CVE-2017-0144
HIGH KEV RANSOMWAREMicrosoft Windows SMBv1 - Remote Code Execution via Crafted Packets
Title source: llmExploitation Summary
CVE-2017-0144 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2022, with confirmed use in ransomware campaigns.
EIP tracks 37 public exploits from researchers including sleepya, Sean Dillon, Juan Sacco, including a Metasploit module spec/lib/msf/core/mcp/tools/vulnerability_info_spec.
AI-analyzed exploit summary This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting SMB vulnerabilities in Windows systems. It leverages a buffer overflow in the SMBv1 protocol to achieve remote code execution by manipulating session security contexts.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Exploits (37)
This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting SMB vulnerabilities in Windows systems. It leverages a buffer overflow in the SMBv1 protocol to achieve remote code execution by manipulating session security contexts.
This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting Windows 8, 2012, and later systems. It leverages a buffer overflow in the SMB protocol to achieve remote code execution by disabling NX bit protection and executing shellcode.
This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting Windows 7/2008 systems via SMB. It leverages a buffer overflow in srvnet.sys to achieve remote code execution (RCE) in kernel mode.
This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.
This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.
This repository contains a scanner for detecting systems vulnerable to CVE-2017-0144 (EternalBlue). It uses Impacket to craft SMB packets and integrates with Metasploit for vulnerability detection.
This repository provides a detailed step-by-step guide on exploiting CVE-2017-0144 (EternalBlue) using Metasploit and Nmap, including target setup, vulnerability scanning, exploitation, and post-exploitation steps. It also covers patching the vulnerability.
This repository contains a detailed VAPT report on exploiting CVE-2017-0144 (EternalBlue) on a Windows 10 system, including reconnaissance, vulnerability scanning with Nessus, and exploitation using Metasploit. It provides a comprehensive technical walkthrough of the attack chain and remediation steps.
The repository contains a functional automated tool that leverages Nmap for vulnerability scanning and Metasploit for exploiting CVE-2017-0144 (EternalBlue). It automates the process of detecting and exploiting the SMBv1 vulnerability to achieve remote code execution on Windows systems.
This repository contains functional exploit code for CVE-2017-0144 (EternalBlue), including Python-based PoC scripts and shellcode for privilege escalation and remote code execution on Windows systems. The repository also includes detailed setup instructions and a CTF challenge framework.
This repository provides educational documentation on EternalBlue (CVE-2017-0144), detailing its history, impact, and mitigation techniques without containing any exploit code.
This repository contains a Python-based scanner that checks for the presence of the EternalBlue vulnerability (CVE-2017-0144) by attempting anonymous SMB connections. It does not exploit the vulnerability but detects if SMBv1 is enabled, which is a prerequisite for the exploit.
The repository contains a Python-based scanner for detecting CVE-2017-0144 (EternalBlue) vulnerability by sending crafted SMB packets to check if a target is vulnerable. It does not include exploit code for achieving remote code execution.
This repository provides a detailed technical analysis and reproduction of the EternalBlue exploit (CVE-2017-0144), including lab setup, traffic analysis, and MITRE ATT&CK mapping. It does not contain exploit code but offers a comprehensive walkthrough of the vulnerability mechanics and mitigation strategies.
This repository contains a detailed technical writeup on CVE-2017-0144 (EternalBlue), covering its impact, technical details, and remediation steps. It does not include exploit code but provides a comprehensive analysis of the vulnerability.
This repository contains a functional Metasploit module for CVE-2017-0144 (EternalBlue), demonstrating remote code execution via SMB on vulnerable Windows 7 systems. It includes detailed lab setup instructions, exploitation steps, and a safe ransomware simulation.
This repository provides a detailed technical walkthrough of exploiting CVE-2017-0144 (EternalBlue) using Metasploit, including victim setup, exploitation steps, post-exploitation techniques, and mitigation via patching. It also includes a safe simulation of a WannaCry-style ransomware attack.
This repository contains a detailed vulnerability assessment report focusing on CVE-2017-0144 (EternalBlue) and Stored XSS (CWE-79) vulnerabilities. It includes technical analysis, tool configurations, and packet-level proof of exploitation using OWASP ZAP, Nessus, and Wireshark.
