--- title: How to Detect MS17-010 Vulnerability in Your Systems description: Uncover the critical steps to identify and mitigate the infamous MS17-010 vulnerability that enabled global cyberattacks like WannaCry. --- [Skip to content](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#main-content) ![thinking_sideways_final](https://thinking.net.nz/hs-fs/hubfs/thinking_sideways_final.png?width=4977&height=1883&name=thinking_sideways_final.png) - [Products](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#products) - [Services](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#services) - [Blog](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#blog) - [About](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#about) Open main navigation Close main navigation - [Products](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#products) - [Services](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#services) - [Blog](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#blog) - [About](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#about) - [Contact us](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#contact) [Contact us](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#contact) Sep 3, 2024 1:25:16 PM # How to Detect MS17-010 Vulnerability in Your Systems ![Picture of JK](https://app.hubspot.com/settings/avatar/d07d287c41a806c015d4f2548c90ba4f) [JK](https://thinking.net.nz/blog/author/jk) Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems) [Twitter icon](https://twitter.com/intent/tweet?url=https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems) [envelope icon](mailto:?body=https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems) Uncover the critical steps to identify and mitigate the infamous MS17-010 vulnerability that enabled global cyberattacks like WannaCry. ## A quick write up to show how to detect the MS17-010 vulnerability using NMAP and to format a report into html readable format The MS17-010 vulnerability, also known as EternalBlue, has been exploited by some of the most notorious malware, including WannaCry, Petya, and NotPetya. To protect your systems, it is crucial to detect this vulnerability early. One of the most efficient ways to do this is by using NMAP, a powerful network scanning tool. Begin by downloading and installing NMAP from the official website. Once installed, you can use specific NMAP scripts designed to detect the MS17-010 vulnerability. The command you will use is: \`nmap -p445 --script smb-vuln-ms17-010 \`. Replace \`\` with the IP address of the target system you want to scan. After running the scan, NMAP will provide a report indicating whether the target system is vulnerable to MS17-010. To make this report more accessible and readable, you can format it into HTML. NMAP supports generating output in various formats, including XML, which can then be transformed into HTML using tools like xsltproc. Use the command: \`nmap -p445 --script smb-vuln-ms17-010 -oX report.xml \`, followed by \`xsltproc report.xml -o report.html\`.   Detailed Steps Install the NMAP script smb-vuln-ms17-010.nse on KALI cd /usr/share/nmap/scripts wget [https://svn.nmap.org/nmap/scripts/smb-vuln-ms17-010.nse](https://svn.nmap.org/nmap/scripts/smb-vuln-ms17-010.nse) Create a shell script to utilise this NMAP script Use NANO/VIM/VI or whatever your favourite editor is to create this.. **nmap -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse “your ip or subnet to scan” -oX “output xml file”.xml** **xsltproc “output xml file”.xml –o”output html file”.html** Once created make the script executable chmod +x “name of script”.sh Run the script ./”name of script”.sh Obviously, omit the double quotes and replace with the parameters you require. Xsltproc will reformat the xml output from NMAP into a nice to read html file. The script will throw up a nice big vulnerability message associated with the host IP address if it finds smbv1 EternalBlue vulnerabilities.       # Double Pulsar You can also scan for Double Pulsar by downloading the following NMAP script and applying the same process as per above. [https://svn.nmap.org/nmap/scripts/smb-double-pulsar-backdoor.nse](https://svn.nmap.org/nmap/scripts/smb-double-pulsar-backdoor.nse) Install the NMAP script smb-double-pulsar.nse on KALI cd /usr/share/nmap/scripts wget [https://svn.nmap.org/nmap/scripts/smb-double-pulsar-backdoor.nse](https://svn.nmap.org/nmap/scripts/smb-double-pulsar-backdoor.nse) The script will throw up a nice big vulnerability message associated with the host IP address if it finds smbv1 DoublePulsar vulnerabilities. ## Related posts ## [Checking the NTP status on RSA Authentication Manager](https://thinking.net.nz/blog/checking-the-ntp-status-on-rsa-authentication-manager) ![Picture of JK](https://app.hubspot.com/settings/avatar/d07d287c41a806c015d4f2548c90ba4f) [JK](https://thinking.net.nz/blog/author/jk) Sep 3, 2024 1:33:50 PM Discover the critical role of Network Time Protocol (NTP) in securing your RSA Authentication... [Read more](https://thinking.net.nz/blog/checking-the-ntp-status-on-rsa-authentication-manager) ## [Managing Digital Certs and CSR in RSA Authentication Manager](https://thinking.net.nz/blog/managing-digital-certs-and-csr-in-rsa-authentication-manager) ![Picture of JK](https://app.hubspot.com/settings/avatar/d07d287c41a806c015d4f2548c90ba4f) [JK](https://thinking.net.nz/blog/author/jk) Sep 3, 2024 1:31:10 PM How to clean up CSR's You have created one or more CSR (certificate signing requests), not all can... [Read more](https://thinking.net.nz/blog/managing-digital-certs-and-csr-in-rsa-authentication-manager) [RSA](https://thinking.net.nz/blog/tag/rsa) ## [Linux 2FA using PAM and RSA](https://thinking.net.nz/blog/linux-2fa-using-pam-and-rsa) ![Picture of JK](https://app.hubspot.com/settings/avatar/d07d287c41a806c015d4f2548c90ba4f) [JK](https://thinking.net.nz/blog/author/jk) Sep 2, 2024 1:33:57 PM When you look down the list of supported Linux distributions officially supported by RSA there are... [Read more](https://thinking.net.nz/blog/linux-2fa-using-pam-and-rsa) [Follow us on Linkedin](https://www.linkedin.com/company/thinking2014limited) [Thinking Service Portal](https://thinking.myportallogin.com.au/) [Download our Terms of Business](https://thinking.net.nz/terms-of-business) - [Products](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#products) - [Services](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#services) - [Blog](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#blog) - [About](https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems#about) --- [![thinking_sideways_final](https://thinking.net.nz/hs-fs/hubfs/thinking_sideways_final.png?width=4977&height=1883&name=thinking_sideways_final.png "thinking_sideways_final")](https://www.thinking.net.nz) Postal: PO Box 26, Waimauku, Auckland 0842, New Zealand Email:enquires@thinking.net.nz Copyright © 2024 Thinking (2014) Limited ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "JK", "url" : "https://thinking.net.nz/blog/author/jk" }, "dateModified" : "2024-09-03T01:25:49.224Z", "datePublished" : "2024-09-03T01:25:16.000Z", "headline" : "How to Detect MS17-010 Vulnerability in Your Systems", "mainEntityOfPage" : { "@id" : "https://thinking.net.nz/blog/how-to-detect-ms17-010-vulnerability-in-your-systems", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Thinking (2014) Limited" } } ```