Question

During an internal engagement, you have identified several Windows hosts with TCP port 445 open. Before attempting exploitation, you want to safely check whether these hosts are vulnerable to known SMB flaws (such as MS17-010) and gather additional SMB configuration details using Nmap. Which command best accomplishes this enumeration goal?

Accepted Answer

nmap -p445 --script smb-vuln-ms17-010,smb-os-discovery,smb-security-mode 10.10.5.0/24

Answer

nmap -p445 --script smb-brute --script-args userdb=users.txt,passdb=pass.txt 10.10.5.0/24

Answer

nmap -sU -p445 -A 10.10.5.0/24

Answer

nmap -p445 --script vuln --min-rate 10000 -T5 10.10.5.0/24