HighExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2017-0144

EternalBlue

Published Mar 17, 2017 · Updated 8 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS8.8High · v3.1

EPSS99.2%100th percentile

CISA KEVYesAdded Feb 10, 2022

In the wildActivePer CISA KEV

Vendors: SiemensMicrosoft Corporation

IdentifiersCVE-2017-0144CWE-20

Also known asms17_010ms17_010_(eternalblue)

CVE-2017-0144 is a remote code execution vulnerability in the Microsoft Windows SMBv1 server, exploited by EternalBlue. Improper handling of specially crafted SMBv1 requests allows an unauthenticated remote attacker to execute arbitrary code on an affected system without user interaction. Affected releases include Windows Vista SP2; Windows 7 SP1; Windows 8.1 and RT 8.1; Windows 10 initial release, 1511, and 1607; Windows Server 2008 SP2 and 2008 R2 SP1; Windows Server 2012 and 2012 R2; and Windows Server 2016, including applicable Server Core installations. Microsoft addressed the vulnerability in MS17-010 on March 14, 2017. Exploitation has enabled worm-like propagation and payload deployment by threats including WannaCry and NotPetya.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation permits unauthenticated remote code execution with elevated access, compromising system confidentiality, integrity, and availability. Attackers can deploy malware, access or modify data, and use compromised hosts to attack additional reachable systems. The vulnerability has supported large-scale ransomware and destructive-malware propagation, resulting in data encryption or loss, unavailable systems, and substantial operational disruption. Medical systems running affected Windows components may also experience disruption to clinical services.

Mitigation

If you can’t patch tonight, do this now.

Disable SMBv1 where feasible and use SMBv2 or SMBv3 after compatibility testing. Block Internet-facing SMB and restrict TCP ports 445 and 139 to necessary, trusted systems. Segment or isolate unpatchable hosts and prevent unnecessary workstation-to-workstation SMB access. Deploy IDS/IPS detection for EternalBlue exploitation and immediately isolate compromised systems. Maintain tested offline or immutable backups to limit downstream malware damage. For medical devices, assess clinical and patient-safety implications before disabling protocols or disconnecting equipment.

Remediation

Patch, then assume compromise.

Apply the operating-system-specific MS17-010 security update or a superseding cumulative update. Original updates include KB4012598 for Windows Vista SP2 and Server 2008 SP2; KB4012212 or KB4012215 for Windows 7 SP1 and Server 2008 R2 SP1; KB4012213 or KB4012216 for Windows 8.1 and Server 2012 R2; KB4012214 or KB4012217 for Server 2012; KB4012216 for Windows RT 8.1; KB4012606 for the initial Windows 10 release; KB4013198 for Windows 10 1511; and KB4013429 for Windows 10 1607 and Server 2016. For embedded medical systems, obtain and install vendor-approved product-specific fixes through the relevant support channel. Verify patch installation across affected assets.

Public exploits

Exploits

6 exploits validated by Mallory's analysis. Hidden: 28 rejected by Mallory's analysis as not a working exploit; 7 not yet analyzed, such as Exploit-DB entries.

