Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.
Start a fresh conversation. Replace the highlighted placeholders.
Use exploiting-ms17-010-eternalblue-vulnerability to create a defensive detection and remediation assessment for [authorized lab or asset inventory], covering SMBv1 exposure, MS17-010 indicators, and recommended mitigations.
Required inputs
[authorized lab or asset inventory]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: exploiting-ms17-010-eternalblue-vulnerabilitydescription: >- Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.domain: cybersecuritysubdomain: red-teamingtags: - red-team- adversary-simulation- mitre-attack- exploitation- post-exploitation- eternalblue- smb- remote-code-executionversion: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Application Protocol Command Analysis- Network Isolation- Network Traffic Analysis- Client-server Payload Profiling- Platform Monitoringnist_csf: - ID.RA-01- GV.OV-02- DE.AE-07mitre_attack: - T1595- T1190- T1059- T1078
Exploiting MS17-010 EternalBlue Vulnerability
Overview
MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.
When to Use
When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability
When analyzing malware samples or attack artifacts in a controlled environment
When conducting red team exercises or penetration testing engagements
When building detection capabilities based on offensive technique understanding
Prerequisites
Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
MITRE ATT&CK Mapping
T1210 - Exploitation of Remote Services
T1190 - Exploit Public-Facing Application
T1569.002 - System Services: Service Execution
Workflow
Phase 1: Vulnerability Scanning
Scan target networks for SMB port 445
Check for SMBv1 protocol support
Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)
Document vulnerable systems with OS version and patch level
Phase 2: Exploitation
Select appropriate exploit variant based on target OS