Skip to content
HackIndex logo

HackIndex

MS17-010 EternalBlue - Detection

2 min read May 15, 2026

MS17-010 is still worth checking when SMBv1 is present because a positive result can indicate a no-credentials remote code execution path on the target.

Confirm SMBv1 first.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-protocols $TARGET_IP

If SMBv1 is not present, stop here.

Run the safe Nmap check.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-vuln-ms17-010 $TARGET_IP 
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers
|   State: VULNERABLE

If Nmap reports vulnerable, write it as likely vulnerable and keep the exact output. That is enough for a strong discovery finding even if exploitation is out of scope. For exploitation, see EternalBlue MS17-010 SMB RCE. If the Print Spooler is also running, also check PrintNightmare.

Add OS context before final wording.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-os-discovery $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP

A legacy Windows family plus SMBv1 plus a positive script result is the combination that matters. If the result is negative, you still keep the SMBv1 finding. If the result is inconclusive, keep the wording conservative instead of overstating it.

References