Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows SMB | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 3 modules
-
MS17-010 SMB RCE Detection
auxiliary/scanner/smb/smb_ms17_010
-
MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
exploit/windows/smb/ms17_010_eternalblue
-
SMB DOUBLEPULSAR Remote Code Execution
exploit/windows/smb/smb_doublepulsar_rce
Exploit-DB 6
- DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit) EDB-47456 · remote · Oct 2, 2019 · verified
- Microsoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010) EDB-42315 · remote · Jul 11, 2017 · verified
- Microsoft Windows 8/8.1/2012 R2 (x64) - 'EternalBlue' SMB Remote Code Execution (MS17-010) EDB-42030 · remote · May 17, 2017 · verified
- Microsoft Windows 7/2008 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010) EDB-42031 · remote · May 17, 2017 · verified
- Microsoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010) EDB-41987 · remote · May 10, 2017
- Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit) EDB-41891 · dos · Apr 17, 2017 · verified
GitHub 26 repositories · most starred shown
-
peterpt/eternal_scanner ★ 341 · Jul 16, 2017
An internet scanner for exploit CVE-2017-0144 (Eternal Blue) & CVE-2017-0145 (Eternal Romance)
-
EEsshq/CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution ★ 18 · Mar 22, 2021
-
AdityaBhatt3010/VAPT-Report-on-SMB-Exploitation-in-Windows-10-Finance-Endpoint ★ 15 · Jul 10, 2025
This report outlines a structured VAPT engagement focusing on PCI DSS compliance, SMB service enumeration, and exploitation of CVE-2017-0144 (EternalBlue) on a Windows 10 machine within a finance-ori…
-
AtithKhawas/autoblue ★ 6 · Dec 30, 2024
AutoBlue - Automated EternalBlue (CVE-2017-0144 / MS17-010) exploitation tool leveraging Nmap and Metasploit for ethical hacking, penetration testing, and CTF challenges. Strictly for authorized and …
-
ashrafzaryouh/CVE-2017-0144 ★ 4 · Jun 14, 2026
CVE-2017-0144
-
sethwhy/BlueDoor ★ 3 · Dec 21, 2024
Can you exploit the EternalBlue vulnerability (CVE-2017-0144) on a Windows 7 system and retrieve the hidden flag? Your goal is to gain administrative privileges and locate the flag stored behind the …
-
quincyomoruyi6-lang/BLUE-WRITEUP-CVE-2017-0144 ★ 1 · Sep 10, 2026
Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment
-
FireTemple/Blackash-CVE-2017-0144 ★ 1 · Nov 27, 2025
CVE-2017-0144
-
MedX267/EternalBlue-Vulnerability-Scanner ★ 1 · Feb 3, 2025
This script checks for devices vulnerable to the EternalBlue exploit (CVE-2017-0144) in a network using SMB.
-
kimocoder/eternalblue ★ 1 · Jun 2, 2019
CVE-2017-0144
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- SCA-2021-0002 MEAC affected by Windows SMBv1 vulnerability SICK PSIRT · Aug 4, 2021
- ICSMA-18-058-02 Philips Intellispace Portal ISP Vulnerabilities CISA ICS & IT advisories · Feb 27, 2018
References
- 42031 exploit
- 42030 exploit
- 41891 exploit
- 1037991 vdb-entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- 41987 exploit
- 96704 vdb-entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html