Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
eternalblue-ms17-010-research — Controlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK mapping | Kitploit
Tools/GitHubGitHub/trinadh-dasari-cyber/eternalblue-ms17-010-research
Vulnerability AnalysisExploitationNetwork ForensicsPenetration TestingLearning & EducationLabs & Practice
GitHubtrinadh-dasari-cyber/eternalblue-ms17-010-research

eternalblue-ms17-010-research

Controlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK mapping

View Repository
94 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

💀 EternalBlue (MS17-010) Exploitation Research

Controlled reproduction of CVE-2017-0144 — the SMB vulnerability behind the WannaCry ransomware outbreak

⚠️ Disclaimer: This research was conducted in a fully isolated, controlled lab environment for academic and educational purposes only. No production systems were involved.

Overview

This project reproduced the EternalBlue exploit (CVE-2017-0144, CVSS 9.3) in a sandboxed AWS EC2 environment. The goal was to deeply understand the vulnerability mechanics, capture and analyze the exploit traffic, and map the attack chain to MITRE ATT&CK — informing both offensive research and defensive hardening strategies.

Lab Architecture

  • Cloud Platform: AWS EC2
  • Attacker Machine: Kali Linux
  • Target Machine: Windows Server 2008 R2 (unpatched, SMBv1 enabled)
  • Network: Isolated VPC, no internet egress from target

What Was Done

Exploit Reproduction

  • Configured a vulnerable Windows Server 2008 R2 instance with SMBv1 enabled and MS17-010 unpatched
  • Used Metasploit Framework to execute the exploit chain
  • Achieved remote code execution and SYSTEM-level shell access

Network Traffic Analysis

  • Captured full packet capture using Wireshark during the exploit
  • Analyzed SMB negotiation sequence, shellcode delivery, and RCE stages at the packet level
  • Identified key indicators of compromise (IOCs) visible in network traffic

MITRE ATT&CK Mapping

  • T1210 — Exploitation of Remote Services (Initial Access)
  • T1059 — Command and Scripting Interpreter (Execution)
  • T1055 — Process Injection (Defense Evasion / Privilege Escalation)

Key Findings & Mitigations

  • SMBv1 enabled by default on legacy systems → Disable via PowerShell or Group Policy
  • MS17-010 patch not applied → Apply KB4012212 / KB4012215 immediately
  • Lateral movement possible post-exploitation → Network segmentation + host-based firewall rules
  • No detection of exploit traffic → Deploy SMB traffic monitoring in SIEM

Academic Output

Delivered a 35-minute capstone presentation covering:

  • Full exploit mechanics and root cause analysis
  • Packet-level walkthrough of the attack chain
  • Detection strategies and remediation recommendations

Skills Demonstrated

Metasploit Wireshark Kali Linux AWS EC2 CVE Analysis CVSS Scoring MITRE ATT&CK SMB Protocol Vulnerability Research Network Forensics

Download Tool