Scan Report

April 19, 2022

Summary
This document reports on the results of an automatic security scan. All dates are dis-
played using the timezone Coordinated Universal Time, which is abbreviated UTC. The
task was Khadijah Watkins. The scan started at Tue Apr 19 02:06:36 2022 UTC and ended
at Tue Apr 19 02:11:19 2022 UTC. The report rst summarises the results found. Then, for
each host, the report describes every issue found. Please consider the advice given in each
description, in order to rectify the issue.

Contents

1 Result Overview 2
2 Results per Host 2
2.1 10.10.1.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2.1.1 High 445/tcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2.1.2 High general/tcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2.2 10.10.1.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2.2.1 High 445/tcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2.2.2 High general/tcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.2.3 Medium 135/tcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

2.2.4 Low general/tcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1
2 RESULTS PER HOST 2

1 Result Overview

Host High Medium Low Log False Positive

10.10.1.2 2 0 0 0 0
10.10.1.3 3 1 1 0 0
Total: 2 5 1 1 0 0

Vendor security updates are not trusted.

Overrides are o. Even when a result has an override, this report uses the actual threat of the
result.
Information on overrides is included in the report.
Notes are included in the report.
This report might not show details of all issues that were found.
Issues with the threat level Log are not shown.
Issues with the threat level Debug are not shown.
Issues with the threat level False Positive are not shown.
Only results with a minimum QoD of 70 are shown.

This report contains all 7 results selected by the ltering described above. Before ltering there
were 43 results.

2 Results per Host

2.1 10.10.1.2

Host scan start Tue Apr 19 02:07:05 2022 UTC

Host scan end Tue Apr 19 02:10:33 2022 UTC

Service (Port) Threat Level

445/tcp High
general/tcp High

2.1.1 High 445/tcp

High (CVSS: 8.1)

NVT: Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389)

Summary
This host is missing a critical security update according to Microsoft Bulletin MS17-010.

Vulnerability Detection Result

Vulnerability was detected according to the Vulnerability Detection Method.

. . . continues on next page . . .

2 RESULTS PER HOST 3

. . . continued from previous page . . .

Impact
Successful exploitation will allow remote attackers to gain the ability to execute code on the
target server, also could lead to information disclosure from the server.

Solution:
Solution type: VendorFix
The vendor has released updates. Please see the references for more information.

Aected Software/OS
- Microsoft Windows 10 x32/x64
- Microsoft Windows Server 2012
- Microsoft Windows Server 2016
- Microsoft Windows 8.1 x32/x64
- Microsoft Windows Server 2012 R2
- Microsoft Windows 7 x32/x64 Service Pack 1
- Microsoft Windows Vista x32/x64 Service Pack 2
- Microsoft Windows Server 2008 R2 x64 Service Pack 1
- Microsoft Windows Server 2008 x32/x64 Service Pack 2

Vulnerability Insight
Multiple aws exist due to the way that the Microsoft Server Message Block 1.0 (SMBv1) server
handles certain requests.

Vulnerability Detection Method

Send the crafted SMB transaction request with d = 0 and check the response to conrm the
vulnerability.
Details: Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389)
OID:1.3.6.1.4.1.25623.1.0.810676
Version used: 2021-09-14T11:01:46Z

References
cve: CVE-2017-0143
cve: CVE-2017-0144
cve: CVE-2017-0145
cve: CVE-2017-0146
cve: CVE-2017-0147
cve: CVE-2017-0148
bid: 96703
bid: 96704
bid: 96705
bid: 96707
bid: 96709
bid: 96706
url: https://support.microsoft.com/en-in/kb/4013078
url: https://technet.microsoft.com/library/security/MS17-010
url: https://github.com/rapid7/metasploit-framework/pull/8167/files
. . . continues on next page . . .
2 RESULTS PER HOST 4

. . . continued from previous page . . .

cert-bund: CB-K17/0435
dfn-cert: DFN-CERT-2017-0448

[ return to 10.10.1.2 ]

2.1.2 High general/tcp

High (CVSS: 10.0)

NVT: OS End Of Life Detection

Product detection result

cpe:/o:microsoft:windows_xp
Detected by OS Detection Consolidation and Reporting (OID: 1.3.6.1.4.1.25623.1.0
,→.105937)

Summary
OS End Of Life Detection.
The Operating System on the remote host has reached the end of life and should not be used
anymore.

