CVE-2017-0144

HIGH KEV RANSOMWARE

Microsoft Windows SMBv1 - Remote Code Execution via Crafted Packets

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-0144 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2022, with confirmed use in ransomware campaigns. EIP tracks 37 public exploits from researchers including sleepya, Sean Dillon, Juan Sacco, including a Metasploit module spec/lib/msf/core/mcp/tools/vulnerability_info_spec.

AI-analyzed exploit summary This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting SMB vulnerabilities in Windows systems. It leverages a buffer overflow in the SMBv1 protocol to achieve remote code execution by manipulating session security contexts.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Exploits (37)

exploitdb WORKING POC VERIFIED
by sleepya · pythonremotewindows
https://www.exploit-db.com/exploits/42315

This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting SMB vulnerabilities in Windows systems. It leverages a buffer overflow in the SMBv1 protocol to achieve remote code execution by manipulating session security contexts.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMBv1 (Windows 2000 - Windows 2016)
No auth needed
Prerequisites: Network access to SMB port (445) · SMBv1 enabled on target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by sleepya · pythonremotewindows_x86-64
https://www.exploit-db.com/exploits/42030

This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting Windows 8, 2012, and later systems. It leverages a buffer overflow in the SMB protocol to achieve remote code execution by disabling NX bit protection and executing shellcode.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows 8, Windows 2012, Windows 10 (x64)
No auth needed
Prerequisites: Access to SMB port (445) · Target system vulnerable to CVE-2017-0144
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by sleepya · pythonremotewindows
https://www.exploit-db.com/exploits/42031

This is a Python-based exploit for CVE-2017-0144 (EternalBlue), targeting Windows 7/2008 systems via SMB. It leverages a buffer overflow in srvnet.sys to achieve remote code execution (RCE) in kernel mode.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows 7/2008 (SMBv1)
No auth needed
Prerequisites: SMBv1 enabled on target · Network access to target's SMB port (445)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb SCANNER VERIFIED
by Sean Dillon · rubydoswindows
https://www.exploit-db.com/exploits/41891

This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows SMB Server (unpatched versions)
No auth needed
Prerequisites: Network access to the target's SMB port (445/TCP)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Juan Sacco · pythonremotewindows_x86-64
https://www.exploit-db.com/exploits/41987

This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (e.g., Windows Server 2008 R2 SP1)
No auth needed
Prerequisites: Network access to SMB port (445/TCP) · Target system with SMBv1 enabled and unpatched
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 339 stars
by peterpt · poc
https://github.com/peterpt/eternal_scanner

This repository contains a scanner for detecting systems vulnerable to CVE-2017-0144 (EternalBlue). It uses Impacket to craft SMB packets and integrates with Metasploit for vulnerability detection.

Classification
Scanner 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1
No auth needed
Prerequisites: Network access to target systems · SMB port (445) open on target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP 17 stars
by EEsshq · poc
https://github.com/EEsshq/CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution

This repository provides a detailed step-by-step guide on exploiting CVE-2017-0144 (EternalBlue) using Metasploit and Nmap, including target setup, vulnerability scanning, exploitation, and post-exploitation steps. It also covers patching the vulnerability.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (MS17-010)
No auth needed
Prerequisites: Kali Linux attacker machine · Windows Server 2008 R2 target machine · Network connectivity to target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP 11 stars
by AdityaBhatt3010 · poc
https://github.com/AdityaBhatt3010/VAPT-Report-on-SMB-Exploitation-in-Windows-10-Finance-Endpoint

This repository contains a detailed VAPT report on exploiting CVE-2017-0144 (EternalBlue) on a Windows 10 system, including reconnaissance, vulnerability scanning with Nessus, and exploitation using Metasploit. It provides a comprehensive technical walkthrough of the attack chain and remediation steps.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows 10 SMBv1
No auth needed
Prerequisites: Unpatched Windows 10 system with SMBv1 enabled · Network access to port 445
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by AtithKhawas · poc
https://github.com/AtithKhawas/autoblue