View more in app →

ms17_010_eternalblue.rbThis repository contains a single Metasploit module implementing the 'EternalBlue' exploit (MS17-010) targeting the SMBv1 service on various versions of Microsoft Windows. The exploit leverages a buffer overflow vulnerability in the Windows SMB kernel driver, allowing remote code execution as SYSTEM. The module is highly weaponized, supporting customizable payloads and targeting a wide range of Windows operating systems (Windows 7, 8, 8.1, 10 Pro, Server 2008 R2, Server 2012, and Embedded Standard 7). The exploit operates over the network, requiring access to TCP port 445 on the target. The code is written in Ruby and is designed to be used within the Metasploit framework, providing a user-friendly interface for payload selection and exploitation. No hardcoded IPs or domains are present; the target is specified by the user at runtime. The module also supports both anonymous and credentialed SMB sessions, increasing its flexibility and effectiveness.Disclosed Mar 14, 2017 · Framework: metasploit · ruby · networkWeaponized smb_doublepulsar_rce.rbThis repository contains a single Metasploit module: 'SMB DOUBLEPULSAR Remote Code Execution' (smb_doublepulsar_rce.rb). The module targets Windows systems that have been compromised with the DOUBLEPULSAR SMB implant, which is often deployed via the ETERNALBLUE exploit (MS17-010). The exploit allows an attacker to execute arbitrary Metasploit payloads (such as Meterpreter reverse shells) on the infected system by communicating with the DOUBLEPULSAR backdoor over SMB (port 445). The module also provides an option to neutralize (disable) the implant. The main endpoints involved are the SMB IPC$ share on the target and the process (default: spoolsv.exe) into which the payload is injected. The code is written in Ruby and is fully integrated into the Metasploit framework, making it a weaponized and highly customizable exploit. The module references multiple CVEs related to MS17-010 and is suitable for post-exploitation scenarios where DOUBLEPULSAR is already present on the target.Disclosed Apr 14, 2017 · Framework: metasploit · ruby · networkWeaponized EternalBlue-Exploit-DemonstrationThis repository is a small lab/demo project built around a Metasploit exploit module and a harmless ransomware-themed batch script. Because it is part of the Metasploit framework, the main exploit file is ms17_010_eternalblue.rb, a Ruby Metasploit module implementing the EternalBlue SMB exploit against vulnerable Microsoft Windows SMBv1 targets. The module is clearly a real exploit, not just a detector: it performs SMB protocol interaction over TCP/445, supports anonymous or credentialed SMB authentication, uses the auxiliary/scanner/smb/smb_ms17_010 check module, and is designed to achieve remote kernel memory corruption leading to arbitrary code execution. The module metadata indicates support for multiple Windows versions including Windows 7, Windows Embedded Standard 7, Server 2008 R2, Windows 8/8.1, Server 2012, and some Windows 10 Pro builds, and references the MS17-010 vulnerability set (CVE-2017-0143 through CVE-2017-0148). In practical use, the README demonstrates pairing it with a windows/x64/meterpreter/reverse_tcp payload to obtain a SYSTEM-level Meterpreter session. Repository structure is simple: README.md documents a university lab exercise, exploitation workflow, post-exploitation commands, and mitigation via KB4012212; ms17_010_eternalblue.rb is the actual exploit module; wannacry64.bat is a separate Windows batch file that only simulates a WannaCry-style ransom screen. The batch file contains no encryption, persistence, propagation, or destructive logic; it displays a countdown, fake progress bar, sample filenames, and a hardcoded Bitcoin address as part of the visual demo. Overall, the repository’s purpose is educational: demonstrate exploitation of MS17-010 in an isolated lab, show post-exploitation access, and then illustrate a safe ransomware-themed payload simulation plus patch-based mitigation.dannic145 · Disclosed Apr 22, 2026 · Framework: metasploit · markdown · ruby · network · fileWeaponized eternalblueThis repository contains three Python scripts related to the exploitation of the MS17-010 (EternalBlue) vulnerability (CVE-2017-0144) in Microsoft Windows SMBv1. The files are: 1. eternalblue_scanner.py: A scanner script that checks if a given IP address is vulnerable to MS17-010 or infected with the DoublePulsar backdoor. It crafts and sends SMB packets to the target's TCP port 445 and analyzes the responses to determine vulnerability status. 2. windows7-windows2008R2-x64.py: An exploit script targeting Windows 7 SP1 x64 and Windows 2008 R2 x64 systems. It leverages the EternalBlue vulnerability to achieve remote code execution by sending specially crafted SMB packets and injecting user-supplied shellcode into the target's memory. The script requires the attacker to provide a shellcode file and the target IP address. 3. windows8-windows2012R2-x64.py: An exploit script for Windows 8.1 x64 and Windows 2012 R2 x64 systems. It uses a similar technique as the previous script but includes additional steps to bypass security features (such as disabling the NX bit) present in newer Windows versions. It also requires a shellcode file and the target IP address. All scripts are written in Python and require network access to the target's SMB service (TCP port 445). The exploit scripts are operational and allow the attacker to execute arbitrary code on vulnerable systems. The repository does not belong to a known exploit framework and is standalone. No hardcoded IP addresses or domains are present; the target is specified at runtime.kimocoder · Disclosed Jun 2, 2019 · python · networkOperational autoblueThe repository 'autoblue' is an automated exploit tool targeting the EternalBlue vulnerability (CVE-2017-0144) in Microsoft Windows systems. The main script, 'autoblue.sh', is a Bash script that automates the process of scanning a target IP for the MS17-010 vulnerability using Nmap and, if found vulnerable, launches the Metasploit Framework's EternalBlue exploit module. The script prompts the user for both the target and attacker's IP addresses, scans the target's port 445 for SMBv1 vulnerabilities, and, upon confirmation, executes Metasploit with a pre-configured payload (windows/x64/meterpreter/reverse_tcp) to obtain a reverse shell on the target. The script logs its actions to 'autoblue.log' and uses 'nmap_scan.log' for scan results. The repository includes a README with detailed usage instructions, prerequisites, and security considerations. The exploit is operational, automating both detection and exploitation, and is intended for use in authorized penetration testing or educational environments.AtithKhawas · Disclosed Dec 30, 2024 · bash · networkOperational BlueDoorThis repository is a Capture The Flag (CTF) challenge simulating exploitation of the EternalBlue vulnerability (CVE-2017-0144) on Windows 7. The structure includes a web-based flag submission site (Flag-site/), detailed documentation (README.md, deployment.md, writeup.md), and a set of exploit modules (exploit-modules/) derived from public research on MS17-010. The main exploit code is in Python (eternalromance_poc2.py), demonstrating the EternalRomance technique for arbitrary read/write via SMB, and is supported by custom kernel shellcode in assembly (eternalblue_kshellcode_x64.asm) and a script for merging shellcode for different architectures (eternalblue_sc_merge.py). The exploit achieves remote code execution as SYSTEM, allowing the attacker to retrieve the flag from C:\Windows\System32\flag.txt. The repository is not a framework but provides a working proof-of-concept exploit and all necessary resources to reproduce the attack in a controlled environment. The challenge is well-documented, with clear setup and exploitation instructions, and is suitable for educational and research purposes.sethwhy · Disclosed Dec 21, 2024 · python · assembly · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationServer Message Blockapplication

