Eternal Blues -- EternalBlue Network Vulnerability Scanner

"Eternal Blues is a free EternalBlue vulnerability scanner. It helps finding the blind spots in your network, these endpoints that are still vulnerable to EternalBlue..."

http://omerez.com/eternalblues/

 

I run that thing to death today. All No's

 

Ran the scanner on XP Pro SP3 after the MS patch installed and rebooted and it still says it is vulnerable.

 

No dreaded lurgy here

 

The developer reports that the thing is giving false positives. Look at the bottom of the utility webpage.

Does it even support XP ?

 

Ran check on Windows 10... no vulnerabilities found!

 

Here on Win8.1, zero vuln.

 

xp sp3 here patch not applied, shows port 203 vulnerable.

edit: shows 203 something vulnerable, not sure if that means a port.
Several other scanners show all ports closed.

 

It doesn't support XP but with your latest patch, your SMB vulnerability should be addressed.

Home users shouldn't worry about it since they never run SMB.

Corporate and institutional users are more susceptible.

 

There is some old hardware like printers and wifi speakers that use SMBv1. However, if the system is behind a NAT router, SMBv1 enabled does not present a high risk. It's the client-server configuration that is the real killer - and as you state, very few home user systems are configured as such.

This whole SMB thing is blown way out of proportion by those that lack understanding.

 

+1

+2

 

+1

 

For those asking themselvers "How do I know I'm actually behind a NAT router"?
http://ask-leo.com/how_do_i_know_if_im_behind_a_nat_router.html

 

I have a Zyxel modem/router so I'm behind a NAT router. If you have a secured network, SMBv1 enabled isn't a high risk.

A broadband modem also doubles as a router and typically displays a connection as 192.168.0.1 - as mine does. That means one is behind a hardware firewall and what is displayed is the local protocol that connects to the Internet - NAT means Network Address Translation.

 

Eset has a scanner to verify if EternalBlue patch has been installed:
https://help.eset.com/eset_tools/ESETEternalBlueChecker.exe

 

Thanks.

I got srv2.sys instead of srv.sys which this utility is looking for. This legend is what I get when executing ESETEternalBlueChecker.exe:

Code:

ESET CVE-2017-0144 vulnerability checker
Copyright 1992-2017 ESET spol. s r.o.

Checking your system for CVE-2017-0144 vulnerability.
Failed to get version of 'C:\Windows\system32\Drivers\srv.sys'.
We are unable to tell if your computer is vulnerable.

Press any key to close this application ...

 

Did you uninstall/disable SMBv1 from your system? Appears that is the case.

 

TH.
Works perfectly with XP

 

Same as you on my home insider build. will try later on my Enterprise VM build later

 

Yes I did.

Wonder what the tool's output is when SMBv1 is installed though. On a patched and non-patched system.

 

See reply #18.

 

Thanks, I missed that one.

 

Here is another Eternal Blue vulnerability scanner by Eset.
https://www.eset.com/us/about/newsr...y-checker-to-help-combat-wannacry-ransomware/

http://support.eset.com/kb6481/?viewlocale=en_US

 

It seems to me the same tool posted by @itman above. Post #15.
However, it's a good thing to have another post with links pointing to. Thanks @Cutting_Edgetech

 

Sorry, it is. I missed that post.