This repository contains a detailed Threat and Vulnerability Risk Assessment (TVRA) report for CVE-2017-0144 (EternalBlue), including risk scoring, methodology, and evidence from tools like Nessus and Wireshark. It provides technical justification for the vulnerability's presence and impact but does not include functional exploit code.
This repository is a detailed technical writeup documenting the design, deployment, and security validation of a multi-VLAN enterprise network infrastructure. It includes vulnerability assessments, network diagrams, and configurations for services like DNS, DHCP, and Active Directory, with a mention of CVE-2017-0144 (EternalBlue) in the context of vulnerability testing.
This repository provides a detailed lab guide for testing CVE-2017-0144 (EternalBlue) using Metasploit's ms17_010_eternalblue exploit. It includes step-by-step instructions for setting up a vulnerable Windows 7 environment, disabling firewalls, and executing the exploit to achieve remote code execution (RCE).
This repository contains a detailed technical writeup on exploiting CVE-2017-0144 (EternalBlue) using Nmap for reconnaissance, Metasploit for initial access and privilege escalation, and JohnTheRipper for credential access. It provides step-by-step instructions, tool configurations, and screenshots to demonstrate the exploitation process.
This repository provides a detailed step-by-step guide on exploiting CVE-2017-0144 (EternalBlue) using Metasploit, including environment setup, target identification, and execution. It does not contain direct exploit code but offers a comprehensive walkthrough of the process.
This repository provides a detailed technical analysis of CVE-2017-0144 (EternalBlue), including exploit flow, memory corruption mechanics, and historical context. It does not contain functional exploit code but offers in-depth research on the vulnerability.
This repository provides a detailed technical analysis of CVE-2017-0144 (EternalBlue), including root cause analysis, patch details, and exploitation steps using Metasploit. It does not contain functional exploit code but offers in-depth explanations of the vulnerability mechanics.
This repository provides a detailed technical walkthrough of exploiting CVE-2017-0144 (EternalBlue) using Metasploit. It includes step-by-step instructions for setting up the environment, executing the exploit, and mitigating the vulnerability.
This script automates the exploitation of CVE-2017-0144 (EternalBlue) by scanning for vulnerable SMB services on port 445, generating a Metasploit resource script, and executing the exploit to achieve remote code execution. It uses Nmap for vulnerability detection and Metasploit for exploitation.
This repository contains detailed exploitation reports for CVE-2019-0708 (BlueKeep), a critical RCE vulnerability in Microsoft's Remote Desktop Services. It includes in-depth analysis, reproduction steps, and mitigation strategies, but no actual exploit code.
The repository contains no exploit code or technical details, only a link to a TryHackMe room and a video. This appears to be a social engineering lure rather than a legitimate PoC.
This repository provides a detailed technical walkthrough of exploiting CVE-2017-0144 (EternalBlue) using Metasploit, including setup, execution steps, and mitigation strategies. It does not contain actual exploit code but offers a comprehensive guide on the vulnerability.
This repository contains a Python script that monitors network traffic in real-time to detect EternalBlue (CVE-2017-0144) exploitation attempts by analyzing SMB packets for specific signatures (e.g., '0xc000000d'). It logs detected attacks to a file and console but does not include exploit code.
This is a Metasploit Framework test suite for vulnerability information retrieval, specifically testing the MCP (Metasploit Console Protocol) tool for querying vulnerability data, including CVE-2017-0144 (EternalBlue). It does not contain exploit code but validates the functionality of vulnerability scanning and data handling.
This is a Metasploit Framework test suite for response transformation logic, specifically for CVE-2017-0144 (EternalBlue). It validates data structures and transformations for module metadata, host information, and service details but does not contain exploit code.
This is a Metasploit module test suite for the EternalBlue exploit (CVE-2017-0144), which demonstrates the module info retrieval functionality. It includes mock HTTP interactions with the Metasploit RPC API to fetch and validate module metadata.
This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems compromised by ETERNALBLUE. It includes functionality to detect the implant, execute payloads, and neutralize the implant.
This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0144) by probing the SMB service for a specific response indicating unpatched systems. It also checks for existing DoublePulsar infections but does not include exploit code for remote code execution.
This Metasploit module exploits the DOUBLEPULSAR implant (CVE-2017-0144) to execute payloads or neutralize the implant on vulnerable SMB servers. It leverages the ETERNALBLUE exploit chain to interact with the implant, supporting both code execution and implant neutralization.
References (13)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H