# Detecting Known SMB Vulnerabilities

> Enumerate SMB services to identify unpatched vulnerabilities including EternalBlue (MS17-010), SMBGhost (CVE-2020-0796), and misconfigurations using Nmap and Metasploit.

- **URL:** https://hackindex.io/services/smb/vulnerability-discovery/detecting-known-smb-vulnerabilities
- **Path:** SMB > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/smb/vulnerability-discovery.md)
- **Published:** 2026-01-04
- **Updated:** 2026-08-11

Nmap NSE scripts fingerprint exploitable SMB issues on Windows and Samba. Most checks are safe. Some legacy scripts risk crashing vulnerable hosts. Positive hits confirm exploit paths. The wildcard matches all available SMB vulnerability scripts in Nmap's NSE library. Each script runs independently. A finding requires `State: VULNERABLE` in the output. Scripts that find nothing produce no output. No output from a script means the check passed clean. Run against both port 139 and 445. Some legacy Windows hosts respond only on 139.

## SMB Vulnerability Scan

All SMB vuln scripts:

```bash
nmap -p 139,445 --script "smb-vuln-*" $TARGET_IP
```

Reports vulnerable CVEs with details. High noise on broad scans. The `intrusive` category includes scripts that send malformed or unexpected packets. Fragile targets like domain controllers, legacy industrial systems, and Windows XP or Server 2003 hosts can crash. Use the non-intrusive subset on production targets. It still covers MS17-010 and SambaCry, the highest-value findings on most networks.

Key NSE scripts for SMB vulnerability detection:

- `smb-vuln-ms17-010` (EternalBlue, safe check)
- `smb-vuln-ms08-067` (legacy RCE, can crash target)
- `smb-vuln-cve2009-3103` (SMBv2 negotiation, DoS risk)
- `smb-vuln-cve-2017-7494` (SambaCry writable share RCE)
- `smb-vuln-ms10-061` (Print Spooler)

Safer subset excludes DoS:

```bash
nmap -p 139,445 --script "smb-vuln-* and not intrusive" $TARGET_IP
```

## EternalBlue (MS17-010)

MS17-010 targets SMBv1 on Windows 7, Server 2008 R2, and unpatched Server 2012 R2. It is the most commonly encountered critical SMB vulnerability in lab environments and older enterprise networks. The NSE check sends a crafted packet and reads the error code. It does not trigger the actual exploit. False positives are rare. Standard safe check:

```bash
nmap -p 445 --script smb-vuln-ms17-010 $TARGET_IP
# Host script results:
# | smb-vuln-ms17-010:
# |   VULNERABLE:
# |   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2017-0143
# |     Risk factor: HIGH
# |       A critical remote code execution vulnerability exists in Microsoft SMBv1
# |        servers (ms17-010).
# |
# |     Disclosure date: 2017-03-14
# |     References:
# |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
# |       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
# |_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
```

The `State: VULNERABLE` line is the definitive indicator. The CVE ID `CVE-2017-0143` confirms the specific variant. If the script returns `NOT VULNERABLE`, the host is patched or has SMBv1 disabled. Confirm with `smb-protocols` to check whether SMBv1 is present at all. Confirms RCE potential without crash risk. For exploitation, see [EternalBlue MS17-010 SMB RCE](https://hackindex.io/services/smb/exploitation/vulnerabilities/eternalblue-ms17-010-smb-rce).

## Legacy Windows RCE Vulnerabilities

### MS08-067

> [!WARNING]
> High crash risk on vulnerable systems.

```bash
nmap -p 445 --script smb-vuln-ms08-067 $TARGET_IP
# | smb-vuln-ms08-067:
# |   VULNERABLE:
# |   Microsoft Windows system vulnerable to remote code execution (MS08-067)
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2008-4250
# |           The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
# |           Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
# |           code via a crafted RPC request that triggers the overflow during path canonicalization.
# |
# |     Disclosure date: 2008-10-23
# |     References:
# |       https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
# |_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
```

MS08-067 affects Windows 2000, XP, and Server 2003. It triggers a stack overflow via a crafted RPC request over SMB. In modern networks it is rare, but CTF boxes and OSCP labs still include it. The NSE script sends an actual exploit packet. This can crash real vulnerable hosts, so treat it as destructive.

### SMBv2 negotiation (CVE-2009-3103)

> [!WARNING]
> DoS possible.

```bash
nmap -p 445 --script smb-vuln-cve2009-3103 $TARGET_IP
# Host script results:
# | smb-vuln-cve2009-3103:
# |   VULNERABLE:
# |   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2009-3103
# |           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
# |           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
# |           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
# |           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
# |           aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.
# |
# |     Disclosure date: 2009-09-08
# |     References:
# |       http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
# |_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
```

This vulnerability affects Vista and Server 2008 only. The SMBv2 NEGOTIATE request triggers an out-of-bounds dereference in srv2.sys. The NSE check itself can trigger the crash. Only run it in isolated lab conditions on expendable hosts.

