CVE-2017-0143
HIGH KEV RANSOMWAREMicrosoft Windows SMBv1 - Remote Code Execution via Crafted Packets
Title source: llmExploitation Summary
CVE-2017-0143 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 23 public exploits from researchers including Metasploit, Sean Dillon, Juan Sacco, including a Metasploit module spec/api/json_rpc_spec.
AI-analyzed exploit summary This Metasploit module exploits SMB vulnerabilities in MS17-010 (CVE-2017-0147) to achieve remote code execution on Windows systems. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec, PowerShell, or native upload methods.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Exploits (23)
This Metasploit module exploits SMB vulnerabilities in MS17-010 (CVE-2017-0147) to achieve remote code execution on Windows systems. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec, PowerShell, or native upload methods.
This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.
This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.
This repository contains a functional exploit for CVE-2017-0143 (EternalBlue), targeting MS17-010 vulnerability in Windows SMBv1. It includes scripts to check for vulnerability and execute payloads, leveraging Impacket for SMB communication.
This repository contains a scanner for detecting the EternalBlue vulnerability (CVE-2017-0143) in Windows 7 systems. It sends SMB packets to check for vulnerability but does not include exploit code for remote code execution.
This repository contains a bash script that uses nmap and masscan to detect CVE-2017-0143 (MS17-010) and CVE-2017-7494 (SAMBA) vulnerabilities in a network. It automates the process of scanning for vulnerable hosts by leveraging existing nmap scripts.
This repository contains a detailed technical writeup on identifying CVE-2017-0143 (EternalBlue) using Nmap's NSE script. It includes command examples, vulnerability context, and defensive recommendations.
This repository contains multiple scripts for detecting and enumerating SMB vulnerabilities, including CVE-2017-0143 (EternalBlue), but does not include functional exploit code for achieving RCE. It focuses on scanning, brute-forcing, and information gathering.
This repository provides a detailed step-by-step guide on exploiting CVE-2017-0143 (EternalBlue) using Metasploit in a lab environment. It includes setup instructions, vulnerability scanning, and post-exploitation steps, but does not contain actual exploit code.
This repository provides a report on EternalBlue (CVE-2017-0143), an exploit targeting Microsoft's SMBv1 protocol. It includes references to external resources but lacks functional exploit code or technical analysis.
This repository contains a detailed technical writeup of exploiting CVE-2017-0143 (EternalBlue) on a Windows 7 VM, including reconnaissance, vulnerability detection, exploitation using Metasploit, and post-exploitation steps. It provides a comprehensive walkthrough with screenshots and remediation recommendations.
This repository contains a functional Python3 exploit for CVE-2017-0143 (MS17-010), targeting the EternalBlue vulnerability in Windows SMBv1. The exploit leverages memory corruption to achieve remote code execution by manipulating session security contexts.
This is a comprehensive test suite for Metasploit's JSON-RPC API, specifically focusing on the integration and functionality of the API endpoints. It includes tests for health checks, job execution, error handling, and vulnerability analysis, with references to CVE-2017-0143 (EternalBlue) in the context of module analysis.
This is a test specification file for the Metasploit Framework's module info tool, specifically for the EternalBlue exploit (CVE-2017-0143). It validates the structure and behavior of the module info tool but does not contain actual exploit code.
This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems compromised by ETERNALBLUE. It includes functionality to detect the implant, execute payloads, and neutralize the implant.
This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0143) by probing the SMB service for a specific response indicating unpatched systems. It also checks for existing DoublePulsar infections but does not include exploit code for remote code execution.
This Metasploit module exploits the DOUBLEPULSAR implant, which leverages the ETERNALBLUE vulnerability (CVE-2017-0143) to execute payloads or neutralize the implant on vulnerable Windows systems via SMB.
This Metasploit module exploits MS17-010 vulnerabilities (EternalRomance, EternalSynergy, EternalChampion) to achieve remote command execution via SMB. It leverages a write-what-where primitive to overwrite session information and execute commands as an Administrator.
This Metasploit module exploits MS17-010 vulnerabilities (EternalRomance/EternalSynergy/EternalChampion) to achieve remote code execution on Windows systems via SMB. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec.
This repository contains a functional Python3 exploit for CVE-2017-0143 (MS17-010), targeting the SMBv1 vulnerability in Windows systems. The exploit leverages memory corruption to achieve remote code execution by manipulating session security contexts.
This repository contains detailed security notes and command snippets for red-teaming activities, including enumeration, brute-force attacks, and tool usage. It does not contain exploit code for CVE-2017-0143 but provides general offensive security techniques.
This repository is a documentation hub for various Windows kernel exploits, including CVE-2017-0143 (EternalBlue). It contains structured README files, issue templates, and a Python script for generating documentation. No functional exploit code is present.
References (12)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H