Dan Kaminsky's Blog

Couple useful things for IT admins out there.  I’ve packaged up Werner and Feder’s PoC scanner via py2exe here.  You can now simply run:

C:\Python26\scs\scs>scanner.exe 1.2.3.4

———————————-
Simple Conficker Scanner
———————————-
scans selected network ranges for
conficker infections
———————————-
Felix Leder, Tillmann Werner 2009
{leder, werner}@cs.uni-bonn.de
———————————-

[WARNING] 1.2.3.4 seems to be infected by Conficker!

C:\Python26\scs\scs>scs.exe 1.2.3.4 1.2.3.4

———————————-
Simple Conficker Scanner
———————————-
scans selected network ranges for
conficker infections
———————————-
Felix Leder, Tillmann Werner 2009
{leder, werner}@cs.uni-bonn.de
———————————-

[WARNING] 1.2.3.4 seems to be infected by Conficker!
Done

Note that scs.exe will also take an IP list, so if you can generate that in a fast sweeper, scs.exe will go much faster.

Of course, what would be really helpful is getting nmap going — and the code is in fact in SVN!  I believe the nmap guys are working on packages right now, but in the meantime, here’s what their dev says to do if you’re on Unix:

If you prefer to install it:
svn co –username=guest –password=” svn://svn.insecure.org/nmap
cd nmap
./configure && make
sudo make install
nmap -PN -d -p445 –script=smb-check-vulns –script-args=safe=1 <host>

If you don’t want to install it:
svn co –username=guest –password=” svn://svn.insecure.org/nmap
cd nmap
./configure && make
export NMAPDIR=.
./nmap -PN -d -p445 –script=smb-check-vulns –script-args=safe=1 <host>

Building nmap is a little tricky on Windows apparently, but happily enough, this isn’t necessary.  Follow these steps to get high speed scanning on Windows:

1) Install the latest development build, of nmap, 4.85Beta4, from here.
2) Retrieve this package, extracted from SVN, and merge it into your c:\Program Files\nmap directory.
3) Enjoy:

C:\Documents and Settings\dan>nmap -PN -d -p 445 –script=smb-check-vulns –script-args=safe=1 1.2.3.4

Winpcap present, dynamic linked to: WinPcap version 4.0.2 (packet.dll version 4.
0.0.1040), based on libpcap version 0.9.5

Starting Nmap 4.85BETA4 ( http://nmap.org ) at 2009-03-30 08:42 Pacific Daylight
Time
————— Timing report —————
hostgroups: min 1, max 100000
rtt-timeouts: init 1000, min 100, max 10000
max-scan-delay: TCP 1000, UDP 1000
parallelism: min 0, max 0
max-retries: 10, host-timeout: 0
min-rate: 0, max-rate: 0
———————————————
mass_rdns: Using DNS server 4.2.2.1
Initiating Parallel DNS resolution of 1 host. at 08:42
mass_rdns: 0.38s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 08:42, 0.36s elapsed
DNS resolution of 1 IPs took 0.38s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF:
0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:42
Scanning 21Cust103.tnt1.kingston.on.da.uu.net (1.2.3.4) [1 port]
Packet capture filter (device eth0): dst host 192.168.1.103 and (icmp or ((tcp o
r udp) and (src host 1.2.3.4)))
Discovered open port 445/tcp on 1.2.3.4 Completed SYN Stealth Scan at 08:42, 0.75s elapsed (1 total ports)
Overall sending rates: 1.33 packets / s, 58.67 bytes / s.
NSE: Initiating script scanning.
NSE: Script scanning foo (1.2.3.4).
NSE: Initialized 1 rules
NSE: Matching rules.
NSE: Running scripts.
NSE: Runlevel: 2.000000
Initiating NSE at 08:42
Running 1 script threads:
NSE (1.438s): Starting smb-check-vulns against 1.2.3.4.
NSE: SMB: Extended login as \guest failed, but was given guest access (username
may be wrong, or system may only allow guest)
NSE (6.001s): Finished smb-check-vulns against 1.2.3.4.
Completed NSE at 08:42, 4.58s elapsed
NSE: Script scanning completed.
Host foo (1.2.3.4) appears to be up … goo
d.
Scanned at 2009-03-30 08:42:46 Pacific Daylight Time for 6s
Interesting ports on foo (1.2.3.4):
PORT    STATE SERVICE      REASON
445/tcp open  microsoft-ds syn-ack

Host script results:
|  smb-check-vulns:
|  MS08-067: NOT RUN
|  Connficker: Likely INFECTED
|_ regsvc DoS: NOT RUN (add –script-args=unsafe=1 to run)
Final times for host: srtt: 360000 rttvar: 360000  to: 1800000

Read from C:\Program Files\Nmap: nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 6.00 seconds
Raw packets sent: 1 (44B) | Rcvd: 1 (44B)

I’m sure there’s some way to use the NMAP GUI too — if someone wants to post a doc for that, I’ll link to it.