thatsBroken

You don’t get this often… the advisory released by the vulnerability researcher includes a ton of PoC code that can be used to, among other things, detect the MS10-012 patch without authentication.

The script connects to a target over TCP 445 and sends it a negotiation request.  The response is parsed for the 8byte challenge token and stored.  After approximately 2000 request we get our first duplicate challenge token.

At the end of a 5 minute test run my results were:

Challenges: 49,328
Duplicates: 198

… um, wow. (10.7.0.122 = PATCHED and 10.7.0.140 = UNPATCHED)