🔵 EternalBlue (CVE-2017-0144)

Critical Microsoft SMBv1 Remote Code Execution Vulnerability

📌 Overview

EternalBlue is a critical vulnerability in Microsoft's Server Message Block version 1 (SMBv1) protocol that allows remote attackers to execute arbitrary code on vulnerable Windows systems without authentication.

The exploit was developed by the NSA and later leaked by the Shadow Brokers hacking group in 2017. It became widely known after being weaponized by global ransomware campaigns such as WannaCry and NotPetya.

🆔 Vulnerability Details

⚠️ Impact

Successful exploitation can lead to:

• 💀 Remote code execution with SYSTEM privileges
• 🖥️ Complete takeover of vulnerable machines
• 🌐 Worm-like propagation across networks
• 🔐 Deployment of ransomware or malware
• 📂 Data theft, destruction, or encryption
• 🚨 Large-scale organizational outages

📸 Demo

🛑 WannaCry Ransomware (May 2017) 🛑

WannaCry used EternalBlue to spread automatically across networks.

Impact:

• 🌍 More than 200,000 computers infected
• 🌎 Affected over 150 countries
• 🏥 Disrupted hospitals, businesses, telecoms, and government services
• 💰 Caused billions of dollars in damages

🛑 NotPetya ransomware (June 2017) 🛑

NotPetya combined EternalBlue with other propagation techniques.

Impact:

• 🏢 Targeted multinational organizations
• 💾 Destroyed data rather than simply encrypting it
• 💸 Estimated damages exceeded $10 billion
• 🌍 One of the most destructive cyberattacks in history

🔥 Why EternalBlue Was Dangerous

Internet
    |
    v
Exposed SMBv1 Port (TCP 445)
    |
    v
Specially Crafted SMB Packet
    |
    v
Kernel Memory Corruption
    |
    v
Remote Code Execution
    |
    v
SYSTEM-Level Access
    |
    v
Automatic Network Spread

🛡️ Mitigation

Immediate Actions

• ✅ Apply Microsoft security update MS17-010
• ✅ Disable SMBv1 if not required
• ✅ Block SMB traffic (TCP port 445) from untrusted networks
• ✅ Segment internal networks
• ✅ Keep Windows systems updated
• ✅ Use modern endpoint protection
• ✅ Monitor SMB activity for unusual behavior

🔍 Detection Indicators

Potential signs of exploitation:

• Unusual SMB traffic over TCP/445
• Rapid lateral movement between systems
• Unexpected creation of processes like cmd.exe or powershell.exe
• Ransomware activity or mass file modifications

📊 CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

🗓 Timeline

📚 References

• Microsoft Security Bulletin MS17-010
• MITRE CVE-2017-0144
• CISA Known Exploited Vulnerabilities Catalog

⚠️ Disclaimer

This repository is for educational and defensive cybersecurity purposes only.
Do not use this information to attack systems without explicit authorization.

🔵 EternalBlue • CVE-2017-0144 • SMBv1 RCE