### Print Spooler (MS10-061)

```bash
nmap -p 445 --script smb-vuln-ms10-061 --script-args printer=<share> $TARGET_IP
# PORT    STATE SERVICE      REASON
# 445/tcp open  microsoft-ds syn-ack
```

Get the printer share name from earlier SMB enumeration. Use `nxc smb $TARGET_IP --shares` or `smbclient -L //$TARGET_IP` to list available shares. Pass the share name with `--script-args printer=<share>`. Without a valid share name, the script cannot probe the vulnerability and returns no useful output. Requires known printer share. For modern Print Spooler exploitation, see [PrintNightmare](https://hackindex.io/services/smb/exploitation/vulnerabilities/printnightmare-print-spooler-rce-to-system).

## Samba Writable Share RCE

SambaCry (CVE-2017-7494) affects Samba 3.5.0 through unpatched 4.x releases. A malicious client uploads a shared library to a writable share. The client then triggers a pipe open, causing Samba to load and execute the library as the daemon user. CVE-2017-7494:

```bash
nmap -p 445 --script smb-vuln-cve-2017-7494 $TARGET_IP
# | smb-vuln-cve-2017-7494:
# |   VULNERABLE:
# |   SAMBA Remote Code Execution from Writable Share
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2017-7494
# |     Risk factor: HIGH  CVSSv3: 7.5 (HIGH) (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
# |       All versions of Samba from 3.5.0 onwards are vulnerable to a remote
# |       code execution vulnerability, allowing a malicious client to upload a
# |       shared library to a writable share, and then cause the server to load
# |       and execute it.
# |
# |     Disclosure date: 2017-05-24
# |     Check results:
# |       Samba Version: 4.3.9-Ubuntu
# |       Writable share found.
# |        Name: \\192.168.15.131\test
# |       Exploitation of CVE-2017-7494 succeeded!
# |     Extra information:
# |       All writable shares:
# |        Name: \\192.168.15.131\test
# |     References:
# |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494
# |_      https://www.samba.org/samba/security/CVE-2017-7494.html
```

Detects loadable pipe vulnerability on unpatched Samba. The `Writable share found` line is the key condition. A vulnerable Samba version without a writable share cannot be exploited via this method. The script checks both version and share writability, then reports the combined verdict. The `Exploitation of CVE-2017-7494 succeeded!` line means the script confirmed actual code execution, not just detection.

## Protocol and Configuration Risks

The `smb-protocols` script queries the server for its full dialect list. Each listed dialect is actively negotiated. Supported dialects:

```bash
nmap -p 445 --script smb-protocols $TARGET_IP
# | smb-protocols:
# |   dialects:
# |     NT LM 0.12 (SMBv1) [dangerous, but default]
# |     2.0.2
# |     2.1
# |     3.0
# |     3.0.2
# |_    3.1.1
```

SMBv1 presence flags broad attack surface. SMBv1 appears as `NT LM 0.12`. The `[dangerous, but default]` tag confirms the dialect is actively negotiated. Any host listing SMBv1 is a candidate for MS17-010 and MS08-067 checks. SMBv1 presence alone does not confirm MS17-010. The patch may still be applied. Run `smb-vuln-ms17-010` to confirm. A host showing only SMBv2 or SMBv3 dialects is not an EternalBlue candidate.

Signing enforcement:

```bash
nmap -p 445 --script smb-security-mode $TARGET_IP
# | smb-security-mode:
# |   account_used: guest
# |   authentication_level: user
# |   challenge_response: supported
# |_  message_signing: disabled (dangerous, but default)
```

Disabled signing enables NTLM relay. The `message_signing: disabled` state means the server accepts unsigned SMB traffic. An attacker who intercepts an NTLM authentication challenge can relay it to another unsigned host. The `authentication_level: user` line confirms NTLM is in use, which is relay-capable. Combine this finding with a writable share or an SMBv1 host to build a complete attack chain. If the target shows `message_signing: required`, relay attacks against that host are blocked. Clients connecting to it may still be relayable to other unsigned targets.

## References

- [smb-vuln-ms17-010 NSE script](https://nmap.org/nsedoc/scripts/smb-vuln-ms17-010.html) - EternalBlue (MS17-010) detection
- [smb-vuln-ms08-067 NSE script](https://nmap.org/nsedoc/scripts/smb-vuln-ms08-067.html) - MS08-067 detection
- [smb-vuln-cve2009-3103 NSE script](https://nmap.org/nsedoc/scripts/smb-vuln-cve2009-3103.html) - SMBv2 negotiation vulnerability
- [smb-vuln-cve-2017-7494 NSE script](https://nmap.org/nsedoc/scripts/smb-vuln-cve-2017-7494.html) - Samba remote code execution
- [smb-protocols NSE script](https://nmap.org/nsedoc/scripts/smb-protocols.html) - SMB dialect enumeration
- [smb-security-mode NSE script](https://nmap.org/nsedoc/scripts/smb-security-mode.html) - Signing and encryption checks