Vulnerability Detection Result

The "Windows XP" Operating System on the remote host has reached the end of life
,→.
CPE: cpe:/o:microsoft:windows_xp
EOL date: 2014-04-08
EOL info: https://support.microsoft.com/en-us/lifecycle/search?sort=PN&
,→alpha=Microsoft%20Windows%20XP&Filter=FilterNO

Solution:
Solution type: Mitigation
Upgrade the Operating System on the remote host to a version which is still supported and
receiving security updates by the vendor.

Vulnerability Detection Method

Details: OS End Of Life Detection
OID:1.3.6.1.4.1.25623.1.0.103674
Version used: 2021-04-16T10:39:13Z

Product Detection Result

Product: cpe:/o:microsoft:windows_xp
Method: OS Detection Consolidation and Reporting
OID: 1.3.6.1.4.1.25623.1.0.105937)

[ return to 10.10.1.2 ]
2 RESULTS PER HOST 5

2.2 10.10.1.3

Host scan start Tue Apr 19 02:07:05 2022 UTC

Host scan end Tue Apr 19 02:11:15 2022 UTC

Service (Port) Threat Level

445/tcp High
general/tcp High
135/tcp Medium
general/tcp Low

2.2.1 High 445/tcp

High (CVSS: 8.1)

NVT: Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389)

Summary
This host is missing a critical security update according to Microsoft Bulletin MS17-010.

Vulnerability Detection Result

Vulnerability was detected according to the Vulnerability Detection Method.

Impact
Successful exploitation will allow remote attackers to gain the ability to execute code on the
target server, also could lead to information disclosure from the server.

Solution:
Solution type: VendorFix
The vendor has released updates. Please see the references for more information.

Aected Software/OS
- Microsoft Windows 10 x32/x64
- Microsoft Windows Server 2012
- Microsoft Windows Server 2016
- Microsoft Windows 8.1 x32/x64
- Microsoft Windows Server 2012 R2
- Microsoft Windows 7 x32/x64 Service Pack 1
- Microsoft Windows Vista x32/x64 Service Pack 2
- Microsoft Windows Server 2008 R2 x64 Service Pack 1
- Microsoft Windows Server 2008 x32/x64 Service Pack 2

Vulnerability Insight
Multiple aws exist due to the way that the Microsoft Server Message Block 1.0 (SMBv1) server
handles certain requests.

Vulnerability Detection Method

. . . continues on next page . . .
2 RESULTS PER HOST 6

. . . continued from previous page . . .

Send the crafted SMB transaction request with d = 0 and check the response to conrm the
vulnerability.
Details: Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389)
OID:1.3.6.1.4.1.25623.1.0.810676
Version used: 2021-09-14T11:01:46Z

References
cve: CVE-2017-0143
cve: CVE-2017-0144
cve: CVE-2017-0145
cve: CVE-2017-0146
cve: CVE-2017-0147
cve: CVE-2017-0148
bid: 96703
bid: 96704
bid: 96705
bid: 96707
bid: 96709
bid: 96706
url: https://support.microsoft.com/en-in/kb/4013078
url: https://technet.microsoft.com/library/security/MS17-010
url: https://github.com/rapid7/metasploit-framework/pull/8167/files
cert-bund: CB-K17/0435
dfn-cert: DFN-CERT-2017-0448

High (CVSS: 8.1)

NVT: Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389)

Summary
This host is missing a critical security update according to Microsoft Bulletin MS17-010.

Vulnerability Detection Result

Vulnerability was detected according to the Vulnerability Detection Method.

Impact
Successful exploitation will allow remote attackers to gain the ability to execute code on the
target server, also could lead to information disclosure from the server.

Solution:
Solution type: VendorFix
The vendor has released updates. Please see the references for more information.

Aected Software/OS
- Microsoft Windows 10 x32/x64
- Microsoft Windows Server 2012
- Microsoft Windows Server 2016
. . . continues on next page . . .
2 RESULTS PER HOST 7

. . . continued from previous page . . .

- Microsoft Windows 8.1 x32/x64
- Microsoft Windows Server 2012 R2
- Microsoft Windows 7 x32/x64 Service Pack 1
- Microsoft Windows Vista x32/x64 Service Pack 2
- Microsoft Windows Server 2008 R2 x64 Service Pack 1
- Microsoft Windows Server 2008 x32/x64 Service Pack 2

Vulnerability Insight
Multiple aws exist due to the way that the Microsoft Server Message Block 1.0 (SMBv1) server
handles certain requests.

Vulnerability Detection Method

Send the crafted SMB transaction request with d = 0 and check the response to conrm the
vulnerability.
Details: Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389)
OID:1.3.6.1.4.1.25623.1.0.810676
Version used: 2021-09-14T11:01:46Z

References
cve: CVE-2017-0143
cve: CVE-2017-0144
cve: CVE-2017-0145
cve: CVE-2017-0146
cve: CVE-2017-0147
cve: CVE-2017-0148
bid: 96703
bid: 96704
bid: 96705
bid: 96707
bid: 96709
bid: 96706
url: https://support.microsoft.com/en-in/kb/4013078
url: https://technet.microsoft.com/library/security/MS17-010
url: https://github.com/rapid7/metasploit-framework/pull/8167/files
cert-bund: CB-K17/0435
dfn-cert: DFN-CERT-2017-0448

[ return to 10.10.1.3 ]

2.2.2 High general/tcp

High (CVSS: 10.0)

NVT: OS End Of Life Detection

Product detection result

cpe:/o:microsoft:windows_7:-:-:
. . . continues on next page . . .
2 RESULTS PER HOST 8

. . . continued from previous page . . .

Detected by OS Detection Consolidation and Reporting (OID: 1.3.6.1.4.1.25623.1.0
,→.105937)

Summary
OS End Of Life Detection.
The Operating System on the remote host has reached the end of life and should not be used
anymore.

Vulnerability Detection Result

The "Windows 7" Operating System on the remote host has reached the end of life.
CPE: cpe:/o:microsoft:windows_7:-:-:
EOL date: 2013-04-09
EOL info: https://support.microsoft.com/en-us/lifecycle/search?sort=PN&
,→alpha=Windows%207&Filter=FilterNO

Solution:
Solution type: Mitigation
Upgrade the Operating System on the remote host to a version which is still supported and
receiving security updates by the vendor.

Vulnerability Detection Method

Details: OS End Of Life Detection
OID:1.3.6.1.4.1.25623.1.0.103674
Version used: 2021-04-16T10:39:13Z

Product Detection Result

Product: cpe:/o:microsoft:windows_7:-:-:
Method: OS Detection Consolidation and Reporting
OID: 1.3.6.1.4.1.25623.1.0.105937)

[ return to 10.10.1.3 ]

2.2.3 Medium 135/tcp

Medium (CVSS: 5.0)

NVT: DCE/RPC and MSRPC Services Enumeration Reporting

Summary
Distributed Computing Environment / Remote Procedure Calls (DCE/RPC) or MSRPC ser-
vices running on the remote host can be enumerated by connecting on port 135 and doing the
appropriate queries.

Vulnerability Detection Result

Here is the list of DCE/RPC or MSRPC services running on this host via the TCP p
. . . continues on next page . . .
2 RESULTS PER HOST 9

. . . continued from previous page . . .

