CVE-2017-0143

HIGH KEV RANSOMWARE

Microsoft Windows SMBv1 - Remote Code Execution via Crafted Packets

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-0143 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 23 public exploits from researchers including Metasploit, Sean Dillon, Juan Sacco, including a Metasploit module spec/api/json_rpc_spec.

AI-analyzed exploit summary This Metasploit module exploits SMB vulnerabilities in MS17-010 (CVE-2017-0147) to achieve remote code execution on Windows systems. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec, PowerShell, or native upload methods.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Exploits (23)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/43970

This Metasploit module exploits SMB vulnerabilities in MS17-010 (CVE-2017-0147) to achieve remote code execution on Windows systems. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec, PowerShell, or native upload methods.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMB Server (MS17-010)
No auth needed
Prerequisites: Network access to SMB port (445) · Vulnerable Windows system (pre-MS17-010 patch)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb SCANNER VERIFIED
by Sean Dillon · rubydoswindows
https://www.exploit-db.com/exploits/41891

This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows SMB Server (unpatched versions)
No auth needed
Prerequisites: Network access to the target's SMB port (445/TCP)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Juan Sacco · pythonremotewindows_x86-64
https://www.exploit-db.com/exploits/41987

This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (e.g., Windows Server 2008 R2 SP1)
No auth needed
Prerequisites: Network access to SMB port (445/TCP) · Target system with SMBv1 enabled and unpatched
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 38 stars
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/MS17-010_CVE-2017-0143

This repository contains a functional exploit for CVE-2017-0143 (EternalBlue), targeting MS17-010 vulnerability in Windows SMBv1. It includes scripts to check for vulnerability and execute payloads, leveraging Impacket for SMB communication.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (unpatched systems)
No auth needed
Prerequisites: Network access to target SMB port (445) · Unpatched Windows system vulnerable to MS17-010
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 7 stars
by NatteeSetobol · poc
https://github.com/NatteeSetobol/Etern-blue-Windows-7-Checker

This repository contains a scanner for detecting the EternalBlue vulnerability (CVE-2017-0143) in Windows 7 systems. It sends SMB packets to check for vulnerability but does not include exploit code for remote code execution.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Windows 7 (SMBv1)
No auth needed
Prerequisites: Network access to target system · SMBv1 enabled on target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 3 stars
by valarauco · poc
https://github.com/valarauco/wannafind

This repository contains a bash script that uses nmap and masscan to detect CVE-2017-0143 (MS17-010) and CVE-2017-7494 (SAMBA) vulnerabilities in a network. It automates the process of scanning for vulnerable hosts by leveraging existing nmap scripts.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Windows SMB (MS17-010), SAMBA (CVE-2017-7494)
No auth needed
Prerequisites: nmap · masscan · network access to target subnet
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by FernandoTDalcin · poc
https://github.com/FernandoTDalcin/thm-blue-writeup

This repository contains a detailed technical writeup on identifying CVE-2017-0143 (EternalBlue) using Nmap's NSE script. It includes command examples, vulnerability context, and defensive recommendations.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft SMBv1 (Windows 7/Server 2008 R2 and earlier)
No auth needed
Prerequisites: Nmap with NSE scripts · Network access to target
devstral-2 · analyzed May 19, 2026 Full analysis →
nomisec SCANNER
by hackingyseguridad · poc
https://github.com/hackingyseguridad/smb

This repository contains multiple scripts for detecting and enumerating SMB vulnerabilities, including CVE-2017-0143 (EternalBlue), but does not include functional exploit code for achieving RCE. It focuses on scanning, brute-forcing, and information gathering.

Classification
Scanner 90%
Attack Type
Info Leak | Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (various versions)
No auth needed
Prerequisites: Network access to target SMB ports (139/445) · SMBv1 enabled on target
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by benguelmas · poc
https://github.com/benguelmas/cve-2017-0143

This repository provides a detailed step-by-step guide on exploiting CVE-2017-0143 (EternalBlue) using Metasploit in a lab environment. It includes setup instructions, vulnerability scanning, and post-exploitation steps, but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMBv1 (Windows 7, Server 2008, etc.)
No auth needed
Prerequisites: Kali Linux (attacker machine) · Windows 7 (vulnerable target) · SMBv1 enabled on target · Unpatched MS17-010
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by Cedric-Martz · poc
https://github.com/Cedric-Martz/EthernalBlue_report

This repository provides a report on EternalBlue (CVE-2017-0143), an exploit targeting Microsoft's SMBv1 protocol. It includes references to external resources but lacks functional exploit code or technical analysis.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1
No auth needed
Prerequisites: Vulnerable SMBv1 implementation · Network access to target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by Mafiosohack · poc
https://github.com/Mafiosohack/offensive-security-lab-1

This repository contains a detailed technical writeup of exploiting CVE-2017-0143 (EternalBlue) on a Windows 7 VM, including reconnaissance, vulnerability detection, exploitation using Metasploit, and post-exploitation steps. It provides a comprehensive walkthrough with screenshots and remediation recommendations.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 7 SP1 (SMBv1)
No auth needed
Prerequisites: Network access to target · SMBv1 enabled on target · Metasploit Framework
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/MS17-010

This repository contains a functional Python3 exploit for CVE-2017-0143 (MS17-010), targeting the EternalBlue vulnerability in Windows SMBv1. The exploit leverages memory corruption to achieve remote code execution by manipulating session security contexts.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Windows SMBv1 (Windows 2000 and later)
No auth needed
Prerequisites: SMBv1 enabled on target · Network access to port 445
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WRITEUP
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/spec/api/json_rpc_spec.rb

This is a comprehensive test suite for Metasploit's JSON-RPC API, specifically focusing on the integration and functionality of the API endpoints. It includes tests for health checks, job execution, error handling, and vulnerability analysis, with references to CVE-2017-0143 (EternalBlue) in the context of module analysis.

Classification
Writeup 95%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Metasploit Framework
No auth needed
Prerequisites: Metasploit Framework installation · JSON-RPC API access
devstral-2 · analyzed May 19, 2026 Full analysis →
metasploit WRITEUP
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/spec/lib/msf/core/mcp/tools/module_info_spec.rb

This is a test specification file for the Metasploit Framework's module info tool, specifically for the EternalBlue exploit (CVE-2017-0143). It validates the structure and behavior of the module info tool but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Metasploit Framework
No auth needed
Prerequisites: Metasploit Framework installation
devstral-2 · analyzed May 01, 2026 Full analysis →
metasploit WORKING POC GREAT
by Equation Group, Shadow Brokers, zerosum0x0, Luke Jennings, wvu, Jacob Robles · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_doublepulsar_rce.rb

This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems compromised by ETERNALBLUE. It includes functionality to detect the implant, execute payloads, and neutralize the implant.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (DOUBLEPULSAR implant)
No auth needed
Prerequisites: Target system must be infected with DOUBLEPULSAR implant · SMB access to the target
devstral-2 · analyzed Apr 24, 2026 Full analysis →
metasploit SCANNER
by Sean Dillon <[email protected]>, Luke Jennings · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb

This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0143) by probing the SMB service for a specific response indicating unpatched systems. It also checks for existing DoublePulsar infections but does not include exploit code for remote code execution.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (unpatched systems prior to MS17-010)
No auth needed
Prerequisites: Network access to the target's SMB service (port 445) · SMBv1 enabled on the target
devstral-2 · analyzed Feb 20, 2026 Full analysis →
exploitdb WORKING POC
rubyremotewindows
https://www.exploit-db.com/exploits/47456

This Metasploit module exploits the DOUBLEPULSAR implant, which leverages the ETERNALBLUE vulnerability (CVE-2017-0143) to execute payloads or neutralize the implant on vulnerable Windows systems via SMB.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (DOUBLEPULSAR implant)
No auth needed
Prerequisites: Vulnerable SMB service exposed · DOUBLEPULSAR implant present
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC
by sleepya, zerosum0x0, Shadow Brokers, Equation Group · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/smb/ms17_010_command.rb

This Metasploit module exploits MS17-010 vulnerabilities (EternalRomance, EternalSynergy, EternalChampion) to achieve remote command execution via SMB. It leverages a write-what-where primitive to overwrite session information and execute commands as an Administrator.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMB Server (pre-MS17-010 patch)
No auth needed
Prerequisites: Access to SMB port (445) · Named pipe availability
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by sleepya, zerosum0x0, Shadow Brokers, Equation Group · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms17_010_psexec.rb

This Metasploit module exploits MS17-010 vulnerabilities (EternalRomance/EternalSynergy/EternalChampion) to achieve remote code execution on Windows systems via SMB. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMBv1 (pre-MS17-010 patch)
No auth needed
Prerequisites: SMBv1 enabled on target · Access to named pipe · Network access to target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
patchapalooza WORKING POC
by n3rdh4x0r · remote-auth
https://github.com/n3rdh4x0r/MS17-010

This repository contains a functional Python3 exploit for CVE-2017-0143 (MS17-010), targeting the SMBv1 vulnerability in Windows systems. The exploit leverages memory corruption to achieve remote code execution by manipulating session security contexts.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMBv1 (Windows 2000 and later)
No auth needed
Prerequisites: SMBv1 enabled on target · Network access to port 445
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WRITEUP
by fanicia · remote
https://github.com/fanicia/security-notes

This repository contains detailed security notes and command snippets for red-teaming activities, including enumeration, brute-force attacks, and tool usage. It does not contain exploit code for CVE-2017-0143 but provides general offensive security techniques.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: N/A
No auth needed
Prerequisites: Basic knowledge of offensive security tools
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WRITEUP
by Ascotbe · remote
https://github.com/Ascotbe/Kernelhub

This repository is a documentation hub for various Windows kernel exploits, including CVE-2017-0143 (EternalBlue). It contains structured README files, issue templates, and a Python script for generating documentation. No functional exploit code is present.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Windows Kernel
No auth needed
Prerequisites: documentation generation tooling
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (12)

Core 12
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41891/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96703
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037991
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41987/
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43970/
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html

Scores

CVSS v3 8.8
EPSS 0.9331
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2017-03-14
InTheWild.io 2017-03-14
ENISA EUVD EUVD-2017-0510
Ransomware Use Confirmed
Status published
Products (19)
microsoft/server_message_block 1.0
Microsoft Corporation/Windows SMB The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1
philips/intellispace_portal 7.0
philips/intellispace_portal 8.0
siemens/acuson_p300_firmware 13.02
siemens/acuson_p300_firmware 13.03
siemens/acuson_p300_firmware 13.20
siemens/acuson_p300_firmware 13.21
siemens/acuson_p500_firmware va10
siemens/acuson_p500_firmware vb10
... and 9 more
Published Mar 17, 2017
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026