Windows SMB Information Disclosure Vulnerability

This repository is a small lab/demo project built around a Metasploit exploit module and a harmless ransomware-themed batch script. Because it is part of the Metasploit framework, the main exploit file is ms17_010_eternalblue.rb, a Ruby Metasploit module implementing the EternalBlue SMB exploit against vulnerable Microsoft Windows SMBv1 targets. The module is clearly a real exploit, not just a detector: it performs SMB protocol interaction over TCP/445, supports anonymous or credentialed SMB authentication, uses the auxiliary/scanner/smb/smb_ms17_010 check module, and is designed to achieve remote kernel memory corruption leading to arbitrary code execution. The module metadata indicates support for multiple Windows versions including Windows 7, Windows Embedded Standard 7, Server 2008 R2, Windows 8/8.1, Server 2012, and some Windows 10 Pro builds, and references the MS17-010 vulnerability set (CVE-2017-0143 through CVE-2017-0148). In practical use, the README demonstrates pairing it with a windows/x64/meterpreter/reverse_tcp payload to obtain a SYSTEM-level Meterpreter session. Repository structure is simple: README.md documents a university lab exercise, exploitation workflow, post-exploitation commands, and mitigation via KB4012212; ms17_010_eternalblue.rb is the actual exploit module; wannacry64.bat is a separate Windows batch file that only simulates a WannaCry-style ransom screen. The batch file contains no encryption, persistence, propagation, or destructive logic; it displays a countdown, fake progress bar, sample filenames, and a hardcoded Bitcoin address as part of the visual demo. Overall, the repository’s purpose is educational: demonstrate exploitation of MS17-010 in an isolated lab, show post-exploitation access, and then illustrate a safe ransomware-themed payload simulation plus patch-based mitigation.

This repository contains a single Metasploit auxiliary module (ms17_010_command.rb) that exploits the MS17-010 vulnerabilities (EternalRomance, EternalSynergy, EternalChampion) in the SMB protocol on Windows systems. The module leverages a write-what-where primitive to escalate privileges to Administrator and then executes arbitrary commands on the target via SMB, using the psexec technique. The exploit requires a writable SMB share (default 'C$'), valid credentials, and access to the SMB service (default port 445). The module is operational and allows the user to specify any command to execute on the remote host, with output returned to the attacker. The code is written in Ruby and is designed to be used within the Metasploit framework. No hardcoded IPs or domains are present, but the exploit targets Windows systems accessible over the network via SMB.

This repository contains a single Metasploit module: 'ms17_010_psexec.rb', which weaponizes the MS17-010 vulnerabilities (EternalRomance, EternalSynergy, EternalChampion) to achieve remote code execution on vulnerable Windows systems via SMB. The exploit leverages a write-what-where primitive to escalate privileges and then executes a payload using various methods (PowerShell, native executable upload, or MOF upload). The module is highly configurable, allowing the attacker to specify the target share, payload type, and advanced options such as service filename and PowerShell path. The exploit is operational and weaponized, supporting customizable payloads and reliable exploitation. The main attack vector is network-based, targeting SMB services on Windows systems. Notable fingerprintable endpoints include the default ADMIN$ share and the PowerShell executable path. The module is part of the Metasploit framework and is intended for use by penetration testers and red teamers to test for and exploit MS17-010 vulnerabilities.

This repository contains a single Metasploit module implementing the 'EternalBlue' exploit (MS17-010) targeting the SMBv1 service on various versions of Microsoft Windows. The exploit leverages a buffer overflow vulnerability in the Windows SMB kernel driver, allowing remote code execution as SYSTEM. The module is highly weaponized, supporting customizable payloads and targeting a wide range of Windows operating systems (Windows 7, 8, 8.1, 10 Pro, Server 2008 R2, Server 2012, and Embedded Standard 7). The exploit operates over the network, requiring access to TCP port 445 on the target. The code is written in Ruby and is designed to be used within the Metasploit framework, providing a user-friendly interface for payload selection and exploitation. No hardcoded IPs or domains are present; the target is specified by the user at runtime. The module also supports both anonymous and credentialed SMB sessions, increasing its flexibility and effectiveness.

This repository contains a single Metasploit module: 'SMB DOUBLEPULSAR Remote Code Execution' (smb_doublepulsar_rce.rb). The module targets Windows systems that have been compromised with the DOUBLEPULSAR SMB implant, which is often deployed via the ETERNALBLUE exploit (MS17-010). The exploit allows an attacker to execute arbitrary Metasploit payloads (such as Meterpreter reverse shells) on the infected system by communicating with the DOUBLEPULSAR backdoor over SMB (port 445). The module also provides an option to neutralize (disable) the implant. The main endpoints involved are the SMB IPC$ share on the target and the process (default: spoolsv.exe) into which the payload is injected. The code is written in Ruby and is fully integrated into the Metasploit framework, making it a weaponized and highly customizable exploit. The module references multiple CVEs related to MS17-010 and is suitable for post-exploitation scenarios where DOUBLEPULSAR is already present on the target.