SMB Process Enumeration Scanner

Details
Stay Up To Date
Asset Type

DOMAIN,IP

Need Membership

No

Asset Verify

No

API Support

Yes

Estimate Time (Second)

15

SMB Process Enumeration Scanner Detail

You can scan your Windows system by using this tool.

Pulls a list of processes from the remote server over SMB. This will determine all running processes, their process IDs, and their parent processes. It is done by querying the remote registry service, which is disabled by default on Vista; on all other Windows versions, it requires Administrator privileges.

Since this requires administrator privileges, it isn't especially useful for a penetration tester, since they can effectively do the same thing with metasploit or other tools. It does, however, provide for a quick way to get process lists for a bunch of systems at the same time.

WARNING: I have experienced crashes in regsvc.exe while making registry calls against a fully patched Windows 2000 system; I've fixed the issue that caused it, but there's no guarantee that it (or a similar vulnerability in the same code) won't show up again. Since the process automatically restarts, it doesn't negatively impact the system, besides showing a message box to the user.

Some Advice for Common Problems

Upgrade your system to the fixed version.

Need a Full Assessment?

Get help from professional hackers. Learn about our penetration test service now!

Request Pentest Service