skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-ms17-010-eternalblue-vulnerability

Exploit MS17-010 EternalBlue SMBv1 vulnerability during authorized red team engagements.

954|172|Updated Mar 13, 2026
Search Tags:#exploitation#metasploit#SMB#Red Team#remote code execution#ms17-010#eternalblue
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-ms17-010-eternalblue-vulnerability
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-ms17-010-eternalblue-vulnerability
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/exploiting-ms17-010-eternalblue-vulnerability
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-ms17-010-eternalblue-vulnerability

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Legacy Windows systems with unpatched SMBv1 remain exposed to MS17-010 (EternalBlue), and security testers need a structured, safe methodology to confirm exploitability without crashing production hosts or drawing false conclusions from incomplete scans.

Core Features & Use Cases

  • Phased Exploitation Workflow: Guides vulnerability scanning (Nmap NSE, Metasploit auxiliary), exploitation (ms17_010_eternalblue, ms17_010_psexec, AutoBlue), and post-exploitation (persistence, credential dumping, pivoting).
  • Pitfall Avoidance: Covers commonly missed checks such as OS build fingerprinting, named-pipe accessibility, x86 vs x64 payload architecture, and crash-safety sign-off on legacy hosts.
  • Detection & Defense Mapping: Maps the technique to MITRE ATT&CK (T1210, T1190, T1569.002), D3FEND countermeasures, and NIST CSF, with concrete detection indicators like Event ID 7045 and anomalous named-pipe activity.
  • Use Case: During an authorized internal penetration test, scan the network for SMB port 445, confirm MS17-010 with the smb-vuln-ms17-010 NSE script, exploit a confirmed Windows 7 target with Metasploit, and document a Meterpreter session running as NT AUTHORITY\SYSTEM as proof.

Quick Start

Ask the AI to scan the authorized lab network for MS17-010 with Nmap and exploit a confirmed vulnerable Windows host using Metasploit's ms17_010_eternalblue module.

Frequently Asked Questions about exploiting-ms17-010-eternalblue-vulnerability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a host is vulnerable to MS17-010 EternalBlue?▼

Run the Nmap NSE script smb-vuln-ms17-010 against port 445 or use the Metasploit auxiliary scanner. A result of VULNERABLE confirms exposure; a filtered or closed port is inconclusive, not proof the host is patched.

What tools can exploit MS17-010 EternalBlue?▼

Metasploit's ms17_010_eternalblue module is the primary option, with ms17_010_psexec as a more reliable authenticated variant when credentials exist. AutoBlue-MS17-010 provides a standalone Python exploit, and CrackMapExec handles mass SMB vulnerability scanning.

Why does the EternalBlue exploit crash the target or fail silently?▼

EternalBlue's kernel grooming is build-sensitive, so firing it without fingerprinting the exact OS version and patch level can blue-screen the host. Mismatched x86 versus x64 payload architecture also causes silent shellcode failure.

Does MS17-010 exploitation require valid credentials?▼

The classic EternalBlue exploit is unauthenticated but needs an accessible named pipe via anonymous IPC$ access. When credentials are available, the ms17_010_psexec variant is preferred because it is more reliable and safer on production systems.

How can defenders detect EternalBlue exploitation attempts?▼

Watch for IDS/IPS signatures on EternalBlue traffic, SMBv1 negotiation from unusual sources, Event ID 7045 indicating new service installation, anomalous named-pipe activity, and large SMB write requests characteristic of the buffer overflow.

Related Skills

Explore More Software Engineering Skills→
L3DigitalNetL3DigitalNet
6

nmap

Scan networks for hosts, ports, services, and operating systems using nmap.

Official
Intermediate
AeonDaveAeonDave
15

lazagne

Extract saved passwords from browsers, mail clients, databases, Git, and WiFi.

Community
Intermediate
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic
Prohao42Prohao42
120

windows-lateral-movement

Execute lateral movement techniques on Windows systems for penetration testing.

Community
Advanced