62 matches found
smb-vuln-ms10-061 NSE Script
Tests whether target machines are vulnerable to ms10-061 Printer Spooler impersonation vulnerability. This vulnerability was used in Stuxnet worm. The script checks for the vuln in a safe way without a possibility of crashing the remote system as this is not a memory corruption vulnerability. In...
smb-mbenum NSE Script
Queries information managed by the Windows Master Browser. Script Arguments smb-mbenum.format optional if set, changes the format of the result returned by the script. There are three possible formats: 1. Ordered by type horizontally 2. Ordered by type vertically 3. Ordered by type vertically...
Nmap NSE net: smb-server-stats
Attempts to grab the server's statistics over SMB and MSRPC, which uses TCP ports 445 or 139. An administrator account is required to pull these statistics on most versions of Windows, and Vista and above require UAC to be turned down. Some of the numbers returned here don't feel right to me, but...
Nmap NSE net: smb-enum-groups
Obtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to 'enum.exe' with the '/G' switch. The following MSRPC functions in SAMR are used to find a list of groups and the RIDs of their users. Keep in mind that MSRPC refers to groups a...
Nmap NSE net: smb-enum-users
Attempts to enumerate the users on a remote Windows system, with as much information as possible, through two different techniques both over MSRPC, which uses port 445 or 139; see 'smb.lua'. The goal of this script is to discover all user accounts that exist on a remote system. This can be helpfu...
stuxnet-detect NSE Script
Detects whether a host is infected with the Stuxnet worm . An executable version of the Stuxnet infection will be downloaded if a format for the filename is given on the command line. See also: smb-vuln-ms10-061.nse Script Arguments stuxnet-detect.save Path to save Stuxnet executable under, with ...
smb-enum-groups NSE Script
Obtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to enum.exe with the /G switch. The following MSRPC functions in SAMR are used to find a list of groups and the RIDs of their users. Keep in mind that MSRPC refers to groups as...
smb-server-stats NSE Script
Attempts to grab the server's statistics over SMB and MSRPC, which uses TCP ports 445 or 139. An administrator account is required to pull these statistics on most versions of Windows, and Vista and above require UAC to be turned down. Some of the numbers returned here don't feel right to me, but...
smb-enum-users NSE Script
Attempts to enumerate the users on a remote Windows system, with as much information as possible, through two different techniques both over MSRPC, which uses port 445 or 139; see smb.lua. The goal of this script is to discover all user accounts that exist on a remote system. This can be helpful...
OS Identification : MSRPC
This plugin attempts to identify the operating system type and version by connecting to the remote Microsoft Remote Procedure Call MSRPC server. C Tenable, Inc. include"compat.inc"; if description scriptid25248; scriptversion"1.45"; scriptsetattributeattribute:"pluginmodificationdate",...
CA BrightStor ARCserve Backup Tape Engine Multiple Remote Overflows (QO84983)
This host is running BrightStor ARCServe for Windows. The remote version of this software has multiple buffer overflow vulnerabilities in the Tape Engine MSRPC service. An attacker, by sending a specially crafted packet, may be able to crash the affected service or execute code on the remote host...
MSRPC Service Detection
The remote host is running a Windows RPC service. This service replies to the RPC Bind Request with a Bind Ack response. However it is not possible to determine the uuid of this service. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid22319; scriptversion"1.10";...
Immunity Canvas: MS06_025
Name| ms06025 ---|--- CVE| CVE-2006-2371 Exploit Pack| CANVAS Description| RasMan RPC Server Signedness Bug Notes| CVE Name: CVE-2006-2371 VENDOR: Microsoft Notes: If you choose the wrong version to attack, RasMan may stop responding with MSRPC Pipe Not Available errors, and will most likely not...
DCE/RPC and MSRPC Services Enumeration
Distributed Computing Environment / Remote Procedure Calls DCE/RPC or MSRPC based service enumeration. SPDX-FileCopyrightText: 2005 Dave Aitel ported to NASL by rd and Pavel Kankovsky Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...
[Full-disclosure] NULL sessions vulnerabilities using alternate named pipes
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NULL sessions vulnerabilities using alternate named pipes Hervй Schauer Consultants Security Advisory http://www.hsc.fr/ - - Summary - Advisory: NULL sessions vulnerabilities using alternate named pipes CVE identifier: CAN-2005-2150 Release date:...
Microsoft Windows SMB svcctl MSRPC Interface SCM Service Enumeration
It is possible to anonymously read the event logs of the remote Windows 2000 host by connecting to the \srvsvc pipe and binding to the event log service, OpenEventLog. An attacker may use this flaw to anonymously read the system logs of the remote host. As system logs typically include valuable...
CVE-2002-1873
Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call MSRPC, allows remote attackers to cause a denial of service crash or memory consumption via malformed MSRPC calls...
CVE-2002-1873
CVE-2002-1873 affects Microsoft Exchange 2000 when used with MSRPC, allowing remote attackers to cause denial of service (crash or memory consumption) via malformed MSRPC calls. The connected Red Hat and CVE List entries mirror this description. No specific patch/version details or remediation ar...
CVE-2002-1873: Uncontrolled Resource Consumption
Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call MSRPC, allows remote attackers to cause a denial of service crash or memory consumption via malformed MSRPC calls...