The repository contains a functional automated tool that leverages Nmap for vulnerability scanning and Metasploit for exploiting CVE-2017-0144 (EternalBlue). It automates the process of detecting and exploiting the SMBv1 vulnerability to achieve remote code execution on Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (MS17-010)
No auth needed
Prerequisites: Nmap installed · Metasploit Framework installed · Target IP address · Attacker IP address
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by sethwhy · infoleak
https://github.com/sethwhy/BlueDoor

This repository contains functional exploit code for CVE-2017-0144 (EternalBlue), including Python-based PoC scripts and shellcode for privilege escalation and remote code execution on Windows systems. The repository also includes detailed setup instructions and a CTF challenge framework.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMBv1 (Windows 7, Windows Server 2008, etc.)
No auth needed
Prerequisites: Network access to target's SMB port (445) · Vulnerable Windows system (unpatched MS17-010)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP 1 stars
by nivedh-j · poc
https://github.com/nivedh-j/EternalBlue-Explained

This repository provides educational documentation on EternalBlue (CVE-2017-0144), detailing its history, impact, and mitigation techniques without containing any exploit code.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SMBv1 protocol on Windows systems (e.g., Windows 7, Windows Server 2008)
No auth needed
Prerequisites: Unpatched Windows system with SMBv1 enabled · Network access to the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 1 stars
by MedX267 · poc
https://github.com/MedX267/EternalBlue-Vulnerability-Scanner

This repository contains a Python-based scanner that checks for the presence of the EternalBlue vulnerability (CVE-2017-0144) by attempting anonymous SMB connections. It does not exploit the vulnerability but detects if SMBv1 is enabled, which is a prerequisite for the exploit.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows SMBv1 (various versions)
No auth needed
Prerequisites: Network access to target SMB ports (typically 445) · SMBv1 enabled on target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 1 stars
by kimocoder · remote
https://github.com/kimocoder/eternalblue

The repository contains a Python-based scanner for detecting CVE-2017-0144 (EternalBlue) vulnerability by sending crafted SMB packets to check if a target is vulnerable. It does not include exploit code for achieving remote code execution.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (affected versions include Windows 7, Windows Server 2008 R2, etc.)
No auth needed
Prerequisites: Network access to target SMB port (445/TCP) · SMBv1 enabled on target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by trinadh-dasari-cyber · poc
https://github.com/trinadh-dasari-cyber/eternalblue-ms17-010-research

This repository provides a detailed technical analysis and reproduction of the EternalBlue exploit (CVE-2017-0144), including lab setup, traffic analysis, and MITRE ATT&CK mapping. It does not contain exploit code but offers a comprehensive walkthrough of the vulnerability mechanics and mitigation strategies.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows Server 2008 R2 (SMBv1)
No auth needed
Prerequisites: Vulnerable Windows Server 2008 R2 with SMBv1 enabled · Metasploit Framework · Isolated network environment
devstral-2 · analyzed May 19, 2026 Full analysis →
nomisec WRITEUP
by joel6948 · poc
https://github.com/joel6948/CVE-2017-0144

This repository contains a detailed technical writeup on CVE-2017-0144 (EternalBlue), covering its impact, technical details, and remediation steps. It does not include exploit code but provides a comprehensive analysis of the vulnerability.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SMBv1
No auth needed
Prerequisites: Unpatched Windows systems with SMBv1 enabled · Network access to port 445 or 139
devstral-2 · analyzed Apr 29, 2026 Full analysis →
nomisec WORKING POC
by dannic145 · poc
https://github.com/dannic145/EternalBlue-Exploit-Demonstration

This repository contains a functional Metasploit module for CVE-2017-0144 (EternalBlue), demonstrating remote code execution via SMB on vulnerable Windows 7 systems. It includes detailed lab setup instructions, exploitation steps, and a safe ransomware simulation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 7 SP1 x64 (unpatched)
No auth needed
Prerequisites: Vulnerable Windows 7 system · Kali Linux with Metasploit · Network connectivity to target
devstral-2 · analyzed Apr 24, 2026 Full analysis →
nomisec WRITEUP
by ichhyak22 · remote
https://github.com/ichhyak22/EternalBlue-Exploit-Demonstration-MS17-010

