Index: scripts/smb-check-vulns.nse
===================================================================
--- scripts/smb-check-vulns.nse	(revision 17562)
+++ scripts/smb-check-vulns.nse	(working copy)
@@ -184,8 +184,8 @@
 	--    test will complete."
 	["NT_STATUS_OBJECT_NAME_NOT_FOUND"] = 
 [[UNKNOWN; not Windows, or Windows with disabled browser service (CLEAN); or Windows with crashed browser service (possibly INFECTED).
-|  If you know the remote system is Windows, try rebooting it and scanning
-|_ again. (Error NT_STATUS_OBJECT_NAME_NOT_FOUND)]],
+     If you know the remote system is Windows, try rebooting it and scanning
+     again. (Error NT_STATUS_OBJECT_NAME_NOT_FOUND)]],
 	-- http://www.skullsecurity.org/blog/?p=209#comment-100
 	--   "That likely means that the server has been locked down, so we
 	--    don’t have access to the necessary pipe. Fortunately, that means
@@ -193,9 +193,9 @@
 	--    means you’re ok."
 	["NT_STATUS_ACCESS_DENIED"] =
 [[Likely CLEAN; access was denied.
-|  If you have a login, try using --script-args=smbuser=xxx,smbpass=yyy
-|  (replace xxx and yyy with your username and password). Also try
-|_ smbdomain=zzz if you know the domain. (Error NT_STATUS_ACCESS_DENIED)]],
+     If you have a login, try using --script-args=smbuser=xxx,smbpass=yyy
+     (replace xxx and yyy with your username and password). Also try
+     smbdomain=zzz if you know the domain. (Error NT_STATUS_ACCESS_DENIED)]],
 	-- The cause of these two is still unknown.
 	-- ["NT_STATUS_NOT_SUPPORTED"] =
 	-- [[]]
@@ -374,7 +374,7 @@
 	-- Try and do something simple
 	stdnse.print_debug(1, "smb-check-vulns: Attempting to connect to the host")
 	socket:set_timeout(5000)
-	status, result = socket:connect(host.ip, 445)
+	status, result = socket:connect(host.ip, smb.get_port(host))
 
 	-- Check the result	
 	if(status == false or status == nil) then
@@ -397,6 +397,72 @@
 	return true, PATCHED
 end
 
+---Checks if the server is vulnerable to a DoS against the Samba server as described in:
+-- http://seclists.org/fulldisclosure/2010/May/145
+local function check_samba_dos(host)
+	local status, smbstate, result
+
+	if(nmap.registry.args.safe ~= nil) then
+		return true, NOTRUN
+	end
+	if(nmap.registry.args.unsafe == nil) then
+		return true, NOTRUN
+	end
+
+	-- http://seclists.org/fulldisclosure/2010/May/145
+	status, smbstate = smb.start(host)
+	if(not(status)) then
+		return false, "Couldn't create the SMB session: " .. result
+	end
+
+	-- Negotiate the protocol with flags2 set to 0x0003
+	status, result = smb.negotiate_protocol(smbstate, {flags2 = 0x0003})
+	if(not(status)) then
+		return false, "Couldn't negotiate protocol: " .. result
+	end
+
+	-- Start the session with flags2 set to 0x8003
+	status, result = smb.start_session(smbstate, {flags2 = 0x8003})
+	if(not(status)) then
+		return false, "Couldn't start session: " .. result
+	end
+
+	-- Give it some time to crash
+	stdnse.print_debug(1, "smb-check-vulns: Waiting 5 seconds to see if Samba crashed")
+	stdnse.sleep(5)
+
+	-- Create a new socket
+	socket = nmap:new_socket()
+	if(socket == nil) then
+		return false, "Couldn't create socket"
+	end
+
+	-- Try and do something simple
+	stdnse.print_debug(1, "smb-check-vulns: Attempting to connect to the host")
+	socket:set_timeout(5000)
+	status, result = socket:connect(host.ip, smb.get_port(host))
+
+	-- Check the result	
+	if(not(status)) then
+		stdnse.print_debug(1, "smb-check-vulns: Connect failed, host is likely vulnerable!")
+		socket:close()
+		return true, VULNERABLE
+	end
+
+	-- Try sending something
+	stdnse.print_debug(1, "smb-check-vulns: Attempting to send data to the host")
+	status, result = socket:send("AAAA")
+	if(not(status)) then
+		stdnse.print_debug(1, "smb-check-vulns: Send failed, host is likely vulnerable!")
+		socket:close()
+		return true, VULNERABLE
+	end
+
+	stdnse.print_debug(1, "smb-check-vulns: Checks finished; host is likely not vulnerable.")
+	socket:close()
+	return true, PATCHED
+end
+
 ---Returns the appropriate text to display, if any. 
 --
 --@param check The name of the check; for example, 'ms08-067'.
@@ -490,6 +556,23 @@
 		end
 	end
 
+	-- Check for samba vulnerablity
+	status, result = check_samba_dos(host)
+	if(status == false) then
+		table.insert(response, get_response("Samba DoS bug (seclists.org/fulldisclosure/2010/May/145)", "ERROR", result, 0, 1))
+	else
+		if(result == VULNERABLE) then
+			table.insert(response, get_response("Samba DoS bug (seclists.org/fulldisclosure/2010/May/145)", "VULNERABLE", nil, 0))
+		elseif(result == NOTRUN) then
+			table.insert(response, get_response("Samba DoS bug (seclists.org/fulldisclosure/2010/May/145)", "CHECK DISABLED", "add '--script-args=unsafe=1' to run", 1))
+		else
+			table.insert(response, get_response("Samba DoS (seclists.org/fulldisclosure/2010/May/145)", "NOT VULNERABLE", nil, 1))
+		end
+	end
+
+
+
+
 	return stdnse.format_output(true, response)
 end