Windows OS version from Major & Minor numbers

Sometimes during an audit you need to determine what's a specific System. Sometimes it's possible to obtain informacion y some SMB traffic is found, but if not, you can find some "BROWSER" traffic:

Sometimes there's no info available. In this cases one can determine the OS that sent this traffic by looking is Major & Minor numbers:

Operating System	Version Number	Major Number	Minor Number
Windows 95 OEM Service Release 1 (95A)	4.00.950	4	0
Windows 95 OEM Service Release 2 (95B)	4.00.1111	4	0
Windows 95 OEM Service Release 2.1	4.03.1212-1214	4	0
Windows 95 OEM Service Release 2.5 C	4.03.1214	4	0
Windows 98	4.10.1998	4	10
Windows 98 Second Edition (SE)	4.10.2222 A	4	10
Windows Millenium Beta	4.90.2476	4	90
Windows Millenium	4.90.3000	4	90
Windows NT 3.1	3.10.528	3	10
Windows NT 3.5	3.50.807	3	50
Windows NT 3.51	3.51.1057	3	51
Windows NT 4.00	4.00.1381	4	0
Windows NT 5.00 (Beta 2)	5.00.1515	5	0
Windows 2000 (Beta 3)	5.00.2031	5	0
Windows 2000 (Beta 3 RC2)	5.00.2128	5	0
Windows 2000 (Beta 3)	5.00.2183	5	0
Windows 2000	5.00.2195	5	0
Windows XP (RC 1)	5.1.2505	5	1
Windows XP	5.1.2600	5	1
Windows XP, Service Pack 1	5.1.2600.1105-1106	5	1
Windows XP, Service Pack 2	5.1.2600.2180	5	1
Windows XP, Service Pack 3	5.1.2600	5	1
Windows .NET Server interim	5.2.3541	5	2
Windows .NET Server Beta 3	5.2.3590	5	2
Windows .NET Server Release Candidate 1	5.2.3660	5	2
Windows .NET Server 2003 RC2	5.2.3718	5	2
Windows Server 2003 (Beta?)	5.2.3763	5	2
Windows Server 2003	5.2.3790	5	2
Windows Server 2003, Service Pack 1	5.2.3790.1180	5	2
Windows Server 2003	5.2.3790.1218	5	2
Windows Home Server	5.2.3790	5	2
Windows Longhorn	6.0.5048	6	0
Windows Vista, Beta 1	6.0.5112	6	0
Windows Vista, Community Technology Preview	6.0.5219	6	0
Windows Vista, TAP Preview	6.0.5259	6	0
Windows Vista, CTP	6.0.5270	6	0
Windows Vista, CTP	6.0.5308	6	0
Windows Vista, CTP (Refresh)	6.0.5342	6	0
Windows Vista, April EWD	6.0.5365	6	0
Windows Vista, Beta 2 Preview	6.0.5381	6	0
Windows Vista, Beta 2	6.0.5384	6	0
Windows Vista, Pre-RC1	6.0.5456	6	0
Windows Vista, Pre-RC1, Build 5472	6.0.5472	6	0
Windows Vista, Pre-RC1, Build 5536	6.0.5536	6	0
Windows Vista, RC1	6.0.5600.16384	6	0
Windows Vista, Pre-RC2	6.0.5700	6	0
Windows Vista, Pre-RC2, Build 5728	6.0.5728	6	0
Windows Vista, RC2	6.0.5744.16384	6	0
Windows Vista, Pre-RTM, Build 5808	6.0.5808	6	0
Windows Vista, Pre-RTM, Build 5824	6.0.5824	6	0
Windows Vista, Pre-RTM, Build 5840	6.0.5840	6	0
Windows Vista, RTM	6.0.6000.16386	6	0
Windows Vista	6.0.6000	6	0
Windows Vista, Service Pack 2	6.0.6002	6	0
Windows Server 2008	6.0.6001	6	0
Windows 7, RTM	6.1.7600.16385	6	1
Windows 7	6.1.7601	6	1
Windows Server 2008 R2, RTM	6.1.7600.16385	6	1
Windows Server 2008 R2, SP1	6.1.7601	6	1
Windows Home Server 2011	6.1.8400	6	1
Windows Server 2012	6.2.9200	6	2
Windows 8	6.2.9200	6	2
Windows Phone 8	6.2.10211	6	2
Windows Server 2012 R2	6.3.9200	6	3
Windows 8.1	6.3.9200	6	3
Windows 8.1, Update 1	6.3.9600	6	3
Windows 10	10.0.10240	10	0
Windows Server 2012 R2	6.3.9600	6	3

CVE 2017-6017 Video Demo

At last I've ready a video demo of the vulnerability I found last year in the PLC Modicon M340. It was eventually catalogued as:

• ICS Cert advisory ICSA-17-054-03
• NIST CVE 2017-6017

Other vulnerability databases mentioned it as well:

• Mitre
• CVE Details
• SecurityFocus

Ok, then, this is the demo video of the vulnerability (https://www.youtube.com/watch?v=9rz4rI82dWM):

This is very dangerous because an attacker could turn off very easily any of the more than 600 modicon devices currently accesible in internet:

For more information about this vulnerability, visit my previous entry in this blog talking about it.

I currently have an exploit both in python and Ruby, will publish them once the accessible vulnerable devices in shodan go below 100.

Meanwhile, there are many other toys waiting!!