,→rotocol:
Port: 49152/tcp
UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49152]
Port: 49153/tcp
UUID: 06bba54a-be05-49f9-b0a0-30f790261023, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49153]
Annotation: Security Center
UUID: 30adc50c-5cbc-46ce-9a0e-91914789e23c, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49153]
Annotation: NRP server endpoint
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49153]
Annotation: DHCP Client LRPC Endpoint
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49153]
Annotation: DHCPv6 Client LRPC Endpoint
UUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49153]
Annotation: Event log TCPIP
Port: 49154/tcp
UUID: 552d076a-cb29-4e44-8b6a-d15e59e2c0af, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49154]
Annotation: IP Transition Configuration endpoint
UUID: 86d35949-83c9-4044-b424-db363231fd0c, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49154]
UUID: 98716d03-89ac-44c7-bb8c-285824e51c4a, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49154]
Annotation: XactSrv service
UUID: a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49154]
Annotation: IKE/Authip API
Port: 49155/tcp
UUID: 367abb81-9844-35f1-ad32-98f038001003, version 2
Endpoint: ncacn_ip_tcp:10.10.1.3[49155]
Port: 49156/tcp
UUID: 12345678-1234-abcd-ef00-0123456789ab, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49156]
Annotation: IPSec Policy agent endpoint
Named pipe : spoolss
Win32 service or process : spoolsv.exe
Description : Spooler service
UUID: 6b5bdd1e-528c-422c-af8c-a4079be4fe48, version 1
Endpoint: ncacn_ip_tcp:10.10.1.3[49156]
Annotation: Remote Fw APIs
Port: 49158/tcp
UUID: 12345778-1234-abcd-ef00-0123456789ac, version 1
. . . continues on next page . . .
2 RESULTS PER HOST 10

. . . continued from previous page . . .

Endpoint: ncacn_ip_tcp:10.10.1.3[49158]
Named pipe : lsass
Win32 service or process : lsass.exe
Description : SAM access
Note: DCE/RPC or MSRPC services running on this host locally were identified. Re
,→porting this list is not enabled by default due to the possible large size of
,→this list. See the script preferences to enable this reporting.

Impact
An attacker may use this fact to gain more knowledge about the remote host.

Solution:
Solution type: Mitigation
Filter incoming trac to this ports.

Vulnerability Detection Method

Details: DCE/RPC and MSRPC Services Enumeration Reporting
OID:1.3.6.1.4.1.25623.1.0.10736
Version used: 2017-06-13T07:06:12Z

[ return to 10.10.1.3 ]

2.2.4 Low general/tcp

Low (CVSS: 2.6)

NVT: TCP timestamps

Summary
The remote host implements TCP timestamps and therefore allows to compute the uptime.

Vulnerability Detection Result

It was detected that the host implements RFC1323/RFC7323.
The following timestamps were retrieved with a delay of 1 seconds in-between:
Packet 1: 313659
Packet 2: 313768

Impact
A side eect of this feature is that the uptime of the remote host can sometimes be computed.

Solution:
Solution type: Mitigation
To disable TCP timestamps on linux add the line 'net.ipv4.tcp_timestamps = 0' to
/etc/sysctl.conf. Execute 'sysctl -p' to apply the settings at runtime.
To disable TCP timestamps on Windows execute 'netsh int tcp set global timestamps=disabled'
Starting with Windows Server 2008 and Vista, the timestamp can not be completely disabled.
. . . continues on next page . . .
2 RESULTS PER HOST 11

. . . continued from previous page . . .

The default behavior of the TCP/IP stack on this Systems is to not use the Timestamp options
when initiating TCP connections, but use them if the TCP peer that is initiating communication
includes them in their synchronize (SYN) segment.
See the references for more information.

Aected Software/OS
TCP implementations that implement RFC1323/RFC7323.

Vulnerability Insight
The remote host implements TCP timestamps, as dened by RFC1323/RFC7323.

Vulnerability Detection Method

Special IP packets are forged and sent with a little delay in between to the target IP. The
responses are searched for a timestamps. If found, the timestamps are reported.
Details: TCP timestamps
OID:1.3.6.1.4.1.25623.1.0.80091
Version used: 2020-08-24T08:40:10Z

References
url: http://www.ietf.org/rfc/rfc1323.txt
url: http://www.ietf.org/rfc/rfc7323.txt
url: https://web.archive.org/web/20151213072445/http://www.microsoft.com/en-us/d
,→ownload/details.aspx?id=9152

[ return to 10.10.1.3 ]

This le was automatically generated.