{"draftJsState":{"blocks":[{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Каждый аудитор обладает своими любимыми техниками при работе в консоли. Поделитесь в комментариях своим опытом. Мы же расскажем про основные приемы перечисления SMB.","type":"unstyled","key":"3elj3"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Утилиты","type":"header-two","key":"92b1k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmblookup - собирает NetBIOS над TCP/IP клиентом, используется для поиска имен NetBIOS.","type":"unordered-list-item","key":"dcc6r"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"smbclient - клиент в стиле \"ftp\" для доступа к общим папкам SMB","type":"unordered-list-item","key":"2ro0u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmap - общий сканер, с возможностью применять скрипты","type":"unordered-list-item","key":"bvnn2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"rpcclient - инструмент для выполнения функций MS-RPC на стороне клиента","type":"unordered-list-item","key":"dpejq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"enum4linux - перечисляет различные функции smb","type":"unordered-list-item","key":"8rasn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"wireshark - инструмент для захвата и анализа сетевого трафика ","type":"unordered-list-item","key":"68ofs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Подробности","type":"header-two","key":"3r9l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Перечисление имен хостов","type":"header-three","key":"9tamh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmblookup","type":"header-three","key":"1ck6p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmblookup -A [IP]","type":"unstyled","key":"d1sj8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-A - посмотреть по IP адресу","type":"unordered-list-item","key":"8qdbo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"699p6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":31,"style":"BOLD"}],"text":"root@scaner-vs:~# nmblookup -A [ip]\nLooking up status of [ip]\n [hostname] <00> - M \n [hostname] <20> - M \n WORKGROUP <00> - M \n WORKGROUP <1e> - M \n <03> - M \n INet~Services <1c> - M \n IS~[hostname] <00> - M \n\n MAC Address = 00-50-56-XX-XX-XX\n","type":"unstyled","key":"4p5dh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Получить список общих папок","type":"header-three","key":"bg9q"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"smbmap","type":"header-three","key":"66fu4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":23,"offset":0,"style":"ITALIC"}],"text":"smbmap -H [ip/hostname]","type":"unstyled","key":"cei9t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Данная команда покажет Вам расшаренные ресурсы на хосте, а также уровень доступа к ним.","type":"unstyled","key":"bntmg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"d4si1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"root@scaner-vs:/# smbmap -H [ip]\n[+] Finding open SMB ports....\n[+] User SMB session establishd on [ip]...\n[+] IP: [ip]:445 Name: [ip] \n Disk Permissions\n ---- -----------\n ADMIN$ NO ACCESS\n C$ NO ACCESS\n IPC$ NO ACCESS\n NETLOGON NO ACCESS\n Replication READ ONLY\n SYSVOL NO ACCESS\n","type":"unstyled","key":"8baf1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если Вы обладаете учетными данными, можете перезапустить для отображения с новым уровнем доступа:","type":"unstyled","key":"cqk5j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"root@scaner-vs:/# smbmap -H [ip] -d [domain] -u [user] -p [password]\n[+] Finding open SMB ports....\n[+] User SMB session establishd on [ip]...\n[+] IP: [ip]:445 Name: [ip] \n Disk Permissions\n ---- -----------\n ADMIN$ NO ACCESS\n C$ NO ACCESS\n IPC$ NO ACCESS\n NETLOGON READ ONLY\n Replication READ ONLY\n SYSVOL READ ONLY\n","type":"unstyled","key":"6dcnk"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"smbclient","type":"header-three","key":"cm3im"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":33,"offset":0,"style":"ITALIC"}],"text":"echo exit | smbclient -L \\\\\\\\[ip]","type":"unstyled","key":"9huh4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"команда exit нужна для обработки запроса пароля, который может всплыть при обращении с пустым логином","type":"unordered-list-item","key":"6nvom"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-L - получить список \"шар\" для заданного хоста","type":"unordered-list-item","key":"86lmk"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"732q7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":33,"style":"BOLD"}],"text":"root@scaner-vs:~# smbclient -L \\\\[ip]\nEnter WORKGROUP\\root's password:\n\n Sharename Type Comment\n --------- ---- -------\n IPC$ IPC Remote IPC\n share Disk\n wwwroot Disk\n ADMIN$ Disk Remote Admin\n C$ Disk Default share\nReconnecting with SMB1 for workgroup listing.\n\n Server Comment\n --------- -------\n\n Workgroup Master\n --------- -------\n","type":"unstyled","key":"8a9m4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmap","type":"header-three","key":"e6dik"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmap --script smb-enum-shares -p 139,445 [ip]","type":"unstyled","key":"34eam"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"--script smb-enum-shares - характерный скрипт перечисления smb","type":"unordered-list-item","key":"5hhir"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-p 139,445 - указание портов smb","type":"unordered-list-item","key":"dp7q3"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"4mhp1"},{"data":{},"depth":0,"entityRanges":[{"key":0,"length":16,"offset":85}],"inlineStyleRanges":[{"length":1,"offset":59,"style":"BOLD"}],"text":"root@scaner-vs:~# nmap --script smb-enum-shares -p 139,445 [ip]\nStarting Nmap 7.70 ( https://nmap.org ) at 2018-09-27 16:25 EDT\nNmap scan report for [ip]\nHost is up (0.037s latency).\n\nPORT STATE SERVICE\n139/tcp open netbios-ssn\n445/tcp open microsoft-ds\nMAC Address: 00:50:56:XX:XX:XX (VMware)\n\nHost script results:\n| smb-enum-shares:\n| account_used: guest\n| \\\\[ip]\\ADMIN$:\n| Type: STYPE_DISKTREE_HIDDEN\n| Comment: Remote Admin\n| Anonymous access: \n| Current user access: \n| \\\\[ip]\\C$:\n| Type: STYPE_DISKTREE_HIDDEN\n| Comment: Default share\n| Anonymous access: \n| Current user access: \n| \\\\[ip]\\IPC$:\n| Type: STYPE_IPC_HIDDEN\n| Comment: Remote IPC\n| Anonymous access: READ\n| Current user access: READ/WRITE\n| \\\\[ip]\\share:\n| Type: STYPE_DISKTREE\n| Comment:\n| Anonymous access: \n| Current user access: READ/WRITE\n| \\\\[ip]\\wwwroot:\n| Type: STYPE_DISKTREE\n| Comment:\n| Anonymous access: \n|_ Current user access: READ\n\nNmap done: 1 IP address (1 host up) scanned in 10.93 seconds\n","type":"unstyled","key":"aqake"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Проверка Нулевых Сессий","type":"header-three","key":"f8fbc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"smbmap","type":"header-three","key":"ch2od"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":23,"offset":0,"style":"ITALIC"}],"text":"smbmap -H [ip/hostname] покажет, что Вы сможете сделать с заданными учетными данными (или null session если без авторизации). Примеры есть выше.","type":"unstyled","key":"4kdm"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"rpcclient","type":"header-three","key":"btgre"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"rpcclient -U \"\" -N [ip]","type":"unstyled","key":"ashhe"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-U \"\" - null session","type":"unordered-list-item","key":"37e9s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-N - без пароля","type":"unordered-list-item","key":"1jnq3"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"fa6rn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":37,"style":"BOLD"},{"length":1,"offset":53,"style":"BOLD"}],"text":"root@scaner-vs:~# rpcclient -U \"\" -N [ip]\nrpcclient $>","type":"unstyled","key":"fdm2k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Отсюда уже можно запускать команды rpc.","type":"unstyled","key":"3mpfm"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"smbclient","type":"header-three","key":"39vkt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":32,"offset":0,"style":"ITALIC"}],"text":"smbclient \\\\\\\\[ip]\\\\[share name]","type":"unstyled","key":"3isd2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Предпринять попытку подсоединиться к \"шаре\". На удачу можно попробовать и без пароля, вдруг повезёт :)","type":"unstyled","key":"fdicf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"161it"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":48,"style":"BOLD"}],"text":"root@scanner-vs:~/pwk/lab/public# smbclient \\\\\\\\[ip]\\\\share\nEnter WORKGROUP\\root's password:\nTry \"help\" to get a list of possible commands.\nsmb: \\> ls\n . D 0 Thu Sep 27 16:26:00 2018\n .. D 0 Thu Sep 27 16:26:00 2018\n New Folder (9) D 0 Sun Dec 13 05:26:59 2015\n New Folder - 6 D 0 Sun Dec 13 06:55:42 2015\n Shortcut to New Folder (2).lnk A 420 Sun Dec 13 05:24:51 2015\n\n 1690825 blocks of size 2048. 794699 blocks available\n","type":"unstyled","key":"4brn1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Проверка на уязвимости","type":"header-three","key":"1le3q"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmap","type":"header-three","key":"1lfga"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"nmap --script smb-vuln* -p 139,445 [ip]","type":"unstyled","key":"1jiro"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"--script smb-vuln* - запустит весь набор скриптов сканирования на уязвимости smb","type":"unordered-list-item","key":"3mh39"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-p 139,445 - smb порты","type":"unordered-list-item","key":"c20pv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример:","type":"unstyled","key":"nvo9"},{"data":{},"depth":0,"entityRanges":[{"key":1,"length":16,"offset":79},{"key":2,"length":60,"offset":888},{"key":3,"length":66,"offset":957},{"key":4,"length":66,"offset":1443},{"key":5,"length":60,"offset":1518},{"key":6,"length":93,"offset":1587}],"inlineStyleRanges":[{"length":1,"offset":40,"style":"BOLD"},{"length":1,"offset":53,"style":"BOLD"}],"text":"root@scaner-vs:~# nmap --script smb-vuln* -p 139,445 [ip]\nStarting Nmap 7.70 ( https://nmap.org ) at 2018-09-27 16:37 EDT\nNmap scan report for [ip]\nHost is up (0.030s latency).\n\nPORT STATE SERVICE\n139/tcp open netbios-ssn\n445/tcp open microsoft-ds\nMAC Address: 00:50:56:XX:XX:XX (VMware)\n\nHost script results:\n| smb-vuln-ms06-025:\n| VULNERABLE:\n| RRAS Memory Corruption vulnerability (MS06-025)\n| State: VULNERABLE\n| IDs: CVE:CVE-2006-2370\n| A buffer overflow vulnerability in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1\n| and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to\n| execute arbitrary code via certain crafted \"RPC related requests\" aka the \"RRAS Memory Corruption Vulnerability.\"\n|\n| Disclosure date: 2006-6-27\n| References:\n| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2370\n|_ https://technet.microsoft.com/en-us/library/security/ms06-025.aspx\n|_smb-vuln-ms10-054: false\n|_smb-vuln-ms10-061: false\n| smb-vuln-ms17-010:\n| VULNERABLE:\n| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)\n| State: VULNERABLE\n| IDs: CVE:CVE-2017-0143\n| Risk factor: HIGH\n| A critical remote code execution vulnerability exists in Microsoft SMBv1\n| servers (ms17-010).\n|\n| Disclosure date: 2017-03-14\n| References:\n| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx\n| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143\n|_ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/\n|_smb-vuln-regsvc-dos: ERROR: Script execution failed (use -d to debug)\n\nNmap done: 1 IP address (1 host up) scanned in 5.58 seconds\n","type":"unstyled","key":"4eqtp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Всеохватывающее Сканирование","type":"header-three","key":"ftdm1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"enum4linux","type":"header-three","key":"f0b9a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"enum4linux -a [ip]","type":"unstyled","key":"d58bh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"-a - весь перечень","type":"unordered-list-item","key":"begf1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Пример вывода команды довольно длинный, однако стоит обратить внимание на следующее:","type":"unstyled","key":"bnnpr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"вывод схож с nmblookup","type":"unordered-list-item","key":"4753k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"проверяются нулевые сессии","type":"unordered-list-item","key":"1bgu9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"выводится список общих папок (\"шар\")","type":"unordered-list-item","key":"dnol7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"информация от домене","type":"unordered-list-item","key":"5417f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"парольная политика","type":"unordered-list-item","key":"5n8tn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"RID cycling output","type":"unordered-list-item","key":"b1kr1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Ручная Инспекция","type":"header-three","key":"3gcip"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Samba","type":"header-three","key":"fnueq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":54,"offset":77,"style":"ITALIC"},{"length":30,"offset":163,"style":"ITALIC"},{"length":54,"offset":77,"style":"BOLD"},{"length":30,"offset":163,"style":"BOLD"}],"text":"ngrep это аккуратная утилита для \"grepa\" в сетевых данных. Запуск, наподобие ngrep -i -d tap0 's.?a.?m.?b.?a.*[[:digit:]]' port 139 в одном окне терминала и затем echo exit | smbclient -L [IP] - в другом, сдампит пачку информации, включая версию.","type":"unstyled","key":"6ct3"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"как получить версии самба ? смотрите скрипт с просторов Инета ! :)","type":"unstyled","key":"amt4m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":9,"offset":0,"style":"ITALIC"},{"length":18,"offset":10,"style":"ITALIC"},{"length":13,"offset":29,"style":"ITALIC"},{"length":52,"offset":43,"style":"ITALIC"},{"length":53,"offset":96,"style":"ITALIC"},{"length":26,"offset":150,"style":"ITALIC"},{"length":7,"offset":177,"style":"ITALIC"},{"length":51,"offset":185,"style":"ITALIC"},{"length":51,"offset":237,"style":"ITALIC"},{"length":2,"offset":289,"style":"BOLD"},{"length":1,"offset":292,"style":"BOLD"},{"length":1,"offset":300,"style":"BOLD"},{"length":5,"offset":303,"style":"BOLD"},{"length":2,"offset":348,"style":"BOLD"},{"length":5,"offset":357,"style":"BOLD"},{"length":1,"offset":367,"style":"BOLD"},{"length":5,"offset":372,"style":"BOLD"},{"length":1,"offset":378,"style":"BOLD"},{"length":1,"offset":380,"style":"BOLD"},{"length":1,"offset":388,"style":"BOLD"},{"length":5,"offset":391,"style":"BOLD"},{"length":1,"offset":401,"style":"BOLD"},{"length":5,"offset":406,"style":"BOLD"},{"length":1,"offset":416,"style":"BOLD"},{"length":3,"offset":422,"style":"BOLD"},{"length":2,"offset":669,"style":"BOLD"}],"text":"#!/bin/sh\n#Author: rewardone\n#Description:\n# Requires root or enough permissions to use tcpdump\n# Will listen for the first 7 packets of a null login\n# and grab the SMB Version\n#Notes:\n# Will sometimes not capture or will print multiple\n# lines. May need to run a second time for success.\nif [ -z $1 ]; then echo \"Usage: ./smbver.sh RHOST {RPORT}\" && exit; else rhost=$1; fi\nif [ ! -z $2 ]; then rport=$2; else rport=139; fi\ntcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i \"samba\\|s.a.m\" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\\n' & echo -n \"$rhost: \" &\necho \"exit\" | smbclient -L $rhost 1>/dev/null 2>/dev/null\nsleep 0.5 && echo \"\"\n","type":"unstyled","key":"fcnla"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Когды вы запустите его на машине с включенной службой Samba, вы получите следующие результаты:","type":"unstyled","key":"csmfj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":45,"style":"BOLD"}],"text":"root@scaner-vs:~/pwk/lab/public# ./smbver.sh [IP]\n[IP]: UnixSamba 227a\n","type":"unstyled","key":"80t7r"},{"data":{"image":{"id":"5d9b5ed33d873600b14f7ad2"}},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если сомневаемся, то сможем проверить версию smb в дампе PCAP. В примере у нас Unix Samba 2.2.3a:","type":"atomic:image","key":"fve3n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Windows","type":"header-three","key":"culh9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Windows SMB гораздо сложнее, чем просто версия, но просматривая в wireshark мы получим набор информации о соединении. Например, мы сможем отфильтровать по ntlmssp.ntlmv2_response, чтобы увидеть траффик NTLMv2.","type":"unstyled","key":"pmug"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"marker","key":"peHZFOjveN4nULIhJT3j"}],"entityMap":{"0":{"data":{"href":"https://nmap.org/","url":"https://nmap.org/"},"mutability":"MUTABLE","type":"LINK"},"1":{"data":{"href":"https://nmap.org/","url":"https://nmap.org/"},"mutability":"MUTABLE","type":"LINK"},"2":{"data":{"href":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2370","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2370"},"mutability":"MUTABLE","type":"LINK"},"3":{"data":{"href":"https://technet.microsoft.com/en-us/library/security/ms06-025.aspx","url":"https://technet.microsoft.com/en-us/library/security/ms06-025.aspx"},"mutability":"MUTABLE","type":"LINK"},"4":{"data":{"href":"https://technet.microsoft.com/en-us/library/security/ms17-010.aspx","url":"https://technet.microsoft.com/en-us/library/security/ms17-010.aspx"},"mutability":"MUTABLE","type":"LINK"},"5":{"data":{"href":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143"},"mutability":"MUTABLE","type":"LINK"},"6":{"data":{"href":"https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/","url":"https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/"},"mutability":"MUTABLE","type":"LINK"}}},"mentions":[]}