NSE script to detect vulnerable CVE-2020-0796 issue, with Microsoft SMBv3 Compression (aka coronablue, SMBGhost)
The script is a modified version of smb-protocols.nse script with a modified output data for v3.11 detection and validating CVE-2020-0796.
Note: This script just safe checks for CVE-2020-0796 vulnerability on SMBv3 and doesn't attempt anything beyond that.
Copy the .nse file to nmap/scripts/ folder and run update
cp cve-2020-0796.nse /usr/share/nmap/scripts/
nmap --script-updatedb
Run as
nmap -p445 --script cve-2020-0796 <<target>>
-- @output
-- | smb-protocols:
-- | dialects:
-- | NT LM 0.12 (SMBv1) [dangerous, but default]
-- | 2.02
-- | 2.10
-- | 3.00
-- | 3.02
-- |_ 3.11 (SMBv3.11) LZNT1 compression algorithm - Vulnerable to CVE-2020-0796 SMBGhost
Checks for compression based on https://github.com/ollypwn/SMBGhost/ Could've been done utilizing smb.lua in the nselib but it required substantial editing of the functions, went with sockets.
NSE script to detect vulnerable CVE-2020-1350 issue, with Microsoft DNS server (aka SIGRed)
The script utilizes code components of dns-nsid.nse script with checks for CVE-2020-1350
Note: This script just safe checks for CVE-2020-1350 vulnerability on Microsoft DNS Servers for identification purposes only and doesn't attempt anything beyond that. This script is not perfect and depends on the output of dig CH TXT bind.version @target and fails when DNS version number is hidden
Copy the .nse file to nmap/scripts/ folder and run update
cp cve-2020-1350.nse /usr/share/nmap/scripts/
nmap --script-updatedb
Run as
sudo nmap -sSU -p53 --script cve-2020-1350 <<target>>
sudo nmap -sSU -p53 --script cve-2020-1350 <<target>> --script-args output=<outputfile.txt>
NSE Script to search for custom HTTP titles provided as script arguments. This script helps in searching and providing only results of HTTP titles required.
Copy the .nse file to nmap/scripts/ folder and run update
cp http-custom-title.nse /usr/share/nmap/scripts/
nmap --script-updatedb
Run as
nmap --script ./http-custom-title.nse -p80 scanme.nmap.org --script-args customtitle='ScanMe'
nmap --script ./http-custom-title.nse <<target>> --script-args customtitle='Apache'
For checking against CVE-2021-21972, CVE-2021-21973 Vulnerability in vCenter. The script also additionally prints the vSphere Version and Build Number
Copy the .nse file to nmap/scripts/ folder and run update
cp cve-2021-21972.nse /usr/share/nmap/scripts/
nmap --script-updatedb
Run as
nmap --script cve-2021-21972.nse -p443 <host> (optional: --script-args output=report.txt)