woensdag 1 april 2009

Nmap to find Conficker infected hosts


Get latest nmap (4.85BETA6 at the moment of writing) from:

http://nmap.org/dist/?C=M&O=D

run:



sudo nmap -sC --script=smb-check-vulns --script-args=safe=1 -p445 \
-d -PN -n -T4 --min-hostgroup 256 --min-parallelism 64 \
-oA conficker_scan

It is important to note that scanning for Conficker has the small chance of crashing an unpatched host. Patched and infected hosts won't be crashed though. Note that if Conficker scans unpatched hosts they are even more likely to crash than with this check so the benefits probably outweigh the drawbacks.

Find the source here.

Geen opmerkingen: