ms15-034.nse

-- The Head Section --
description = [[Scan for ms15-034 -> https://technet.microsoft.com/library/security/MS15-034]]

---
-- @usage
-- nmap --script ./ms15-034.nse <target>
-- @output
-- PORT   STATE SERVICE
-- 80/tcp open  http
-- |_ms15-034: Vulnerable

author = "Kl0nEz"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"default", "safe"}

local shortport = require "shortport"
local http = require "http"
local stdnse = require "stdnse"
local string = require "string"

-- The Rule Section --
portrule = shortport.http

-- The Action Section --
action = function(host, port)

    local uri = "/"

    local options = {header={}}
    options['header']['User-Agent'] = "Mozilla/5.0 (compatible; ArcticFission)"
    options['header']['Host'] = "keep_your_mind_flying"
    options['header']['Range'] = "bytes=0-18446744073709551615"

    local response = http.get(host, port, uri, options)

    local title = string.match(response.body, "<[Tt][Ii][Tt][Ll][Ee][^>]*>([^<]*)</[Tt][Ii][Tt][Ll][Ee]>")

    if ( title == "Requested Range Not Satisfiable" ) then
    return "Vulnerable"
    else
    return "Can't check"
    end

end