clean. Run against both port 139 and 445. Some legacy Windows hosts respond only on 139.

SMB Vulnerability Scan

All SMB vuln scripts:

┌──(kali㉿kali)-[~]
└─$ nmap -p 139,445 --script "smb-vuln-*" $TARGET_IP

Reports vulnerable CVEs with details. High noise on broad scans. The intrusive category includes scripts that send malformed or unexpected packets. Fragile targets like domain controllers, legacy industrial systems, and Windows XP or Server 2003 hosts can crash. Use the non-intrusive subset on production targets. It still covers MS17-010 and SambaCry, the highest-value findings on most networks.

Key NSE scripts for SMB vulnerability detection:

  • smb-vuln-ms17-010 (EternalBlue, safe check)
  • smb-vuln-ms08-067 (legacy RCE, can crash target)
  • smb-vuln-cve2009-3103 (SMBv2 negotiation, DoS risk)
  • smb-vuln-cve-2017-7494 (SambaCry writable share RCE)
  • smb-vuln-ms10-061 (Print Spooler)

Safer subset excludes DoS:

┌──(kali㉿kali)-[~]
└─$ nmap -p 139,445 --script "smb-vuln-* and not intrusive" $TARGET_IP

EternalBlue (MS17-010)

MS17-010 targets SMBv1 on Windows 7, Server 2008 R2, and unpatched Server 2012 R2. It is the most commonly encountered critical SMB vulnerability in lab environments and older enterprise networks. The NSE check sends a crafted packet and reads the error code. It does not trigger the actual exploit. False positives are rare. Standard safe check:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms17-010 $TARGET_IP 
Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

The State: VULNERABLE line is the definitive indicator. The CVE ID CVE-2017-0143 confirms the specific variant. If the script returns NOT VULNERABLE, the host is patched or has SMBv1 disabled. Confirm with smb-protocols to check whether SMBv1 is present at all. Confirms RCE potential without crash risk. For exploitation, see EternalBlue MS17-010 SMB RCE.

Legacy Windows RCE Vulnerabilities

MS08-067

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms08-067 $TARGET_IP 
| smb-vuln-ms08-067:
|   VULNERABLE:
|   Microsoft Windows system vulnerable to remote code execution (MS08-067)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2008-4250
|           The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
|           Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
|           code via a crafted RPC request that triggers the overflow during path canonicalization.
|
|     Disclosure date: 2008-10-23
|     References:
|       https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250

MS08-067 affects Windows 2000, XP, and Server 2003. It triggers a stack overflow via a crafted RPC request over SMB. In modern networks it is rare, but CTF boxes and OSCP labs still include it. The NSE script sends an actual exploit packet. This can crash real vulnerable hosts, so treat it as destructive.

SMBv2 negotiation (CVE-2009-3103)

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-cve2009-3103 $TARGET_IP 
Host script results:
| smb-vuln-cve2009-3103:
|   VULNERABLE:
|   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2009-3103
|           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
|           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
|           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
|           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
|           aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.
|
|     Disclosure date: 2009-09-08
|     References:
|       http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103

This vulnerability affects Vista and Server 2008 only. The SMBv2 NEGOTIATE request triggers an out-of-bounds dereference in srv2.sys. The NSE check itself can trigger the crash. Only run it in isolated lab conditions on expendable hosts.

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms10-061 --script-args printer=<share> $TARGET_IP 
PORT    STATE SERVICE      REASON
445/tcp open  microsoft-ds syn-ack

Get the printer share name from earlier SMB enumeration. Use nxc smb $TARGET_IP --shares or smbclient -L //$TARGET_IP to list available shares. Pass the share name with --script-args printer=<share>. Without a valid share name, the script cannot probe the vulnerability and returns no useful output. Requires known printer share. For modern Print Spooler exploitation, see PrintNightmare.

Samba Writable Share RCE

SambaCry (CVE-2017-7494) affects Samba 3.5.0 through unpatched 4.x releases. A malicious client uploads a shared library to a writable share. The client then triggers a pipe open, causing Samba to load and execute the library as the daemon user. CVE-2017-7494:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-cve-2017-7494 $TARGET_IP 
| smb-vuln-cve-2017-7494:
|   VULNERABLE:
|   SAMBA Remote Code Execution from Writable Share
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-7494
|     Risk factor: HIGH  CVSSv3: 7.5 (HIGH) (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
|       All versions of Samba from 3.5.0 onwards are vulnerable to a remote
|       code execution vulnerability, allowing a malicious client to upload a
|       shared library to a writable share, and then cause the server to load
|       and execute it.
|
|     Disclosure date: 2017-05-24
|     Check results:
|       Samba Version: 4.3.9-Ubuntu
|       Writable share found.
|        Name: \\192.168.15.131\test
|       Exploitation of CVE-2017-7494 succeeded!
|     Extra information:
|       All writable shares:
|        Name: \\192.168.15.131\test
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494
|_      https://www.samba.org/samba/security/CVE-2017-7494.html

Detects loadable pipe vulnerability on unpatched Samba. The Writable share found line is the key condition. A vulnerable Samba version without a writable share cannot be exploited via this method. The script checks both version and share writability, then reports the combined verdict. The Exploitation of CVE-2017-7494 succeeded! line means the script confirmed actual code execution, not just detection.

Protocol and Configuration Risks

The smb-protocols script queries the server for its full dialect list. Each listed dialect is actively negotiated. Supported dialects:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-protocols $TARGET_IP 
| smb-protocols:
|   dialects:
|     NT LM 0.12 (SMBv1) [dangerous, but default]
|     2.0.2
|     2.1
|     3.0
|     3.0.2
|_    3.1.1

SMBv1 presence flags broad attack surface. SMBv1 appears as NT LM 0.12. The [dangerous, but default] tag confirms the dialect is actively negotiated. Any host listing SMBv1 is a candidate for MS17-010 and MS08-067 checks. SMBv1 presence alone does not confirm MS17-010. The patch may still be applied. Run smb-vuln-ms17-010 to confirm. A host showing only SMBv2 or SMBv3 dialects is not an EternalBlue candidate.

Signing enforcement:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-security-mode $TARGET_IP 
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Disabled signing enables NTLM relay. The message_signing: disabled state means the server accepts unsigned SMB traffic. An attacker who intercepts an NTLM authentication challenge can relay it to another unsigned host. The authentication_level: user line confirms NTLM is in use, which is relay-capable. Combine this finding with a writable share or an SMBv1 host to build a complete attack chain. If the target shows message_signing: required, relay attacks against that host are blocked. Clients connecting to it may still be relayable to other unsigned targets.

References