Skip to content

Lab scope: This documentation is intended for an isolated cybersecurity lab using intentionally vulnerable Windows systems. Do not test MS17-010 or any exploit against systems you do not own or have explicit authorization to assess.

Overview

MS17-010 is a Microsoft security bulletin covering multiple vulnerabilities in the Windows SMBv1 implementation.

One of the most well-known vulnerabilities associated with MS17-010 is EternalBlue, a remote code execution vulnerability identified as CVE-2017-0144.

The vulnerability became widely known after the Shadow Brokers leaked the exploit in 2017. It was subsequently associated with major malware outbreaks, including WannaCry.

Why MS17-010 is important

A vulnerable SMB service can potentially allow a remote attacker to execute code without first having valid credentials.

The attack surface is primarily:

Attacker
   |
   | TCP/445
   v
+----------------------+
| Windows SMBv1 Server |
|     MS17-010         |
+----------------------+
          |
          v
   Remote Code Execution

This is particularly dangerous because SMB is commonly used for file and printer sharing and may be exposed across internal networks.

Affected Systems

Historically affected Windows versions included systems such as:

  • Windows Vista

  • Windows 7

  • Windows Server 2008 / 2008 R2

  • Windows 8.1

  • Windows Server 2012

  • Windows 10

  • Windows Server 2016

The exact affected editions depend on the specific MS17-010 vulnerability and Microsoft security update.

Microsoft released security updates for MS17-010 in March 2017.

Lab Environment

A simple isolated environment can be structured as:

+-----------------------+
| Kali Linux            |
| Penetration Testing   |
|                       |
| 10.10.10.10           |
+-----------+-----------+
            |
            | Isolated Lab Network
            |
+-----------v-----------+
| Windows Server 2008 R2|
| Vulnerable Lab Target |
|                       |
| 10.10.10.12           |
| SMB TCP/445            |
+-----------------------+

Example configuration

System Role Example IP
Kali Linux Security testing system 10.10.10.10
Windows Server 2008 R2 Vulnerable target 10.10.10.12

Use a Host-Only or otherwise isolated virtual network for this type of lab.

Step 1 — Identify SMB

The first step is to determine whether SMB is exposed on the target.

Example:

nmap -sV -p 445 10.10.10.12

Example result:

PORT    STATE SERVICE      VERSION
445/tcp open  microsoft-ds Microsoft Windows Server 2008 R2

Explanation

-sV

Attempts to identify the service and version.

-p 445

Restricts the scan to TCP port 445.

Port 445/TCP is commonly used for direct-hosted SMB.

Step 2 — Check for MS17-010

Nmap provides an NSE script that can check whether the SMB service appears vulnerable.

nmap -p 445 --script smb-vuln-ms17-010 10.10.10.12

A vulnerable lab machine may produce output similar to:

Host script results:

| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers
|   State: VULNERABLE
|   IDs: CVE:CVE-2017-0144
|   Risk factor: HIGH

What this tells us

The scan is performing a vulnerability check against the SMB service.

It does not mean that every system with port 445 open is vulnerable.

The important distinction is:

TCP/445 open
      |
      v
SMB service detected
      |
      v
MS17-010 vulnerability check
      |
      +---- Not vulnerable
      |
      +---- Vulnerable

Important CVE Note

MS17-010 contains multiple vulnerabilities.

The term EternalBlue is most commonly associated with:

CVE-2017-0144

Some security tools may report other CVEs belonging to the MS17-010 bulletin.

Therefore:

MS17-010 != one single CVE

A useful way to remember it is:

MS17-010
   |
   +-- CVE-2017-0143
   +-- CVE-2017-0144  <-- commonly associated with EternalBlue
   +-- other related vulnerabilities

Always verify the exact CVE against Microsoft's advisory rather than assuming that every MS17-010 result means exactly the same vulnerability.

Understanding the Vulnerability

The underlying issue involves improper handling of specially crafted SMBv1 requests.

At a high level:

Attacker
   |
   | Malicious SMB request
   v
SMBv1
   |
   v
Vulnerable Windows kernel
   |
   v
Memory corruption
   |
   v
Potential remote code execution

The vulnerability is particularly serious because exploitation can occur remotely over the network.

No normal application-level login is necessarily required before reaching the vulnerable code path.

Why SMBv1 Was a Security Concern

SMBv1 is an old protocol implementation with a large and complex attack surface.

