Updated Message due localhost bug

Author: racerxdl

Form1.Designer.cs

@@ -4,29 +4,40 @@
 using System.Data;
 using System.Drawing;
 using System.Linq;
+using System.Net;
+using System.Net.Sockets;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using System.Windows.Forms;
 
-namespace MS17010Test
-{
-  public partial class Form1 : Form
-  {
-    public Form1()
-    {
+namespace MS17010Test {
+  public partial class Form1 : Form {
+    public Form1() {
       InitializeComponent();
     }
+    private IPAddress LocalIPAddress() {
+      if (!System.Net.NetworkInformation.NetworkInterface.GetIsNetworkAvailable()) {
+        return null;
+      }
+
+      IPHostEntry host = Dns.GetHostEntry(Dns.GetHostName());
+
+      return host
+          .AddressList
+          .FirstOrDefault(ip => ip.AddressFamily == AddressFamily.InterNetwork);
+    }
 
     private void button1_Click(object sender, EventArgs e) {
       button1.Enabled = false;
       button2.Enabled = false;
       progressBar1.Visible = true;
       resultLabel.Text = strings.pleaseWait;
       resultLabel.ForeColor = Color.AliceBlue;
+      testIpBox.Text = LocalIPAddress().ToString();
       ThreadPool.QueueUserWorkItem((t) => {
         try {
-          var res = Tester.TestIP("127.0.0.1");
+          var res = Tester.TestIP(LocalIPAddress().ToString());
           UpdateWithResults(res);
         } catch (Exception ex) {
           ResultError(ex);
@@ -39,16 +50,21 @@ private void UpdateWithResults(TestResult res) {
         var self = new Action<TestResult>(UpdateWithResults);
         BeginInvoke(self, res);
       } else {
-        var msg = string.Format(strings.resultString, res.OSName, res.OSBuild, res.Workgroup, res.IsVulnerable ? strings.yes : strings.no);
+        var msg = string.Format(strings.resultString, res.OSName, res.OSBuild, res.Workgroup, res.IsVulnerable ? strings.yes : strings.no, res.error);
         resultLabel.Text = msg;
-        if (res.IsVulnerable) {
+        if (res.hadError) {
+          resultLabel.ForeColor = Color.PaleVioletRed;
+        } else if (res.IsVulnerable) {
           resultLabel.ForeColor = Color.Red;
         } else {
           resultLabel.ForeColor = Color.Green;
         }
         button1.Enabled = true;
         button2.Enabled = true;
         progressBar1.Visible = false;
+        if (res.hadError) {
+          MessageBox.Show(strings.executionError);
+        }
       }
     }
 
@@ -78,7 +94,7 @@ private void button2_Click(object sender, EventArgs e) {
         } catch (Exception ex) {
           ResultError(ex);
         }
-    });
+      });
     }
   }
 }

Form1.cs

@@ -121,7 +121,9 @@
     <value>That application is for checking if your computer is vulnerable to the flaw MS17-010 that the Ransonware WannaCry exploits.
 The first versions of that ransomware exploits that flaw to be able to spread over network using the protocol SMB.
 
-Worth note that this application only verifies if your computer is vulnerable to this flaw, and does not guarante that new versions of the ransomware wouldn't exploit other flaws on the system.</value>
+Worth note that this application only verifies if your computer is vulnerable to this flaw, and does not guarante that new versions of the ransomware wouldn't exploit other flaws on the system.
+
+For better test execute this application in another machine and execute with your IP Address.</value>
   </data>
   <assembly alias="System.Drawing" name="System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
   <data name="$this.Icon" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">

Form1.resx

@@ -6,27 +6,15 @@ Tester for MS017-010 Exploit Vulnearbility. Based on https://github.com/nixawk/l
 ## References
 
 https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/
-
 https://www.rapid7.com/db/modules/auxiliary/scanner/smb/smb_ms17_010
-
 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb
-
 https://www.symantec.com/security_response/vulnerability.jsp?bid=96707
-
 https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/[MS-SMB2]-151016.pdf
-
 https://msdn.microsoft.com/en-us/library/windows/desktop/aa365233(v=vs.85).aspx
-
 https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
-
 https://community.rapid7.com/community/metasploit/blog/2017/04/03/introducing-rubysmb-the-protocol-library-nobody-else-wanted-to-write
-
 https://msdn.microsoft.com/en-us/library/ee441741.aspx
-
 https://github.com/countercept/doublepulsar-detection-script/blob/master/detect_doublepulsar_smb.py
-
 http://stackoverflow.com/questions/38735421/packing-an-integer-number-to-3-bytes-in-python
-
 https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html
 
