Detections
Analytics
SMB Server DOUBLEPULSAR Backdoor / Implant Detection (EternalRocks)
critical Nessus Network Monitor Plugin ID 700059
Synopsis
The DOUBLEPULSAR backdoor is detected on the remote Windows host.Description
NNM detected the presence of DOUBLEPULSAR on the remote Windows host. DOUBLEPULSAR is one of multiple Equation Group SMB implants and backdoors disclosed on 2017/04/14 by a group known as the 'Shadow Brokers'. The implant allows an unauthenticated, remote attacker to use SMB as a covert channel to exfiltrate data, launch remote commands, or execute arbitrary code.Solution
Remove the Double Pulsar backdoor and disable SMBv1.See Also
https://github.com/countercept/doublepulsar-detection-script
https://technet.microsoft.com/en-us/library/security/ms17-mar.aspx
https://technet.microsoft.com/library/security/ms17-010
http://thehackernews.com/2017/03/microsoft-patch-tuesday.html
Plugin Details
Severity: Critical
ID: 700059
Family: Web Servers
Published: 4/18/2017
Updated: 4/22/2019
Nessus ID: 99439
Risk Information
VPR
Risk Factor: Critical
Score: 9.8
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:samba:samba
Patch Publication Date: 3/14/2017
Vulnerability Publication Date: 3/14/2017
Exploitable With
Metasploit (MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption)
Reference Information
CVE: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148