Windows SMBv1 Remote Code Execution Vulnerability

This repository is a small lab/demo project built around a Metasploit exploit module and a harmless ransomware-themed batch script. Because it is part of the Metasploit framework, the main exploit file is ms17_010_eternalblue.rb, a Ruby Metasploit module implementing the EternalBlue SMB exploit against vulnerable Microsoft Windows SMBv1 targets. The module is clearly a real exploit, not just a detector: it performs SMB protocol interaction over TCP/445, supports anonymous or credentialed SMB authentication, uses the auxiliary/scanner/smb/smb_ms17_010 check module, and is designed to achieve remote kernel memory corruption leading to arbitrary code execution. The module metadata indicates support for multiple Windows versions including Windows 7, Windows Embedded Standard 7, Server 2008 R2, Windows 8/8.1, Server 2012, and some Windows 10 Pro builds, and references the MS17-010 vulnerability set (CVE-2017-0143 through CVE-2017-0148). In practical use, the README demonstrates pairing it with a windows/x64/meterpreter/reverse_tcp payload to obtain a SYSTEM-level Meterpreter session. Repository structure is simple: README.md documents a university lab exercise, exploitation workflow, post-exploitation commands, and mitigation via KB4012212; ms17_010_eternalblue.rb is the actual exploit module; wannacry64.bat is a separate Windows batch file that only simulates a WannaCry-style ransom screen. The batch file contains no encryption, persistence, propagation, or destructive logic; it displays a countdown, fake progress bar, sample filenames, and a hardcoded Bitcoin address as part of the visual demo. Overall, the repository’s purpose is educational: demonstrate exploitation of MS17-010 in an isolated lab, show post-exploitation access, and then illustrate a safe ransomware-themed payload simulation plus patch-based mitigation.

This repository provides a Python-based exploit for the MS17-010 vulnerability (CVE-2017-0143), also known as EternalRomance/EternalSynergy, targeting Microsoft Windows systems via the SMB protocol (port 445). The exploit consists of several files: 'send_and_execute.py' (main exploit script), 'checker.py' (vulnerability and named pipe checker), 'mysmb.py' (SMB protocol extensions for exploitation), and a README.md with detailed usage instructions. The exploit allows an attacker to upload and execute an arbitrary payload (such as a reverse shell) on a vulnerable Windows machine by exploiting the SMB service. The attacker must provide a payload executable (e.g., generated with msfvenom) and can use the included scripts to check for vulnerability and execute the attack. The exploit supports a wide range of Windows versions (from Windows 2000 up to Windows 10/2016) and leverages named pipes (e.g., browser, spoolss, netlogon, lsarpc, samr) for exploitation. The repository is operational and provides all necessary components for successful exploitation, assuming the target is vulnerable and accessible over the network.

This repository contains a Python3 exploit for MS17-010 (CVE-2017-0143), a critical vulnerability in Microsoft Windows SMBv1. The main file, 'exploit.py', implements the exploit logic, targeting a wide range of Windows versions from Windows 2000 through Windows 10 and Windows Server 2016. The exploit leverages the same bug as the NSA's 'EternalRomance' and 'EternalSynergy' exploits, manipulating SMB transactions and session security contexts to achieve remote code execution as SYSTEM. The exploit is highly reliable on Windows 7 and later, with additional logic to minimize the risk of crashing the target. The 'mysmb.py' file provides SMB protocol extensions and helper classes, including a minimal SMB server for post-exploitation. The exploit requires network access to the target's SMB service (typically on TCP port 445 or 139) and can provide a remote shell upon success. The repository is operational and suitable for real-world exploitation of unpatched systems.

This repository contains a single Metasploit module: 'ms17_010_psexec.rb', which weaponizes the MS17-010 vulnerabilities (EternalRomance, EternalSynergy, EternalChampion) to achieve remote code execution on vulnerable Windows systems via SMB. The exploit leverages a write-what-where primitive to escalate privileges and then executes a payload using various methods (PowerShell, native executable upload, or MOF upload). The module is highly configurable, allowing the attacker to specify the target share, payload type, and advanced options such as service filename and PowerShell path. The exploit is operational and weaponized, supporting customizable payloads and reliable exploitation. The main attack vector is network-based, targeting SMB services on Windows systems. Notable fingerprintable endpoints include the default ADMIN$ share and the PowerShell executable path. The module is part of the Metasploit framework and is intended for use by penetration testers and red teamers to test for and exploit MS17-010 vulnerabilities.

This repository contains a single Metasploit auxiliary module (ms17_010_command.rb) that exploits the MS17-010 vulnerabilities (EternalRomance, EternalSynergy, EternalChampion) in the SMB protocol on Windows systems. The module leverages a write-what-where primitive to escalate privileges to Administrator and then executes arbitrary commands on the target via SMB, using the psexec technique. The exploit requires a writable SMB share (default 'C$'), valid credentials, and access to the SMB service (default port 445). The module is operational and allows the user to specify any command to execute on the remote host, with output returned to the attacker. The code is written in Ruby and is designed to be used within the Metasploit framework. No hardcoded IPs or domains are present, but the exploit targets Windows systems accessible over the network via SMB.

This repository contains a single Metasploit module implementing the 'EternalBlue' exploit (MS17-010) targeting the SMBv1 service on various versions of Microsoft Windows. The exploit leverages a buffer overflow vulnerability in the Windows SMB kernel driver, allowing remote code execution as SYSTEM. The module is highly weaponized, supporting customizable payloads and targeting a wide range of Windows operating systems (Windows 7, 8, 8.1, 10 Pro, Server 2008 R2, Server 2012, and Embedded Standard 7). The exploit operates over the network, requiring access to TCP port 445 on the target. The code is written in Ruby and is designed to be used within the Metasploit framework, providing a user-friendly interface for payload selection and exploitation. No hardcoded IPs or domains are present; the target is specified by the user at runtime. The module also supports both anonymous and credentialed SMB sessions, increasing its flexibility and effectiveness.

This repository contains a single Metasploit module: 'SMB DOUBLEPULSAR Remote Code Execution' (smb_doublepulsar_rce.rb). The module targets Windows systems that have been compromised with the DOUBLEPULSAR SMB implant, which is often deployed via the ETERNALBLUE exploit (MS17-010). The exploit allows an attacker to execute arbitrary Metasploit payloads (such as Meterpreter reverse shells) on the infected system by communicating with the DOUBLEPULSAR backdoor over SMB (port 445). The module also provides an option to neutralize (disable) the implant. The main endpoints involved are the SMB IPC$ share on the target and the process (default: spoolsv.exe) into which the payload is injected. The code is written in Ruby and is fully integrated into the Metasploit framework, making it a weaponized and highly customizable exploit. The module references multiple CVEs related to MS17-010 and is suitable for post-exploitation scenarios where DOUBLEPULSAR is already present on the target.