Is there a list of exact attack vectors for the lazy? Both tools in the demo vid...

gerdesj · on April 14, 2017

Disabling SMB is possible but it means you will not be accessing a Windows file share or providing one. Fine if you don't need it.

https://support.microsoft.com/en-gb/help/2696547/how-to-enab...

For my money, disable SMBv1 anyway and use a firewall and (V)LANs.

Samba, pop this under [global] to disable SMBv1 min protocol = SMB2

To disable it try "systemctl stop smbd" or "/etc/init.d/smbd stop" or ... 8)

jlgaddis · on April 14, 2017

There's an incomplete "summary of leaked data" at https://www.bleepingcomputer.com/news/security/shadow-broker...

cm2187 · on April 14, 2017

Looking at this list it seems to affect mostly older versions of windows servers and servers with SMB running. I'd say it would mostly be a problem on intranets than windows based web servers.

noinsight · on April 15, 2017

> and servers with SMB running.

Which is going to be Domain Controllers, the most highly privileged servers on most corporate networks. And accessible to the "entire" network too. Group Policy is distributed through SMB shares.