Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya) - Nessus

High   Plugin ID: 99304

---

This page contains detailed information about the Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 99304
Name: Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya)
Filename: smb_nt_ms17_apr_4015549.nasl
Vulnerability Published: 2013-11-12
This Plugin Published: 2017-04-12
Last Modification Time: 2021-11-30
Plugin Version: 1.20
Plugin Type: local
Plugin Family: Windows : Microsoft Bulletins
Dependencies: ms_bulletin_checks_possible.nasl, smb_check_rollup.nasl, smb_hotfixes.nasl
Required KB Items [?]: SMB/MS_Bulletin_Checks/Possible

Vulnerability Information

---

Severity: High
Vulnerability Published: 2013-11-12
Patch Published: 2017-04-11
CVE [?]: CVE-2013-6629, CVE-2017-0058, CVE-2017-0155, CVE-2017-0156, CVE-2017-0158, CVE-2017-0163, CVE-2017-0166, CVE-2017-0168, CVE-2017-0180, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0191, CVE-2017-0192, CVE-2017-0199, CVE-2017-0202, CVE-2017-0210
CPE [?]: cpe:/o:microsoft:windows
Exploited by Malware: True
In the News: True

Synopsis

The remote Windows host is affected by multiple vulnerabilities.

Description

The remote Windows host is missing security update 4015546 or cumulative update 4015549. It is, therefore, affected by multiple vulnerabilities :

- An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this to disclose sensitive information that can be utilized to bypass ASLR security protections. (CVE-2013-6629)

- An information disclosure vulnerability exists in the win32k component due to improper handling of kernel information. A local attacker can exploit this, via a specially crafted application, to disclose sensitive information. (CVE-2017-0058)

- Multiple privilege escalation vulnerabilities exist in the Microsoft Graphics Component due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated privileges. (CVE-2017-0155, CVE-2017-0156)

- A flaw exists in the VBScript engine due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website or open a specially crafted document file, to execute arbitrary code. (CVE-2017-0158)

- Multiple flaws exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker can exploit these, via a specially crafted application on the guest, to execute arbitrary code on the host system. (CVE-2017-0163, CVE-2017-0180)

- A flaw exists in LDAP due to buffer request lengths not being properly calculated. An unauthenticated, remote attacker can exploit this, via specially crafted traffic sent to a Domain Controller, to run processes with elevated privileges. (CVE-2017-0166)

- An information disclosure vulnerability exists in Windows Hyper-V Network Switch due to improper validation of user-supplied input. A guest attacker can exploit this to disclose sensitive information on the host server. (CVE-2017-0168)

- Multiple denial of service vulnerabilities exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker on the guest can exploit these vulnerabilities, via a specially crafted application, to crash the host system. (CVE-2017-0182, CVE-2017-0183)

- A denial of service vulnerability exists in Hyper-V due to improper validation of input from a privileged user on a guest operating system. A local attacker on the guest can exploit this, via a specially crafted application, to cause the host system to crash. (CVE-2017-0184)

- A flaw exists in Windows due to improper handling of objects in memory that allows an attacker to cause a denial of service condition. (CVE-2017-0191)

- An information disclosure vulnerability exists in the Adobe Type Manager Font Driver (ATMFD.dll) due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted document or visit a malicious web page, to disclose sensitive information. (CVE-2017-0192)

- An arbitrary code execution vulnerability exists in Microsoft Office and Windows WordPad due to improper handling of specially crafted files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a malicious file, to execute arbitrary code in the context of the current user. Note that this vulnerability is being utilized to spread the Petya ransomware. (CVE-2017-0199)

- A memory corruption issue exists in Internet Explorer due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website, to execute arbitrary code. (CVE-2017-0202)

- A privilege escalation vulnerability exists in Internet Explorer due to a failure to properly enforce cross-domain policies. An unauthenticated, remote attacker can exploit this to inject arbitrary content and gain elevated privileges. (CVE-2017-0210)

Solution

Apply Security Only update KB4015546 or Cumulative update KB4015549.

Public Exploits

---

Target Network Port(s): 139, 445
Target Asset(s): Host/patch_management_checks
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub, Core Impact)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya) vulnerability:

1. Metasploit: exploit/windows/fileformat/office_word_hta
   [Microsoft Office Word Malicious Hta Execution]
2. Exploit-DB: exploits/windows/local/44263.md
   [EDB-44263: Microsoft Office - 'Composite Moniker Remote Code Execution]
3. Exploit-DB: exploits/windows/remote/41894.py
   [EDB-41894: Microsoft Word - '.RTF' Remote Code Execution]
4. Exploit-DB: exploits/windows/remote/41934.rb
   [EDB-41934: Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)]
5. GitHub: https://github.com/0xsyr0/OSCP
   [CVE-2017-0199]
6. GitHub: https://github.com/AnonVulc/Pentest-Tools
   [CVE-2017-0199]
7. GitHub: https://github.com/Apri1y/Red-Team-links
   [CVE-2017-0199]
8. GitHub: https://github.com/BRAINIAC22/CVE-2017-0199
   [CVE-2017-0199: A python script/generator, for generating and exploiting Microsoft vulnerability]
9. GitHub: https://github.com/DrVilepis/cyber-apocalypse-drvilepis
   [CVE-2017-0199]
10. GitHub: https://github.com/Echocipher/Resource-list
    [CVE-2017-0199]
11. GitHub: https://github.com/FlatL1neAPT/MS-Office
    [CVE-2017-0199]
12. GitHub: https://github.com/Loveforkeeps/Lemon-Duck
    [CVE-2017-0199]
13. GitHub: https://github.com/Nacromencer/cve2017-0199-in-python
    [CVE-2017-0199]
14. GitHub: https://github.com/PWN-Kingdom/Test_Tasks
    [CVE-2017-0199]
15. GitHub: https://github.com/Panopticon-Project/Panopticon-Patchwork
    [CVE-2017-0199]
16. GitHub: https://github.com/Phantomlancer123/CVE-2017-0199
    [CVE-2017-0199]
17. GitHub: https://github.com/S3cur3Th1sSh1t/Pentest-Tools
    [CVE-2017-0199]
18. GitHub: https://github.com/SyFi/cve-2017-0199
    [CVE-2017-0199]
19. GitHub: https://github.com/Winter3un/cve_2017_0199
    [CVE-2017-0199]
20. GitHub: https://github.com/bloomer1016/2017-11-17-Maldoc-Using-CVE-2017-0199
    [CVE-2017-0199]
21. GitHub: https://github.com/czq945659538/-study
    [CVE-2017-0199]
22. GitHub: https://github.com/decalage2/oletools
    [CVE-2017-0199]
23. GitHub: https://github.com/fideliscyber/yalda
    [CVE-2017-0199]
24. GitHub: https://github.com/gold1029/Red-Teaming-Toolkit
    [CVE-2017-0199]
25. GitHub: https://github.com/herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199
    [CVE-2017-0199]
26. GitHub: https://github.com/highmeh/cvesearch
    [CVE-2017-0199]
27. GitHub: https://github.com/houjingyi233/office-exploit-case-study
    [CVE-2017-0199]
28. GitHub: https://github.com/hudunkey/Red-Team-links
    [CVE-2017-0199]
29. GitHub: https://github.com/john-80/-007
    [CVE-2017-0199]
30. GitHub: https://github.com/joke998/Cve-2017-0199
    [CVE-2017-0199]
31. GitHub: https://github.com/joke998/Cve-2017-0199-
    [CVE-2017-0199: Cve-2017-0199]
32. GitHub: https://github.com/kbandla/APTnotes
    [CVE-2017-0199]
33. GitHub: https://github.com/likescam/CVE-2017-0199
    [CVE-2017-0199]
34. GitHub: https://github.com/likescam/Red-Teaming-Toolkit
    [CVE-2017-0199]
35. GitHub: https://github.com/likescam/Red-Teaming-Toolkit_all_pentests
    [CVE-2017-0199]
36. GitHub: https://github.com/lp008/Hack-readme
    [CVE-2017-0199]
37. GitHub: https://github.com/mucahittopal/Pentesting-Pratic-Notes
    [CVE-2017-0199]
38. GitHub: https://github.com/nccgroup/CVE-2017-8759
    [CVE-2017-0199]
39. GitHub: https://github.com/ngadminq/Bei-Gai-penetration-test-guide
    [CVE-2017-0199]
40. GitHub: https://github.com/nitishbadole/pentesting_Notes
    [CVE-2017-0199]
41. GitHub: https://github.com/nixawk/labs
    [CVE-2017-0199]
42. GitHub: https://github.com/oneplus-x/MS17-010
    [CVE-2017-0199]
43. GitHub: https://github.com/papa-anniekey/CustomSignatures
    [CVE-2017-0199]
44. GitHub: https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-0199.md
    [CVE-2017-0199]
45. GitHub: https://github.com/qiantu88/office-cve
    [CVE-2017-0199]
46. GitHub: https://github.com/r0eXpeR/supplier
    [CVE-2017-0199]
47. GitHub: https://github.com/r3p3r/yeyintminthuhtut-Awesome-Red-Teaming
    [CVE-2017-0199]
48. GitHub: https://github.com/rosetscmite/logsender
    [CVE-2017-0199]
49. GitHub: https://github.com/ryhanson/CVE-2017-0199
    [CVE-2017-0199]
50. GitHub: https://github.com/sUbc0ol/Microsoft-Word-CVE-2017-0199-
    [CVE-2017-0199]
51. GitHub: https://github.com/seclib/oletools
    [CVE-2017-0199]
52. GitHub: https://github.com/severnake/Pentest-Tools
    [CVE-2017-0199]
53. GitHub: https://github.com/shr3ddersec/Shr3dKit
    [CVE-2017-0199]
54. GitHub: https://github.com/slimdaddy/RedTeam
    [CVE-2017-0199]
55. GitHub: https://github.com/stealth-ronin/CVE-2017-0199-PY-KIT
    [CVE-2017-0199]
56. GitHub: https://github.com/theyoge/AD-Pentesting-Tools
    [CVE-2017-0199]
57. GitHub: https://github.com/viethdgit/CVE-2017-0199
    [CVE-2017-0199]
58. GitHub: https://github.com/vysecurity/RedTips
    [CVE-2017-0199]
59. GitHub: https://github.com/xiaoZ-hc/redtool
    [CVE-2017-0199]
60. GitHub: https://github.com/xiaoy-sec/Pentest_Note
    [CVE-2017-0199]
61. GitHub: https://github.com/zakybstrd21215/PoC-CVE-2017-0199
    [CVE-2017-0199: Exploit toolkit for vulnerability RCE Microsoft RTF]
62. GitHub: https://github.com/zhang040723/web
    [CVE-2017-0199]
63. GitHub: https://github.com/googleprojectzero/domato
    [CVE-2017-0202]
64. GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/41894.zip
    [EDB-41894]
65. GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/44263.zip
    [EDB-44263]
66. GitHub: https://github.com/bhdresh/CVE-2017-0199
    [CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides ...]
67. GitHub: https://github.com/Exploit-install/CVE-2017-0199
    [CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick ...]
68. GitHub: https://github.com/haibara3839/CVE-2017-0199-master
    [CVE-2017-0199]
69. GitHub: https://github.com/jacobsoo/RTF-Cleaner
    [CVE-2017-0199: RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & ...]
70. GitHub: https://github.com/kn0wm4d/htattack
    [CVE-2017-0199: An exploit implementation for RCE in RTF & DOCs (CVE-2017-0199)]
71. GitHub: https://github.com/mzakyz666/PoC-CVE-2017-0199
    [CVE-2017-0199: Exploit toolkit for vulnerability RCE Microsoft RTF]
72. GitHub: https://github.com/n1shant-sinha/CVE-2017-0199
    [CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick ...]
73. GitHub: https://github.com/nicpenning/RTF-Cleaner
    [CVE-2017-0199: RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically.]
74. GitHub: https://github.com/NotAwful/CVE-2017-0199-Fix
    [CVE-2017-0199: Quick and dirty fix to OLE2 executing code via .hta]
75. GitHub: https://github.com/SwordSheath/CVE-2017-8570
    [CVE-2017-0199: CVE-2017-8570生成脚本(CVE-2017-0199另一种利用方式)]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS Score Source [?]: CVE-2017-0199
CVSS V2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C

CVSS Base Score:	9.3 (High)
Impact Subscore:	10.0
Exploitability Subscore:	8.6
CVSS Temporal Score:	8.1 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	8.1 (High)

CVSS V3 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

CVSS Base Score:	7.8 (High)
Impact Subscore:	5.9
Exploitability Subscore:	1.8
CVSS Temporal Score:	7.5 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	7.5 (High)

STIG Severity [?]: I
STIG Risk Rating: High

Go back to menu.

Plugin Source

---

This is the smb_nt_ms17_apr_4015549.nasl nessus plugin source code. This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(99304);
  script_version("1.20");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/11/30");

  script_cve_id(
    "CVE-2013-6629",
    "CVE-2017-0058",
    "CVE-2017-0155",
    "CVE-2017-0156",
    "CVE-2017-0158",
    "CVE-2017-0163",
    "CVE-2017-0166",
    "CVE-2017-0168",
    "CVE-2017-0180",
    "CVE-2017-0182",
    "CVE-2017-0183",
    "CVE-2017-0184",
    "CVE-2017-0191",
    "CVE-2017-0192",
    "CVE-2017-0199",
    "CVE-2017-0202",
    "CVE-2017-0210"
  );
  script_bugtraq_id(
    63676,
    97418,
    97427,
    97428,
    97435,
    97441,
    97444,
    97446,
    97452,
    97455,
    97462,
    97465,
    97466,
    97471,
    97498,
    97507,
    97512
  );
  script_xref(name:"CERT", value:"921560");
  script_xref(name:"EDB-ID", value:"41894");
  script_xref(name:"EDB-ID", value:"41934");
  script_xref(name:"MSKB", value:"4015546");
  script_xref(name:"MSFT", value:"MS17-4015546");
  script_xref(name:"IAVA", value:"2017-A-0110");
  script_xref(name:"MSKB", value:"4015549");
  script_xref(name:"MSFT", value:"MS17-4015549");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");

  script_name(english:"Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya)");
  script_summary(english:"Checks for rollup.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing security update 4015546
or cumulative update 4015549. It is, therefore, affected by
multiple vulnerabilities :

  - An information disclosure vulnerability exists in the
    open-source libjpeg image processing library due to
    improper handling of objects in memory. An
    unauthenticated, remote attacker can exploit this to
    disclose sensitive information that can be utilized to
    bypass ASLR security protections. (CVE-2013-6629)

  - An information disclosure vulnerability exists in the
    win32k component due to improper handling of kernel
    information. A local attacker can exploit this, via a
    specially crafted application, to disclose sensitive
    information. (CVE-2017-0058)

  - Multiple privilege escalation vulnerabilities exist in
    the Microsoft Graphics Component due to improper
    handling of objects in memory. A local attacker can
    exploit this, via a specially crafted application, to
    execute arbitrary code with elevated privileges.
    (CVE-2017-0155, CVE-2017-0156)

  - A flaw exists in the VBScript engine due to improper
    handling of objects in memory. An unauthenticated,
    remote attacker can exploit this, by convincing a user
    to visit a malicious website or open a specially crafted
    document file, to execute arbitrary code.
    (CVE-2017-0158)

  - Multiple flaws exist in Windows Hyper-V Network Switch
    due to improper validation of input from the guest
    operating system. A local attacker can exploit these,
    via a specially crafted application on the guest, to
    execute arbitrary code on the host system.
    (CVE-2017-0163, CVE-2017-0180)

  - A flaw exists in LDAP due to buffer request lengths not
    being properly calculated. An unauthenticated, remote
    attacker can exploit this, via specially crafted traffic
    sent to a Domain Controller, to run processes with
    elevated privileges. (CVE-2017-0166)

  - An information disclosure vulnerability exists in
    Windows Hyper-V Network Switch due to improper validation
    of user-supplied input. A guest attacker can exploit
    this to disclose sensitive information on the host
    server. (CVE-2017-0168)

  - Multiple denial of service vulnerabilities exist in
    Windows Hyper-V Network Switch due to improper
    validation of input from the guest operating system. A
    local attacker on the guest can exploit these
    vulnerabilities, via a specially crafted application, to
    crash the host system. (CVE-2017-0182, CVE-2017-0183)

  - A denial of service vulnerability exists in Hyper-V due
    to improper validation of input from a privileged user
    on a guest operating system. A local attacker on the
    guest can exploit this, via a specially crafted
    application, to cause the host system to crash.
    (CVE-2017-0184)

  - A flaw exists in Windows due to improper handling of
    objects in memory that allows an attacker to cause a
    denial of service condition. (CVE-2017-0191)

  - An information disclosure vulnerability exists in the
    Adobe Type Manager Font Driver (ATMFD.dll) due to
    improper handling of objects in memory. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to open a specially crafted document
    or visit a malicious web page, to disclose sensitive
    information. (CVE-2017-0192)

  - An arbitrary code execution vulnerability exists in
    Microsoft Office and Windows WordPad due to improper
    handling of specially crafted files. An unauthenticated,
    remote attacker can exploit this, by convincing a user
    to open a malicious file, to execute arbitrary code in
    the context of the current user. Note that this
    vulnerability is being utilized to spread the Petya
    ransomware. (CVE-2017-0199)

  - A memory corruption issue exists in Internet Explorer
    due to improper validation of user-supplied input. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to visit a malicious website, to
    execute arbitrary code. (CVE-2017-0202)

  - A privilege escalation vulnerability exists in Internet
    Explorer due to a failure to properly enforce
    cross-domain policies. An unauthenticated, remote
    attacker can exploit this to inject arbitrary content
    and gain elevated privileges. (CVE-2017-0210)");
  # https://support.microsoft.com/en-us/help/4015549/windows-7-windows-server-2008-r2-sp1-update-kb4015549
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e9bccd2b");
  # https://www.tenable.com/blog/petyanotpetya-ransomware-detection-for-the-modern-enterprise
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59db5b5b");
  script_set_attribute(attribute:"solution", value:
"Apply Security Only update KB4015546 or Cumulative update KB4015549.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-0199");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Microsoft Office Word Malicious Hta Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"in_the_news", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/11/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/04/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS17-04';
kbs = make_list("4015549", "4015546");

if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

# KB only applies to Window 7 / 2008 R2, SP1
if (hotfix_check_sp_range(win7:'1') <= 0) 
  audit(AUDIT_OS_SP_NOT_VULN);

share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Windows 7 / 2008 R2
  smb_check_rollup(os:"6.1", sp:1, rollup_date:"04_2017", bulletin:bulletin, rollup_kb_list:make_list(4015549, 4015546)) 
)
{
  replace_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/smb_nt_ms17_apr_4015549.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\smb_nt_ms17_apr_4015549.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/smb_nt_ms17_apr_4015549.nasl

Go back to menu.

How to Run

---

Here is how to run the Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Windows : Microsoft Bulletins plugin family.
6. On the right side table select Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya) plugin ID 99304.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl smb_nt_ms17_apr_4015549.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a smb_nt_ms17_apr_4015549.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - smb_nt_ms17_apr_4015549.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state smb_nt_ms17_apr_4015549.nasl -t <IP/HOST>

Go back to menu.

References

---

BID | SecurityFocus Bugtraq ID:

• 63676, 97418, 97427, 97428, 97435, 97441, 97444, 97446, 97452, 97455, 97462, 97465, 97466, 97471, 97498, 97507, 97512

MSKB | Microsoft Knowledge Base:

• 4015546, 4015549

MSFT | Microsoft Security Bulletin:

• MS17-4015546, MS17-4015549

IAVA | Information Assurance Vulnerability Alert:

• 2017-A-0110

CERT | Computer Emergency Response Team:

• 921560

See also:

• https://www.tenable.com/plugins/nessus/99304
• http://www.nessus.org/u?59db5b5b
• http://www.nessus.org/u?e9bccd2b
• https://vulners.com/nessus/SMB_NT_MS17_APR_4015549.NASL

Similar and related Nessus plugins:

• 72907 - Apple iOS < 7.1 Multiple Vulnerabilities
• 72962 - Apple TV < 6.1 Multiple Vulnerabilities
• 70986 - Debian DSA-2799-1 : chromium-browser - several vulnerabilities
• 77810 - IBM Domino 9.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities (uncredentialed check)
• 76303 - GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)
• 77811 - IBM Domino 9.0.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities (credentialed check) (POODLE)
• 77812 - IBM Notes 9.0.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities
• 72687 - Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities
• 72688 - Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)
• 75212 - openSUSE Security Update : chromium (openSUSE-SU-2013:1776-1)
• 75213 - openSUSE Security Update : chromium (openSUSE-SU-2013:1777-1)
• 75225 - openSUSE Security Update : chromium (openSUSE-SU-2013:1861-1)
• 75366 - openSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)
• 79011 - RHEL 5 / 6 : java-1.6.0-sun (RHSA-2014:0414)
• 104044 - KB4014793: Microsoft Wordpad Remote Code Execution vulnerability (April 2017)
• 99282 - KB4015219: Windows 10 Version 1511 April 2017 Cumulative Update
• 99312 - Windows 8.1 and Windows Server 2012 R2 April 2017 Security Updates
• 99285 - Windows Server 2012 April 2017 Security Updates (Petya)
• 99288 - KB4015583: Windows 10 Version 1703 April 2017 Cumulative Update
• 104889 - Security Updates for Internet Explorer (April 2017)
• 99314 - Security Update for Microsoft Office Products (April 2017) (Petya)
• 77728 - VMware Security Updates for vCenter Server (VMSA-2014-0008)
• 77630 - VMSA-2014-0008 : VMware vSphere product updates to third-party libraries
• 97833 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)
• 97737 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file smb_nt_ms17_apr_4015549.nasl version 1.20. For more plugins, visit the Nessus Plugin Library.

Go back to menu.