On that note, how do you guys fingerprint the OS? MSF’s ‘smb-fingerprints’ is able to nicely identify the operating system, language, and service pack. Whereas nmap’s smb-os-discovery script only reported that the machine runs either XP or Server 2000.
Should not be a rocket science to adopt MSF’s method into standalone script, but I am wondering if there is something already out there that can produce better results than the mentioned script.