During a vulnerability assessment, Nessus identifies a host as vulnerable to MS17-010 (EternalBlue). The rules of engagement for this engagement specify 'vulnerability assessment only — no exploitation.' What is the correct action?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you follow the rules of engagement, and a vulnerability assessment only means no exploitation. You document the scanner finding, back it up with version and patch-level evidence, rate it by CVSS, and recommend patching without trying the exploit.
Full Explanation
Document the scanner finding, note version and patch level as corroboration, rate severity by CVSS, and recommend patching without exploiting, per the ROE. Rules of engagement define the legal and contractual boundary; vulnerability assessment only prohibits exploitation. Scanner findings with OS and patch-level corroboration are sufficient to report with high confidence. Exploiting to prove a true positive and including a shell screenshot is wrong because it violates the ROE regardless of evidentiary value. Ignoring the finding because scanner results are always false positives is wrong because MS17-010 is well-characterized and scanner detection has high confidence; dismissing it would be negligent. Running EternalBlue manually but omitting results is wrong because concealing exploitation violates professional ethics and engagement terms.