CVE-2017-0148
HIGH KEV RANSOMWAREMicrosoft Windows SMBv1 - Remote Code Execution via Crafted Packets
Title source: llmExploitation Summary
CVE-2017-0148 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 6, 2022, with confirmed use in ransomware campaigns.
EIP tracks 6 public exploits from researchers including Metasploit, Sean Dillon, Juan Sacco, including a Metasploit module exploits/windows/smb/smb_doublepulsar_rce.
AI-analyzed exploit summary This Metasploit module exploits the DOUBLEPULSAR implant (CVE-2017-0148) to execute payloads or neutralize the implant on vulnerable SMB servers. It leverages the ETERNALBLUE exploit chain to achieve remote code execution on Windows systems.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
Exploits (6)
This Metasploit module exploits the DOUBLEPULSAR implant (CVE-2017-0148) to execute payloads or neutralize the implant on vulnerable SMB servers. It leverages the ETERNALBLUE exploit chain to achieve remote code execution on Windows systems.
This Metasploit module scans for the MS17-010 vulnerability (CVE-2017-0147) by checking the SMB response status for FID 0. It does not exploit the vulnerability but detects its presence.
This is a Python-based exploit for CVE-2017-0148 (MS17-010), targeting a buffer overflow in the SMBv1 protocol. It leverages a crafted SMB packet to achieve remote code execution on vulnerable Windows systems.
The repository contains a Ruby script for the Metasploit Framework that scans for the MS17-010 (EternalBlue) vulnerability by checking the SMB response status. It does not include exploit code but detects vulnerability via STATUS_INSUFF_SERVER_RESOURCES.
This Metasploit module exploits the DOUBLEPULSAR implant for SMB, allowing remote code execution on systems already compromised by the implant. It includes functionality to detect the implant, execute payloads, and neutralize the implant.
This Metasploit module detects the presence of the MS17-010 vulnerability (CVE-2017-0148) by probing the SMB service for a specific response indicating the absence of the patch. It also checks for DoublePulsar infections on vulnerable hosts.
References (11)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H