Skip to content
HackIndex logo

HackIndex

SMBv1 Enabled Detection

2 min read May 15, 2026

SMBv1 is a finding by itself. It keeps the host compatible with legacy SMB attack paths and old remote code execution checks that no longer apply to hardened SMBv2 and SMBv3-only systems.

Start with the supported dialects.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-protocols $TARGET_IP 
| smb-protocols:
|   dialects:
|     NT LM 0.12 (SMBv1) [dangerous, but default]
|     2.1
|     3.0.2
|     3.1.1

Add host context before deciding how much time to spend on it.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 139,445 -sV --script smb-os-discovery $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP

On a modern Windows host, SMBv1 usually means hardening debt and keeps legacy CVE checks in scope. On a clearly old system, it is still important, but often less surprising.

Once SMBv1 is confirmed, move straight to targeted legacy checks instead of generic enumeration.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-vuln-ms17-010 $TARGET_IP

A positive MS17-010 result leads directly to EternalBlue MS17-010 SMB RCE. If the Print Spooler service is running, also check PrintNightmare.

If SMBv1 is absent, drop most legacy SMB vulnerability paths and focus on signing, share exposure, and access control.

References