SMBv1 Remote Code Execution in Microsoft Windows (MS17-010)

This repository is a small lab/demo project built around a Metasploit exploit module and a harmless ransomware-themed batch script. Because it is part of the Metasploit framework, the main exploit file is ms17_010_eternalblue.rb, a Ruby Metasploit module implementing the EternalBlue SMB exploit against vulnerable Microsoft Windows SMBv1 targets. The module is clearly a real exploit, not just a detector: it performs SMB protocol interaction over TCP/445, supports anonymous or credentialed SMB authentication, uses the auxiliary/scanner/smb/smb_ms17_010 check module, and is designed to achieve remote kernel memory corruption leading to arbitrary code execution. The module metadata indicates support for multiple Windows versions including Windows 7, Windows Embedded Standard 7, Server 2008 R2, Windows 8/8.1, Server 2012, and some Windows 10 Pro builds, and references the MS17-010 vulnerability set (CVE-2017-0143 through CVE-2017-0148). In practical use, the README demonstrates pairing it with a windows/x64/meterpreter/reverse_tcp payload to obtain a SYSTEM-level Meterpreter session. Repository structure is simple: README.md documents a university lab exercise, exploitation workflow, post-exploitation commands, and mitigation via KB4012212; ms17_010_eternalblue.rb is the actual exploit module; wannacry64.bat is a separate Windows batch file that only simulates a WannaCry-style ransom screen. The batch file contains no encryption, persistence, propagation, or destructive logic; it displays a countdown, fake progress bar, sample filenames, and a hardcoded Bitcoin address as part of the visual demo. Overall, the repository’s purpose is educational: demonstrate exploitation of MS17-010 in an isolated lab, show post-exploitation access, and then illustrate a safe ransomware-themed payload simulation plus patch-based mitigation.

This repository contains a single Metasploit module implementing the 'EternalBlue' exploit (MS17-010) targeting the SMBv1 service on various versions of Microsoft Windows. The exploit leverages a buffer overflow vulnerability in the Windows SMB kernel driver, allowing remote code execution as SYSTEM. The module is highly weaponized, supporting customizable payloads and targeting a wide range of Windows operating systems (Windows 7, 8, 8.1, 10 Pro, Server 2008 R2, Server 2012, and Embedded Standard 7). The exploit operates over the network, requiring access to TCP port 445 on the target. The code is written in Ruby and is designed to be used within the Metasploit framework, providing a user-friendly interface for payload selection and exploitation. No hardcoded IPs or domains are present; the target is specified by the user at runtime. The module also supports both anonymous and credentialed SMB sessions, increasing its flexibility and effectiveness.

This repository contains a single Metasploit module: 'SMB DOUBLEPULSAR Remote Code Execution' (smb_doublepulsar_rce.rb). The module targets Windows systems that have been compromised with the DOUBLEPULSAR SMB implant, which is often deployed via the ETERNALBLUE exploit (MS17-010). The exploit allows an attacker to execute arbitrary Metasploit payloads (such as Meterpreter reverse shells) on the infected system by communicating with the DOUBLEPULSAR backdoor over SMB (port 445). The module also provides an option to neutralize (disable) the implant. The main endpoints involved are the SMB IPC$ share on the target and the process (default: spoolsv.exe) into which the payload is injected. The code is written in Ruby and is fully integrated into the Metasploit framework, making it a weaponized and highly customizable exploit. The module references multiple CVEs related to MS17-010 and is suitable for post-exploitation scenarios where DOUBLEPULSAR is already present on the target.