CVE-2017-0145

HIGH KEV RANSOMWARE

Microsoft Windows SMBv1 - Remote Code Execution via Crafted Packets

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-0145 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2022, with confirmed use in ransomware campaigns. EIP tracks 6 public exploits from researchers including Sean Dillon, Juan Sacco, MelonSmasher, including a Metasploit module exploits/windows/smb/smb_doublepulsar_rce.

AI-analyzed exploit summary This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.

Exploits (6)

exploitdb SCANNER VERIFIED
by Sean Dillon · rubydoswindows
https://www.exploit-db.com/exploits/41891

This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows SMB Server (unpatched versions)
No auth needed
Prerequisites: Network access to the target's SMB port (445/TCP)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Juan Sacco · pythonremotewindows_x86-64
https://www.exploit-db.com/exploits/41987

This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv1 (e.g., Windows Server 2008 R2 SP1)
No auth needed
Prerequisites: Network access to SMB port (445/TCP) · Target system with SMBv1 enabled and unpatched
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by MelonSmasher · poc
https://github.com/MelonSmasher/chef_tissues

This repository contains a Chef cookbook that automates the installation of Microsoft's patch for CVE-2017-0145 (EternalBlue/WannaCry vulnerability). It detects the Windows version and architecture, then downloads and installs the appropriate MSU patch from Microsoft's update servers.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Windows 7/8/8.1, Windows Server 2008 R2/2012/2012 R2
Auth required
Prerequisites: Administrative access to the target Windows system · Chef installed on the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC GREAT
by Equation Group, Shadow Brokers, zerosum0x0, Luke Jennings, wvu, Jacob Robles · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_doublepulsar_rce.rb

This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems compromised by ETERNALBLUE. It includes functionality to detect, execute payloads, and neutralize the implant.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (DOUBLEPULSAR implant)
No auth needed
Prerequisites: Target system must be infected with DOUBLEPULSAR implant · SMB access to the target
devstral-2 · analyzed Apr 24, 2026 Full analysis →
metasploit SCANNER
by Sean Dillon <[email protected]>, Luke Jennings · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb

This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0145) by probing the SMB service for a specific response indicating the patch is missing. It also checks for DoublePulsar infections and named pipes on vulnerable hosts.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMB Server (unpatched versions)
No auth needed
Prerequisites: Network access to the target's SMB service (port 445)
devstral-2 · analyzed Feb 20, 2026 Full analysis →
exploitdb WORKING POC
rubyremotewindows
https://www.exploit-db.com/exploits/47456

This Metasploit module exploits the DOUBLEPULSAR implant, which leverages the ETERNALBLUE vulnerability (CVE-2017-0145) to execute payloads or neutralize the implant on vulnerable Windows systems. It communicates via SMB to send crafted packets to the implant, enabling remote code execution or implant removal.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows SMB (DOUBLEPULSAR implant)
No auth needed
Prerequisites: Vulnerable SMB service exposed · DOUBLEPULSAR implant present
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (11)

Core 11
Core References
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96705
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41987/
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41891/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037991

Scores

CVSS v3 8.8
EPSS 0.9334
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-02-10
VulnCheck KEV 2017-03-14
InTheWild.io 2017-03-14
ENISA EUVD EUVD-2017-0512
Ransomware Use Confirmed
Status published
Products (17)
microsoft/server_message_block 1.0
Microsoft Corporation/Windows SMB The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1
siemens/acuson_p300_firmware 13.02
siemens/acuson_p300_firmware 13.03
siemens/acuson_p300_firmware 13.20
siemens/acuson_p300_firmware 13.21
siemens/acuson_p500_firmware va10
siemens/acuson_p500_firmware vb10
siemens/acuson_sc2000_firmware 5.0a
siemens/acuson_sc2000_firmware 4.0 - 4.0e
... and 7 more
Published Mar 17, 2017
KEV Added Feb 10, 2022
Tracked Since Feb 18, 2026