This is taken from the nmap seclist page. A script for nmap has been written that should allow you to scan your network to determine if its vulnerable. It may not be perfect but I am sure it will help someone out there.
I need some help testing the script smb-vuln-ms17-010. I tested it on a vulnerable win7 machine and it works as
expected but I suspect there might be some issues with newer Windows versions and certain smb configurations (v2
authentication protocols with signing enabled).
Don't forget to send me packet captures if you run into servers that are incorrectly marked as not vulnerable.
description = [[
Attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote code
execution vulnerability (ms2017-010).
The script connects to the $IPC tree, executes a transaction on FID 0 and
checks if the error "STATUS_INSUFF_SERVER_RESOURCES" is returned to
determine if the target is not patched against CVE2017-010.
Tested on a vulnerable Windows 7. We might have some issues with v2 protocols with
Paulino Calderon Pale || @calderpwn on Twitter || http://www.calderonpale.com
It seems the initial wave has been stopped by Researchers, and then we had another one as detailed in the link below.
More good information and I suggest reading through it all if you have not done so already. This is a bad weekend for business and infrastructure that is using older systems, but its been a good weekend for the infosec community in coming together and helping and sharing alot of good information with each other.
There is a tool you can run on a host that will stop the ransomware from encrypting your machine, however it will still attempt to spread over your network.
wcrypt activity map
In what has been big news over the past 24 hours. Especially here in the UK is that the NHS has been hit with a large ransomware attack.
This is a pretty good write up of what was known at the time.
There have been easy fixes for this available for the past 2 months and it was just a matter of time until the tools that were developed by our American Friends, that they would be used against the general public.
Hopefully this is lessons learned for many organisations, and they realise that patching and running fairly up to date operating systems is important and not just something to achieve compliance.
Few more articles that contain good information about these events.
Also of note.
If you use intitle:”index of” “@WanaDecryptor@.exe” as a search on google, at the time of this update there are 67 results.
Not a good weekend for the world of IT admins.
The github link referenced below is being kept up today and contains some very good and useful information.