Modern environments should generally avoid SMBv1 where possible.

A safer architecture is:

Legacy:

Client
  |
  v
SMBv1
  |
  v
Windows Server


Preferred:

Client
  |
  v
SMBv2 / SMBv3
  |
  v
Windows Server

Disabling unnecessary legacy protocols reduces the available attack surface.

Metasploit Module Discovery

Metasploit Framework contains modules related to MS17-010.

Start Metasploit:

msfconsole

Search for the vulnerability:

search eternalblue

A typical result includes modules such as:

exploit/windows/smb/ms17_010_eternalblue
auxiliary/scanner/smb/smb_ms17_010

The important distinction is:

Module type Purpose
auxiliary/scanner/... Detection / vulnerability checking
exploit/... Attempts exploitation

For initial validation, prefer the scanner/checking functionality.

Metasploit Vulnerability Checking

The scanner can be used in an authorized lab to verify whether a target appears vulnerable.

Conceptually:

msfconsole
    |
    v
MS17-010 scanner
    |
    v
Target: 10.10.10.12
    |
    v
SMB vulnerability check
    |
    +---- Vulnerable
    |
    +---- Not vulnerable

This is preferable during the reconnaissance phase because it allows you to establish whether the target is vulnerable before attempting exploitation.

Exploitation Concept

EternalBlue exploitation generally follows this sequence:

1. Discover target
       |
       v
2. Identify SMB
       |
       v
3. Check MS17-010
       |
       v
4. Confirm vulnerable configuration
       |
       v
5. Select appropriate exploit
       |
       v
6. Deliver controlled payload
       |
       v
7. Obtain execution/session

The exploitation phase is intentionally omitted here as a reusable weaponized procedure. In a training lab, the goal should be to understand the vulnerability, validate detection, observe the resulting behavior, and document the security impact.

The demonstrated workflow follows a standard penetration-testing methodology.

Phase 1 — Service Enumeration

nmap -sV -p 445 10.10.10.12

The scan identifies:

445/tcp open
microsoft-ds
Windows Server 2008 R2

This establishes that SMB is available.

Phase 2 — Vulnerability Detection

nmap -p 445 --script smb-vuln-ms17-010 10.10.10.12

The result indicates:

State: VULNERABLE
Risk factor: HIGH

This provides stronger evidence than simply seeing port 445 open.

Phase 3 — Exploit Research

The lab then examines publicly available MS17-010 tooling and Metasploit modules.

The important learning objective is understanding the relationship between:

Vulnerability
      |
      v
Detection
      |
      v
Exploit
      |
      v
Payload
      |
      v
Execution

AutoBlue and Public Exploit Code

The screenshots also demonstrate a publicly available project commonly referred to as AutoBlue-MS17-010.

Such projects typically contain components for:

  • Vulnerability checking

  • SMB exploit handling

  • Shellcode preparation

  • Payload integration

  • Architecture-specific support

  • Supporting scripts

The repository shown in the screenshots contains files such as:

eternal_checker.py
eternalblue_exploit7.py
eternalblue_exploit8.py
eternalblue_exploit10.py
mysmb.py
requirements.txt
shellcode/

The important concept is that an exploit framework usually separates the process into several components.

                 MS17-010
                    |
        +-----------+-----------+
        |                       |
 Vulnerability              Exploit
   Checker                  Logic
        |                       |
        +-----------+-----------+
                    |
                 Payload
                    |
                    v
                Execution

Shellcode and Payload Concepts

The screenshots show a shellcode preparation stage.

Conceptually, shellcode is machine code intended to execute after successful exploitation.

The architecture matters:

Windows x64
    |
    +--> x64 shellcode

Windows x86
    |
    +--> x86 shellcode

This is why exploit tooling may provide separate payloads for:

x86
x64

The screenshots also demonstrate the difference between:

  • staged payloads

  • stageless payloads

  • command shells

  • Meterpreter-based payloads

Staged payload

Exploit
   |
   v
Small initial payload
   |
   v
Connect to handler
   |
   v
Download additional payload

Stageless payload

Exploit
   |
   v
Complete payload
   |
   v
Execution

Staged payloads can reduce the initial payload size, while stageless payloads contain more of the functionality in the initial payload.

Listener Concept

A listener waits for a connection from a payload.

Conceptually:

Target
10.10.10.12
    |
    | connection
    v
Kali
10.10.10.10
    |
    v
Listener
TCP port

The listener must correspond to the connection parameters configured for the lab payload.