This repository provides a detailed technical walkthrough of exploiting CVE-2017-0144 (EternalBlue) using Metasploit, including victim setup, exploitation steps, post-exploitation techniques, and mitigation via patching. It also includes a safe simulation of a WannaCry-style ransomware attack.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows 7 SP1 x64 (Unpatched)
No auth needed
Prerequisites: Kali Linux with Metasploit · Windows 7 SP1 x64 (Unpatched) · Isolated network environment
devstral-2 · analyzed Apr 24, 2026 Full analysis →
nomisec WRITEUP
by klairmanraj · poc
https://github.com/klairmanraj/Multi-VLAN-Enterprise-Network-Vulnerability-Assessment

This repository contains a detailed vulnerability assessment report focusing on CVE-2017-0144 (EternalBlue) and Stored XSS (CWE-79) vulnerabilities. It includes technical analysis, tool configurations, and packet-level proof of exploitation using OWASP ZAP, Nessus, and Wireshark.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Metasploitable 3 (SMBv1)
No auth needed
Prerequisites: Access to target network · Vulnerable SMBv1 service · OWASP ZAP/Nessus for scanning
devstral-2 · analyzed Apr 20, 2026 Full analysis →
nomisec WRITEUP
by klairmanraj · poc
https://github.com/klairmanraj/Vulnerability-Risk-Assessment-TVRA-Enterprise-Network

This repository contains a detailed Threat and Vulnerability Risk Assessment (TVRA) report for CVE-2017-0144 (EternalBlue), including risk scoring, methodology, and evidence from tools like Nessus and Wireshark. It provides technical justification for the vulnerability's presence and impact but does not include functional exploit code.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (EternalBlue)
No auth needed
Prerequisites: Network access to target · SMBv1 enabled on target
devstral-2 · analyzed Apr 20, 2026 Full analysis →
nomisec WRITEUP
by klairmanraj · poc
https://github.com/klairmanraj/Multi-VLAN-Enterprise-Network-Security-Infrastructure

This repository is a detailed technical writeup documenting the design, deployment, and security validation of a multi-VLAN enterprise network infrastructure. It includes vulnerability assessments, network diagrams, and configurations for services like DNS, DHCP, and Active Directory, with a mention of CVE-2017-0144 (EternalBlue) in the context of vulnerability testing.

Classification
Writeup 95%
Attack Type
Other
Complexity
Complex
Reliability
Theoretical
Target: Multi-VLAN Enterprise Network Infrastructure
No auth needed
Prerequisites: Virtualized environment with multiple VMs · Networking equipment supporting VLANs and GRE tunneling · Security tools like OWASP ZAP and Nessus
devstral-2 · analyzed Apr 20, 2026 Full analysis →
nomisec WRITEUP
by althany · poc
https://github.com/althany/CVE-2017-0144_Lab-Guide

This repository provides a detailed lab guide for testing CVE-2017-0144 (EternalBlue) using Metasploit's ms17_010_eternalblue exploit. It includes step-by-step instructions for setting up a vulnerable Windows 7 environment, disabling firewalls, and executing the exploit to achieve remote code execution (RCE).

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows 7 SP1 x64 (unpatched SMBv1)
No auth needed
Prerequisites: Windows 7 SP1 x64 (unpatched) · Kali Linux with Metasploit · Host-Only network configuration · Disabled Windows Firewall
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WRITEUP
by Mitsu-bis · poc
https://github.com/Mitsu-bis/Eternal-Blue-CVE-2017-0144-THM-Write-Up

This repository contains a detailed technical writeup on exploiting CVE-2017-0144 (EternalBlue) using Nmap for reconnaissance, Metasploit for initial access and privilege escalation, and JohnTheRipper for credential access. It provides step-by-step instructions, tool configurations, and screenshots to demonstrate the exploitation process.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SMBv1
No auth needed
Prerequisites: Target with SMBv1 enabled · Network access to port 445 · Metasploit framework · JohnTheRipper
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by AbbeAlthany · poc
https://github.com/AbbeAlthany/Windows-7_och_CVE-2017-0144_Exploit

This repository provides a detailed step-by-step guide on exploiting CVE-2017-0144 (EternalBlue) using Metasploit, including environment setup, target identification, and execution. It does not contain direct exploit code but offers a comprehensive walkthrough of the process.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows 7 SP1 x64 (SMBv1)
No auth needed
Prerequisites: Metasploit Framework · Vulnerable Windows 7 target · Network connectivity to target
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by FireTemple · poc
https://github.com/FireTemple/Blackash-CVE-2017-0144

This repository provides a detailed technical analysis of CVE-2017-0144 (EternalBlue), including exploit flow, memory corruption mechanics, and historical context. It does not contain functional exploit code but offers in-depth research on the vulnerability.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows SMBv1
No auth needed
Prerequisites: SMBv1 enabled · Port 445/TCP open · Unpatched system (pre-MS17-010)
devstral-2 · analyzed Feb 19, 2026 Full analysis →
github WRITEUP
by OscarYR · poc
https://github.com/OscarYR/CVE_Reproduction/tree/main/EternalBlue/CVE-2017-0144.md

This repository provides a detailed technical analysis of CVE-2017-0144 (EternalBlue), including root cause analysis, patch details, and exploitation steps using Metasploit. It does not contain functional exploit code but offers in-depth explanations of the vulnerability mechanics.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows (XP, Vista, 7, 8, 8.1, 10 prior to MS17-010; Windows Server 2003, 2008, 2012, 2016)
No auth needed
Prerequisites: SMBv1 enabled on target · Unpatched Windows system (pre-MS17-010)
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WRITEUP
by luckyman2907 · poc
https://github.com/luckyman2907/SMB-Protocol-Vulnerability_CVE-2017-0144

This repository provides a detailed technical walkthrough of exploiting CVE-2017-0144 (EternalBlue) using Metasploit. It includes step-by-step instructions for setting up the environment, executing the exploit, and mitigating the vulnerability.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (Windows 7 64-bit)
No auth needed
Prerequisites: Kali Linux with Metasploit · Windows 7 64-bit (unpatched) · Network connectivity to target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by pelagornisandersi · poc
https://github.com/pelagornisandersi/WIndows-7-automated-exploitation-using-metasploit-framework-

This script automates the exploitation of CVE-2017-0144 (EternalBlue) by scanning for vulnerable SMB services on port 445, generating a Metasploit resource script, and executing the exploit to achieve remote code execution. It uses Nmap for vulnerability detection and Metasploit for exploitation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (Windows 7, Server 2008, etc.)
No auth needed
Prerequisites: Target with SMBv1 enabled and vulnerable to MS17-010 · Network access to port 445 · Metasploit Framework installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by denuwanjayasekara · poc
https://github.com/denuwanjayasekara/CVE-Exploitation-Reports

This repository contains detailed exploitation reports for CVE-2019-0708 (BlueKeep), a critical RCE vulnerability in Microsoft's Remote Desktop Services. It includes in-depth analysis, reproduction steps, and mitigation strategies, but no actual exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Microsoft Remote Desktop Services (RDS)
No auth needed
Prerequisites: Network access to vulnerable RDS service · Suitable exploit payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SUSPICIOUS
by AnugiArrawwala · poc
https://github.com/AnugiArrawwala/CVE-Research

The repository contains no exploit code or technical details, only a link to a TryHackMe room and a video. This appears to be a social engineering lure rather than a legitimate PoC.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by ducanh2oo3 · poc
https://github.com/ducanh2oo3/Vulnerability-Research-CVE-2017-0144

This repository provides a detailed technical walkthrough of exploiting CVE-2017-0144 (EternalBlue) using Metasploit, including setup, execution steps, and mitigation strategies. It does not contain actual exploit code but offers a comprehensive guide on the vulnerability.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (Windows 7 64-bit)
No auth needed
Prerequisites: Kali Linux (attacker) · Windows 7 (victim) · Metasploit Framework · Disabled Firewall on victim
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER
by quynhold · poc
https://github.com/quynhold/Detect-CVE-2017-0144-attack

This repository contains a Python script that monitors network traffic in real-time to detect EternalBlue (CVE-2017-0144) exploitation attempts by analyzing SMB packets for specific signatures (e.g., '0xc000000d'). It logs detected attacks to a file and console but does not include exploit code.

Classification
Scanner 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (EternalBlue vulnerability)
No auth needed
Prerequisites: Network access to monitor SMB traffic · Python with pyshark library
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit SCANNER
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/spec/lib/msf/core/mcp/tools/vulnerability_info_spec.rb

This is a Metasploit Framework test suite for vulnerability information retrieval, specifically testing the MCP (Metasploit Console Protocol) tool for querying vulnerability data, including CVE-2017-0144 (EternalBlue). It does not contain exploit code but validates the functionality of vulnerability scanning and data handling.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Metasploit Framework (MCP Tool)
Auth required
Prerequisites: Access to Metasploit Framework · Valid workspace configuration
devstral-2 · analyzed May 01, 2026 Full analysis →
metasploit WRITEUP
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/spec/lib/msf/core/mcp/metasploit/response_transformer_spec.rb

This is a Metasploit Framework test suite for response transformation logic, specifically for CVE-2017-0144 (EternalBlue). It validates data structures and transformations for module metadata, host information, and service details but does not contain exploit code.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Metasploit Framework
No auth needed
Prerequisites: Metasploit Framework installation
devstral-2 · analyzed May 01, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/spec/integration/msfmcpd/tool_execution_module_info_spec.rb

This is a Metasploit module test suite for the EternalBlue exploit (CVE-2017-0144), which demonstrates the module info retrieval functionality. It includes mock HTTP interactions with the Metasploit RPC API to fetch and validate module metadata.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (MS17-010)
Auth required
Prerequisites: Metasploit Framework · Authenticated RPC API access
devstral-2 · analyzed May 01, 2026 Full analysis →
metasploit WORKING POC GREAT
by Equation Group, Shadow Brokers, zerosum0x0, Luke Jennings, wvu, Jacob Robles · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_doublepulsar_rce.rb

This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems compromised by ETERNALBLUE. It includes functionality to detect the implant, execute payloads, and neutralize the implant.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (DOUBLEPULSAR implant)
No auth needed
Prerequisites: Target system must be infected with DOUBLEPULSAR implant · SMB access to the target
devstral-2 · analyzed Apr 24, 2026 Full analysis →
metasploit SCANNER
by Sean Dillon <[email protected]>, Luke Jennings · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb

This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0144) by probing the SMB service for a specific response indicating unpatched systems. It also checks for existing DoublePulsar infections but does not include exploit code for remote code execution.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMB Server (unpatched versions affected by MS17-010)
No auth needed
Prerequisites: Network access to the target's SMB service (port 445)
devstral-2 · analyzed Feb 20, 2026 Full analysis →
exploitdb WORKING POC
rubyremotewindows
https://www.exploit-db.com/exploits/47456

This Metasploit module exploits the DOUBLEPULSAR implant (CVE-2017-0144) to execute payloads or neutralize the implant on vulnerable SMB servers. It leverages the ETERNALBLUE exploit chain to interact with the implant, supporting both code execution and implant neutralization.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMB (DOUBLEPULSAR implant)
No auth needed
Prerequisites: Vulnerable SMB service exposed · DOUBLEPULSAR implant present on target
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (13)

Core 13
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42031/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42030/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41891/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037991
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41987/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96704
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html

Scores

CVSS v3 8.8
EPSS 0.9432
EPSS Percentile 100.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-02-10
VulnCheck KEV 2016-04-22
InTheWild.io 2017-03-14
ENISA EUVD EUVD-2017-0511
Ransomware Use Confirmed
Status published
Products (17)
microsoft/server_message_block 1.0
Microsoft Corporation/Windows SMB The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1
siemens/acuson_p300_firmware 13.02
siemens/acuson_p300_firmware 13.03
siemens/acuson_p300_firmware 13.20
siemens/acuson_p300_firmware 13.21
siemens/acuson_p500_firmware va10
siemens/acuson_p500_firmware vb10
siemens/acuson_sc2000_firmware 5.0a
siemens/acuson_sc2000_firmware 4.0 - 4.0e
... and 7 more
Published Mar 17, 2017
KEV Added Feb 10, 2022
Tracked Since Feb 18, 2026