Skip to content
HackIndex.io

MS17-010 EternalBlue - Detection

3 min read Created Mar 6, 2026 Last updated Aug 11, 2026

MS17-010 is still worth checking when SMBv1 is present. A positive result indicates a no-credentials remote code execution path on the target. The vulnerability covers EternalBlue, the exploit behind WannaCry and NotPetya. Affected systems include Windows 7, Windows Server 2008 R2, and unpatched Server 2012 instances. Most modern networks have applied the patch. Legacy hosts still appear on internal segments that skip regular patch cycles. A single vulnerable host can be enough for full domain compromise. Confirm SMBv1 first.

MS17-010 Detection with Nmap

Windows versions affected by MS17-010:

  • Windows XP and Windows Server 2003
  • Windows Vista and Windows Server 2008
  • Windows 7 and Windows Server 2008 R2
  • Windows 8.1 and Windows Server 2012 / 2012 R2
  • Unpatched Windows 10 and Windows Server 2016 builds
┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-protocols $TARGET_IP

If SMBv1 is not present, stop here. The smb-protocols script lists all supported SMB dialects. Look for NT LM 0.12 or SMB 1.0 in the output. If only SMBv2 or SMBv3 appear, MS17-010 cannot apply and there is no point running the vuln check. The smb-vuln-ms17-010 script does not trigger the vulnerability. It checks for the patch by probing a specific SMB transaction without sending exploit code. Running it against a vulnerable host will not crash or destabilize the target. Run the safe Nmap check.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-vuln-ms17-010 $TARGET_IP 
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers
|   State: VULNERABLE

If Nmap reports vulnerable, write it as likely vulnerable and keep the exact output. The key lines are State: VULNERABLE and the CVE:2017-0143 reference that appears in most NSE output versions. That is enough for a strong discovery finding even if exploitation is out of scope. A confirmed MS17-010 finding means unauthenticated SYSTEM-level code execution is possible. Report it as critical severity regardless of whether the exploit was run. For exploitation, see EternalBlue MS17-010 SMB RCE. If the Print Spooler is also running, also check PrintNightmare. Collect the OS version and build number before finalizing the finding wording.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-os-discovery $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP

A legacy Windows family plus SMBv1 plus a positive script result is the combination that matters. The smb-os-discovery output and nxc output both show the OS string. Look for Windows 7, Windows XP, Windows Server 2003, Windows Server 2008, or Windows Server 2012. Hosts running those versions without the patch are confirmed targets. If the result is negative, the patch is applied. You still keep the SMBv1 finding as a separate issue. SMBv1 is a deprecated protocol with multiple other weaknesses beyond MS17-010. If the result is inconclusive, keep the wording conservative instead of overstating it. Inconclusive results happen when an IPS or packet filter silently drops the probe. They also occur when the host is behind NAT that breaks the SMB transaction sequence. In those cases, note the attempt as inconclusive and recommend direct host access or a second verification method.

References