Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix report_vuln/print_error in smb_ms17_010 #8255

Merged
merged 1 commit into from Apr 17, 2017
Merged

Fix report_vuln/print_error in smb_ms17_010 #8255

merged 1 commit into from Apr 17, 2017

Conversation

wvu
Copy link
Contributor

@wvu wvu commented Apr 17, 2017

report_vuln was missing the necessary keys to store the vuln in the database. print_error got annoying when scanning a range of hosts.

  • vulns shows the vuln now
  • Scanning a range doesn't barf errors

#8167

host: ip,
name: self.name,
refs: self.references,
info: 'STATUS_INSUFF_SERVER_RESOURCES for FID 0 against IPC$'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Happy to change this to something else, but this is what made the most sense to me, given that we're already reporting module title and references.

@jork2345
Copy link

Is it possible to make an exploit module of this vulnerability ?

@ghost
Copy link

ghost commented Apr 17, 2017

@jork2345 according to Microsoft, this is exploitable with EternalBlue, EternalRomance, and EternalSynergy

https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/

These are some of the most complex exploits I've ever seen, and I don't say that lightly. Eternalromance does a ridiculous amount of "grooming", aka remote heap feng shui. In the case of EternalBlue, it simultaneously exploits SMBv1 and SMBv2, and talks Cairo, an undocumented SMB LanMan alternative. I haven't even gotten around to looking at EternalSynergy.

tl;dr The exploit modules are gonna be huge, even if they simply just replay the pcaps of these exploits.

@wvu wvu merged commit b1c7f13 into rapid7:master Apr 17, 2017
wvu added a commit that referenced this pull request Apr 17, 2017
@wvu wvu deleted the pr/8167 branch April 17, 2017 16:41
@tdoan-r7
Copy link
Contributor

Running the vulns command with smb_ms17_010 now shows vulnerabilities and running the print_error command doesn't error out when scanning a range of hosts.

@tdoan-r7 tdoan-r7 added the rn-fix release notes fix label Apr 18, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants