MS17-010 SMB RCE Detection

Description

                                Uses information disclosure to determine if MS17-010 has been patched or not.        Specifically, it connects to the IPC$ tree and attempts a transaction on FID 0.        If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does        not have the MS17-010 patch.        If the machine is missing the MS17-010 patch, the module will check for an        existing DoublePulsar (ring 0 shellcode/malware) infection.        This module does not require valid SMB credentials in default server        configurations. It can log on as the user "\" and connect to IPC$.
                            Author(s)
Sean Dillon <[email protected]>
Luke Jennings
NoneNone