-

README.md

@@ -8,16 +8,20 @@ namespace MS17010Test {
   public class TestResult {
     public bool IsVulnerable;
     public bool VulnerabilityOK;
+    public bool hadError;
+    public string error;
     public string OSName;
     public string OSBuild;
     public string Workgroup;
 
     public TestResult() {
       IsVulnerable = false;
       VulnerabilityOK = false;
+      hadError = false;
       OSName = strings.unknown;
       OSBuild = strings.unknown;
       Workgroup = strings.unknown;
+      error = "";
     }
   }
 }

TestResult.cs

@@ -77,13 +77,15 @@ public static TestResult TestIP(string ip) {
         res.IsVulnerable = (smb.error_class == 0x05 && smb.reserved1 == 0x02 && smb.error_code == 0xC000);
         res.VulnerabilityOK = (smb.error_class == 0x08 && smb.reserved1 == 0x00 && smb.error_code == 0xC000) ||
           (smb.error_class == 0x22 && smb.reserved1 == 0x00 && smb.error_code == 0xC000);
-
+        res.error = $"{smb.error_class:X2} {smb.reserved1:X2} {smb.error_code:X4}";
         client.Close();
         return res;
       } catch (SocketException e) {
         if (e.SocketErrorCode == SocketError.ConnectionReset) {
           res.IsVulnerable = false;
           res.VulnerabilityOK = false;
+          res.hadError = true;
+          res.error = e.Message;
           return res;
         } else {
           throw e;

Tester.cs

@@ -123,6 +123,9 @@
   <data name="buttonTestOtherIP" xml:space="preserve">
     <value>Teste outro IP</value>
   </data>
+  <data name="executionError" xml:space="preserve">
+    <value>Houve um erro na execução do teste. Isso provavelmente significa que o seu computador não está vulnerável, porém o resultado não é tão confiável.</value>
+  </data>
   <data name="no" xml:space="preserve">
     <value>Não</value>
   </data>
@@ -131,7 +134,9 @@
 
 As primeiras versões do Ransonware usam uma falha no protocolo SMB do windows para poder se espalhar pela rede. 
 
-Vale notar que este aplicativo apenas verifica se o computador está vulnerável a essa falha, sendo que existe ainda a possibilidade de versões futuras do ransomware se aproveitarem de outras falhas.</value>
+Vale notar que este aplicativo apenas verifica se o computador está vulnerável a essa falha, sendo que existe ainda a possibilidade de versões futuras do ransomware se aproveitarem de outras falhas.
+
+Para melhor confiança no resultado, execute esse aplicativo em outra máquina e use o seu IP</value>
   </data>
   <data name="pleaseWait" xml:space="preserve">
     <value>Por favor aguarde...</value>
@@ -146,7 +151,8 @@ Vale notar que este aplicativo apenas verifica se o computador está vulnerável
     <value>OS: {0}
 Build: {1}
 Workgroup: {2}
-É vulnerável: {3}</value>
+É vulnerável: {3}
+Message: {4}</value>
   </data>
   <data name="unknown" xml:space="preserve">
     <value>Desconhecido</value>

strings.Designer.cs

@@ -123,14 +123,19 @@
   <data name="buttonTestOtherIP" xml:space="preserve">
     <value>Test Other IP</value>
   </data>
+  <data name="executionError" xml:space="preserve">
+    <value>There was an execution error. This may mean it is not vulnerable, but the results are not reliable.</value>
+  </data>
   <data name="no" xml:space="preserve">
     <value>No</value>
   </data>
   <data name="notice" xml:space="preserve">
     <value>That application is for checking if your computer is vulnerable to the flaw MS17-010 that the Ransonware WannaCry exploits.
 The first versions of that ransomware exploits that flaw to be able to spread over network using the protocol SMB.
 
-Worth note that this application only verifies if your computer is vulnerable to this flaw, and does not guarante that new versions of the ransomware wouldn't exploit other flaws on the system.</value>
+Worth note that this application only verifies if your computer is vulnerable to this flaw, and does not guarante that new versions of the ransomware wouldn't exploit other flaws on the system.
+
+For better test execute this application in another machine and execute with your IP Address.</value>
   </data>
   <data name="pleaseWait" xml:space="preserve">
     <value>Please wait ...</value>
@@ -145,7 +150,8 @@ Worth note that this application only verifies if your computer is vulnerable to
     <value>OS: {0}
 Build: {1}
 Workgroup: {2}
-Is Vulnerable: {3}</value>
+Is Vulnerable: {3}
+Message {4}</value>
   </data>
   <data name="unknown" xml:space="preserve">
     <value>Unknown</value>