1025354003.yaml

id: netbios-ssn
info:
  name: Samba smbd
  author: nmap,cn-kali-team
  tags: detect,tech,netbios-ssn,service
  severity: info
  metadata:
    product: samba
    rarity: 4
    vendor: samba
    verified: true
    version: 4.6.2
tcp:
- name: smbprog-neg
  inputs:
  - data: \0\0\0\xa4\xff\x53\x4d\x42\x72\0\0\0\0\x08\x01\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\x06\0\0\x01\0\0\x81\0\x02PC NETWORK PROGRAM 1.0\0\x02MICROSOFT NETWORKS 1.03\0\x02MICROSOFT NETWORKS 3.0\0\x02LANMAN1.0\0\x02LM1.2X002\0\x02Samba\0\x02NT LANMAN 1.0\0\x02NT LM 0.12\0
  host:
  - '{{Hostname}}'
  port: 42,88,135,139,445,660,1025,1027,1031,1112,3006,3900,5000,5009,5432,5555,5600,7461,9102,9103,18182,27000-27010
  extractors:
  - name: netbios-ssn
    type: regex
    regex:
    - (?i)^\0\0\0.\xffSMBr\0\0\0\0\x88..\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x01\xff\xff\0\0$