Exploiting MS17-010 Vulnerability
FreeLeverage the EternalBlue exploit for red team engagements.
Free · Opens the source repo
What Exploiting MS17-010 Vulnerability does
The Exploiting MS17-010 EternalBlue Vulnerability skill provides a framework for detecting and exploiting the MS17-010 vulnerability in Microsoft's SMBv1 implementation. This vulnerability allows for remote code execution and has been a significant vector for attacks since its discovery. The skill utilizes Nmap's ms-17-010 NSE script for vulnerability detection and Metasploit's ms17_010_eternalblue and ms17_010_psexec modules for exploitation. It is designed for use in authorized security testing scenarios, such as red team exercises and penetration testing engagements, particularly in environments with unpatched legacy Windows systems.
The workflow is structured into three phases: vulnerability scanning, exploitation, and post-exploitation. In the scanning phase, users identify systems vulnerable to the EternalBlue exploit by checking for SMBv1 support and documenting the OS version and patch level. The exploitation phase involves selecting the appropriate exploit variant based on the target operating system, configuring the payload, and executing the exploit to establish a session. Finally, the post-exploitation phase allows users to perform actions such as establishing persistence, dumping credentials, and documenting the evidence of exploitation.
This skill is particularly useful for security professionals who require a practical tool for understanding and demonstrating the impact of the EternalBlue vulnerability. It also aids in building detection capabilities by providing insights into offensive techniques. Given the ongoing prevalence of unpatched systems, this skill remains relevant for those engaged in security assessments and red teaming.
When to use it
Use this skill during authorized penetration tests or red team engagements targeting legacy Windows environments with SMBv1.
When not to use it
This skill is not suitable for environments where SMBv1 is patched or for unauthorized testing activities.
What you can build with it
Conducting a Penetration Test
Use this skill to assess the security of legacy Windows systems during a controlled penetration test.
Red Team Exercise
Leverage the skill in a red team engagement to simulate an attack using the EternalBlue exploit.
Building Detection Capabilities
Utilize the insights gained from this skill to enhance detection mechanisms for SMB vulnerabilities in your organization.
How to install Exploiting MS17-010 Vulnerability
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/exploiting-ms17-010-eternalblue-vulnerability --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Exploiting MS17-010 EternalBlue Vulnerability
Overview
MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.
When to Use
- When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability
- When analyzing malware samples or attack artifacts in a controlled environment
- When conducting red team exercises or penetration testing engagements
- When building detection capabilities based on offensive technique understanding
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
MITRE ATT&CK Mapping
- T1210 - Exploitation of Remote Services
- T1190 - Exploit Public-Facing Application
- T1569.002 - System Services: Service Execution
Workflow
Phase 1: Vulnerability Scanning
- Scan target networks for SMB port 445
- Check for SMBv1 protocol support
- Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)
- Document vulnerable systems with OS version and patch level
Phase 2: Exploitation
- Select appropriate exploit variant based on target OS
- Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode)
- Execute exploit against confirmed vulnerable target
- Verify code execution and establish session
Phase 3: Post-Exploitation
- Establish persistence on compromised system
- Dump credentials from memory
- Use compromised host as pivot point
- Document exploitation evidence
Tools and Resources
| Tool | Purpose |
|---|---|
| Nmap ms-17-010 NSE scripts | Vulnerability detection |
| Metasploit ms17_010_eternalblue | Exploitation module |
| Metasploit ms17_010_psexec | Alternative exploitation |
| AutoBlue-MS17-010 | Standalone Python exploit |
| CrackMapExec | Mass SMB vulnerability scanning |
Detection Indicators
- IDS/IPS signatures for EternalBlue exploit traffic
- SMBv1 negotiation from unusual source hosts
- Event ID 7045: New service installation after exploitation
- Anomalous named pipe activity on SMB
- Large SMB write requests characteristic of buffer overflow
Validation Criteria
- Vulnerable systems identified via scanning
- Exploitation achieved on authorized target
- Code execution confirmed with session established
- Post-exploitation activities documented
- Remediation recommendations provided
Frequently asked questions about Exploiting MS17-010 Vulnerability
Similar skills
Cloudflare Security Audit
Perform authorized security audits on codebases.
Authenticated Scan with OpenVAS
Perform deep vulnerability scans using OpenVAS with credentials.
Active Directory Penetration Test
Conduct focused AD penetration tests with ease.
Active Directory BloodHound Analysis
Visualize Active Directory attack paths and risks.
Orchestrating LLM Attacks with PyRIT
Automate multi-turn adversarial attacks against LLMs.
Operating Sliver C2
Deploy and manage Sliver C2 for red-team engagements.