kitskater/legacyshield-cve-2017-0144Defensive Windows security application providing compensating controls for CVE-2017-0144 (EternalBlue/MS17-010) through SMB monitoring, attack detection, automated firewall response, configuration auditing, and security reporting for legacy and unsupported systems.
A Windows desktop security application that provides a defensive compensating control for systems still exposed to CVE-2017-0144 (MS17-010 / EternalBlue) — most commonly legacy or unsupported Windows installations that can no longer receive official Microsoft security updates.
LegacyShield does not patch the underlying SMBv1 vulnerability. It reduces attack surface and improves visibility through monitoring, heuristic detection, automated (temporary, reversible) firewall mitigation, structured logging, and professional reporting. Applying the official MS17-010 update, or upgrading to a supported Windows version, remains the definitive remediation.
This project contains no exploit code, proof-of-concept attack code, privilege escalation techniques, or offensive tooling of any kind.
| Capability | Summary |
|---|---|
| System Assessment | Reads (never writes) Windows version, SMBv1 status, port 139/445 exposure, firewall state, file sharing, and network profile. Produces a 0–100 security score. |
| SMB Monitoring | Polls TCP 139/445 via the OS connection table for new inbound connections. No packet capture or payload inspection. |
| Detection Engine | Configurable heuristics: connection bursts, per-minute volume, repeated failed negotiations. |
| Automated Response | Creates temporary, tagged, auto-expiring Windows Firewall block rules for offending sources; never touches rules it didn't create; full rollback support. |
| Logging | Structured JSON/CSV/plain-text logs, plus Windows Event Log entries for high-severity events. |
| Reporting | Executive-summary security reports exportable as JSON, HTML, or PDF. |
| Desktop UI | PySide6 dashboard, sidebar navigation, system tray notifications. |
| Background Service | Optional pywin32-based Windows Service so protection continues when the GUI is closed. |
LegacyShield/
├── main.py # GUI entry point (+ install/uninstall/rollback CLI verbs)
├── legacyshield/
│ ├── core/ # Read-only system inspection, scoring, shared models
│ ├── modules/ # Config, detection engine, response engine, whitelist
│ ├── services/ # SMB monitor, firewall service, background Windows Service
│ ├── logging_/ # JSON/CSV/text log writers + Windows Event Log mirror
│ ├── reports/ # JSON/HTML/PDF report generator + HTML template
│ └── ui/ # PySide6 main window, sidebar, dashboard, pages, tray
├── config/default_config.json # Shipped default configuration
├── installer/ # PyInstaller spec, build script, manifest, Inno Setup script
├── tests/ # pytest suite incl. mocked-Windows-API tests
├── samples/ # Example config/log/report output
└── docs/ # Guides referenced below
See ARCHITECTURE.md for the full design, including UML class and sequence diagrams.
python -m venv .venv
.venv\Scripts\activate # Windows
pip install -r requirements-dev.txt
pytest tests/ -v
python main.py
The GUI (
main.py) and Windows Service (legacyshield/services/background_service.py) require Windows +pywin32. The core/modules/services business logic is platform-independent and its test suite runs on any OS via mocked Windows API protocols — seetests/mocks/windows_mocks.py.
pip install -r requirements-dev.txt
python installer/build.py # runs tests, then PyInstaller -> dist/LegacyShield.exe
iscc installer/installer.iss # optional: Inno Setup -> dist/installer/LegacyShield-Setup-*.exe
This is a defensive-engineering portfolio project demonstrating Windows systems programming, monitoring/detection design, and secure application architecture. It ships without a specific license; add one appropriate to your intended use before distribution.