For example:

LHOST = Kali lab IP
LPORT = selected lab port

LHOST represents the address that the target should connect back to.

LPORT represents the port on which the handler is listening.

Why Architecture Matters

When dealing with Windows exploitation, architecture compatibility is important.

Target
 |
 +-- Windows x86
 |      |
 |      +-- x86 payload
 |
 +-- Windows x64
        |
        +-- x64 payload

Using an incompatible payload can result in failed execution even when the underlying vulnerability is exploitable.

Common Failure Points

An MS17-010 lab may fail for reasons unrelated to the vulnerability itself.

SMB port unavailable

445/tcp closed

Possible causes:

  • Windows firewall

  • SMB service disabled

  • Incorrect network configuration

  • Wrong target IP

Target is patched

SMB available
       |
       v
MS17-010 check
       |
       v
Not vulnerable

In this situation, exploitation should not be attempted.

Wrong network

VirtualBox networking is particularly important.

Check the Kali interface:

ip addr

Check connectivity:

ping 10.10.10.12

Then verify SMB:

nmap -p 445 10.10.10.12

Architecture mismatch

A payload designed for x64 should not be assumed to work on an x86 target.

Always determine the target architecture before selecting a payload.

Detection From a Blue-Team Perspective

MS17-010 is also useful for learning defensive monitoring.

Useful indicators include:

TCP/445 activity
      |
      +-- Unusual SMB traffic
      |
      +-- SMBv1 usage
      |
      +-- Suspicious connection patterns
      |
      +-- Exploitation attempts

Network monitoring tools such as:

  • Wireshark

  • Suricata

  • Zeek

  • Wazuh

  • SIEM platforms

can be used to investigate suspicious SMB activity.

Mitigation

The primary mitigation is to keep Windows systems patched.

Additional defensive measures include:

Disable SMBv1 where it is not required

Prefer:

SMBv2
SMBv3

over legacy SMBv1.

Restrict TCP/445

Do not expose SMB unnecessarily to untrusted networks.

A firewall policy should generally prevent direct Internet access to internal SMB services.

Network segmentation

A useful architecture is:

Internet
    |
 Firewall
    |
    +----------------+
    |                |
 User Network    Server Network
                     |
                  SMB Servers

SMB access should be restricted to systems that actually require it.

Recommended Lab Methodology

For a complete learning exercise:

                 MS17-010 Lab
                      |
       +--------------+--------------+
       |              |              |
   Enumeration     Detection      Defense
       |              |              |
      Nmap          NSE/MSF       Firewall
       |              |              |
       +--------------+--------------+
                      |
                  Analysis
                      |
             Wireshark / Wazuh

Suggested workflow

# 1. Identify the target
nmap -sV -p 445 <TARGET-IP>

# 2. Check MS17-010
nmap -p 445 --script smb-vuln-ms17-010 <TARGET-IP>

# 3. Open Metasploit
msfconsole

# 4. Search MS17-010 modules
search ms17_010

Only perform exploitation against an intentionally vulnerable machine in your isolated lab.

Key Takeaways

MS17-010

Microsoft security bulletin covering multiple SMB vulnerabilities.

EternalBlue

A widely known SMBv1 remote-code-execution exploit associated primarily with CVE-2017-0144.

SMB

Windows file/printer sharing protocol. TCP/445 is the primary port for direct-hosted SMB.

Nmap

Useful for:

Port discovery
Service detection
MS17-010 vulnerability checking

Metasploit

Provides modules for:

Vulnerability detection
Exploit research
Controlled exploitation in authorized labs

Main security lesson

The most important lesson from EternalBlue is not simply how to execute an exploit. It is how a remotely reachable legacy service, combined with an unpatched vulnerability, can become a major compromise and lateral-movement risk.

Unpatched System
       +
Exposed SMB
       +
SMBv1
       |
       v
Remote Exploitation Risk
       |
       v
System Compromise
       |
       v
Potential Lateral Movement

References

  • Microsoft MS17-010 security bulletin

  • MITRE CVE-2017-0144

  • Nmap SMB vulnerability detection scripts

  • Metasploit Framework MS17-010 modules

  • Microsoft guidance for disabling SMBv1

Lab reminder: Keep vulnerable Windows machines on an isolated virtual network. Do not bridge intentionally vulnerable systems directly onto your home or production network.