Re: Precise OS detection of Windows over port 445?

[David Fifield <david () bamsoftware com>]

On Thu, Jun 03, 2010 at 01:38:29PM +0000, Richard Miles wrote:
> I use nmap to detect Windows machine vulnerable to ms08_067, it works
> very well. I also use nmap -sV -sC -p 443 target to get a precise
> identification of the system, and it's very helpful like telling me
> the Windows version and even service pack. It's essential to set the
> target on metasploit. My question is, how reliable is this
> information? Is possible it be incorrectly fingerprinted?
>
> Independent of this, to set a correct target I need to know the OS
> language and if NX is in use or not. Metasploit has a script to detect
> OS language on port 445 but my experience is very bad, sometimes work
> but most of the time it just return unknown. Someone know how they
> detect it? Is possible to add a feature like that on nmap? Would be
> awesome...

Try adding "-O --script=smb-os-discovery" to your command line. When
conditions are good, the OS detection is very accurate, but it might be
overly specific. smb-os-discovery will always be correct unless the
remote system is actively lying.

You can also try a UDP scan to port 161 with the snmp-win32-* scripts.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/