CVE-2017-0146
HIGH KEV RANSOMWAREMicrosoft Windows SMBv1 - Remote Code Execution via Crafted Packets
Title source: llmExploitation Summary
CVE-2017-0146 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2022, with confirmed use in ransomware campaigns.
EIP tracks 6 public exploits from researchers including Metasploit, Sean Dillon, Juan Sacco, including a Metasploit module exploits/windows/smb/smb_doublepulsar_rce.
AI-analyzed exploit summary This Metasploit module exploits SMB vulnerabilities in MS17-010 (CVE-2017-0147) to achieve remote code execution on Windows systems. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec, PowerShell, or native upload methods.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.
Exploits (6)
This Metasploit module exploits SMB vulnerabilities in MS17-010 (CVE-2017-0147) to achieve remote code execution on Windows systems. It leverages a write-what-where primitive to overwrite session information and execute payloads via psexec, PowerShell, or native upload methods.
This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.
This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.
This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems compromised by ETERNALBLUE. It includes functionality to detect, execute payloads, and neutralize the implant.
This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0146) by probing SMB responses and checking for DoublePulsar infections. It does not exploit the vulnerability but scans for it by analyzing SMB transaction responses.
This Metasploit module exploits the DOUBLEPULSAR implant (CVE-2017-0146) to execute payloads or neutralize the implant via SMB. It includes detection, payload execution, and implant neutralization capabilities.
References (12)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H