SiemensAcuson P300 Firmwareoperating_system

SiemensAcuson P500 Firmwareoperating_system

SiemensAcuson Sc2000 Firmwareoperating_system

SiemensAcuson X700 Firmwareoperating_system

SiemensSyngo Sc2000 Firmwareoperating_system

SiemensTissue Preparation System Firmwareoperating_system

SiemensVersant Kpcr Molecular System Firmwareoperating_system

SiemensVersant Kpcr Sample Prep Firmwareoperating_system

External references

References

MITRE CVEcve.org · CVE-2017-0144 NVDnvd.nist.gov/vuln/detail/CVE-2017-0144 MITRE CWE · CWE-20cwe.mitre.org Patchportal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 Third Party Advisorypacketstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html Third Party Advisorypacketstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html Third Party Advisorycert-portal.siemens.com/productcert/pdf/ssa-701903.pdf Third Party Advisorycert-portal.siemens.com/productcert/pdf/ssa-966341.pdf Third Party Advisoryics-cert.us-cert.gov/advisories/ICSMA-18-058-02 Third Party Advisoryexploit-db.com/exploits/41891 Third Party Advisoryexploit-db.com/exploits/41987 Third Party Advisoryexploit-db.com/exploits/42030 +2 more referencesview more in app

Activity feed

Recent activity

71 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

codebyNews · Sep 6, 2026Сканирование внешнего периметра: связка Nmap и OSINTВысокоопасная SMBv1 уязвимость, известная как EternalBlue; проверяется Nmap-скриптом smb-vuln-ms17-010 и, согласно тексту, продолжает обнаруживаться на внешних периметрах, где SMBv1 не отключён.Read more ↗malware newsNews · Jul 30, 2026WannaCry Ransomware | The Complete Guide to the 2017 Cyberattack That Shook the World - Malware News - Malware Analysis, News and IndicatorsA remote code execution vulnerability in Microsoft Windows SMBv1 that enabled WannaCry’s worm-like propagation across unpatched systems.Read more ↗securelistNews · May 21, 2026PipeMagic in 2025: How the backdoor operators’ tactics have changed | SecurelistA vulnerability used for initial penetration in the 2022 PipeMagic/RansomExx-related campaign against industrial companies in Southeast Asia.Read more ↗security affairsNews · May 12, 2026WannaCry, the ransomware attack that changed the history of cybersecurityA remote code execution vulnerability in Microsoft Windows SMBv1 that allowed unauthenticated exploitation and was used by WannaCry for worm-like propagation.Read more ↗

+52 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence61Every report linking this CVE to a named adversary.

Associated malware410Malware families linked to this CVE, with evidence and IOCs.

Detection signatures12YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity10Community discussion across Reddit, Mastodon, and other social sources.