Scanning and Remediating WannaCry/MS17-010 in InsightVM and Nexpose

Last updated at Thu, 13 Apr 2023 00:04:41 GMT

*Update 5/18/17: EternalBlue exploit (used in WannaCry attack) is now available in Metasploit for testing your compensating controls and validating remediations. More info: EternalBlue: Metasploit Module for MS17-010. Also removed steps 5 and 6 from scan instructions as they were not strictly necessary and causing issues for some customers.

*Update 5/17/17: Unauthenticated remote checks have now been provided. For hosts that are locked down to prevent null or guest access an authenticated remote check has also been provided. The pre-existing instructions below will enable the remote checks on creation of the template.

*Update 6/7/17: Fixed a small error in the dynamic asset group/dashboard section. We also now have a pre-built WannaCry dashboards in InsightVM.

Today, security teams are starting their work week with a scramble to remediate MS17-010, in order to prevent the associated ransomware attack, WannaCry, also known as Wanna Decryptor, WNCRY, and Wanna Decryptor 2.0 (how I miss the halcyon days when vulnerabilities had gentle names like Poodle).

With all of the WannaCry information circulating we want to keep this simple. First, check out this link to an overview of the WannaCry ransomware vulnerability written by Bob Rudis, and then review the below steps to quickly scan for this vulnerability in your own infrastructure (if you aren't already a customer, go try out InsightVM for free you can use this free trial to scan for this vulnerability across your environment), create a dynamic asset group to continuously see affected assets, as well as create a dynamic remediation project to track the progress of remediating WannaCry.

Here is the InsightVM/Nexpose step-by-step guide to create a scan template specifically to look for MS17-010:

1. Under the Administration tab, go to Templates > Manage Templates

2. Copy the following template: Full Audit enhanced logging without Web Spider. Don't forget to give your copy a name and description; here, we'll call it “WNCRY Scan Template”

3. Click on Vulnerability Checks and then “By Individual Check”

4. Add Check “MS17-010” and click save:

This should come back with 192 checks that are related to MS17-010. The related CVEs are:
CVE-2017-0143
CVE-2017-0144
CVE-2017-0145
CVE-2017-0146
CVE-2017-0147
CVE-2017-0148

5. Save the template and run a scan to identify all assets with MS17-010.

Creating a Dynamic Asset Group for MS17-010

Now that you have your assets scanned, you may want to create a Dynamic Asset Group to report/tag off of that will update itself whenever new assets are found with this vulnerability (and when they are fixed). To get started, click on the filter icon in the top right of the InsightVM console, just under the search button:

Now, use the "CVE ID" filter to specify the CVEs listed below:

This asset group can now be used for reporting as well as tagging to quickly identify exposed systems.

Creating a WannaCry Dashboard

Recently, Ken Mizota posted an article on how to build a custom dashboard to track your exposure to exploits from the Shadow Brokers leak. If you already did that, you're good to go! If you wanted to be specific to WannaCry, you could use this Dashboard filter:

asset.vulnerability.title CONTAINS "cve-2017-0143" OR asset.vulnerability.title CONTAINS "cve-2017-0144" OR asset.vulnerability.title CONTAINS "cve-2017-0145" OR asset.vulnerability.title CONTAINS "cve-2017-0101" OR asset.vulnerability.title CONTAINS "cve-2017-0146"asset.vulnerability.title CONTAINS "cve-2017-0147" OR asset.vulnerability.title CONTAINS "cve-2017-0148"

Creating a SQL Query Export

@00jay kindly posted this handy discussion for details on using the SQL export in InsightVM/Nexpose: WannaCry - Scanning & Reporting

Creating a Remediation Project for MS17-010:

In InsightVM, you can also create a remediation project for MS17-010 to track the progress of remediation live. To do this, go to the “Projects” tab and click “Create a Project”:

Give the project a name, and under vulnerability filter type in "vulnerability.alternateIds <=> ( altId = "ms17-010" )"

Note that this project is going to be dynamic, so it will automatically update as you fix and/or find new instances of this vulnerability.

Now, you can give this project a description, and configure who is responsible for remediation, as well as access levels if you wish. If you have JIRA, you can also configure the automatic ticketing integration between InsightVM and JIRA to automatically assign tickets to the right folks.

Using these steps, you'll be able to quickly scan for the WannaCry vulnerability as well as ensure that the vulns are being remediated. If you have any questions please don't hesitate to let us know!

For more information and resources on WannaCry and ransomware, please visit this page.