# MS17-010 EternalBlue - Detection

> Detect MS17-010 EternalBlue SMB vulnerability on Windows hosts using network scanning, traffic analysis, and patch verification techniques.

- **URL:** https://hackindex.io/services/smb/vulnerability-discovery/ms17-010-detection
- **Path:** SMB > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/smb/vulnerability-discovery.md)
- **Published:** 2026-03-06
- **Updated:** 2026-08-11

MS17-010 is still worth checking when SMBv1 is present. A positive result indicates a no-credentials remote code execution path on the target. The vulnerability covers EternalBlue, the exploit behind WannaCry and NotPetya. Affected systems include Windows 7, Windows Server 2008 R2, and unpatched Server 2012 instances. Most modern networks have applied the patch. Legacy hosts still appear on internal segments that skip regular patch cycles. A single vulnerable host can be enough for full domain compromise. Confirm SMBv1 first.

## MS17-010 Detection with Nmap

Windows versions affected by MS17-010:

- Windows XP and Windows Server 2003
- Windows Vista and Windows Server 2008
- Windows 7 and Windows Server 2008 R2
- Windows 8.1 and Windows Server 2012 / 2012 R2
- Unpatched Windows 10 and Windows Server 2016 builds

```bash
nmap -Pn -p 445 --script smb-protocols $TARGET_IP
```

If SMBv1 is not present, stop here. The smb-protocols script lists all supported SMB dialects. Look for NT LM 0.12 or SMB 1.0 in the output. If only SMBv2 or SMBv3 appear, MS17-010 cannot apply and there is no point running the vuln check. The smb-vuln-ms17-010 script does not trigger the vulnerability. It checks for the patch by probing a specific SMB transaction without sending exploit code. Running it against a vulnerable host will not crash or destabilize the target. Run the safe Nmap check.

```bash
nmap -Pn -p 445 --script smb-vuln-ms17-010 $TARGET_IP
# | smb-vuln-ms17-010:
# |   VULNERABLE:
# |   Remote Code Execution vulnerability in Microsoft SMBv1 servers
# |   State: VULNERABLE
```

If Nmap reports vulnerable, write it as likely vulnerable and keep the exact output. The key lines are State: VULNERABLE and the CVE:2017-0143 reference that appears in most NSE output versions. That is enough for a strong discovery finding even if exploitation is out of scope. A confirmed MS17-010 finding means unauthenticated SYSTEM-level code execution is possible. Report it as critical severity regardless of whether the exploit was run. For exploitation, see [EternalBlue MS17-010 SMB RCE](https://hackindex.io/services/smb/exploitation/vulnerabilities/eternalblue-ms17-010-smb-rce). If the Print Spooler is also running, also check [PrintNightmare](https://hackindex.io/services/smb/exploitation/vulnerabilities/printnightmare-print-spooler-rce-to-system). Collect the OS version and build number before finalizing the finding wording.

```bash
nmap -Pn -p 445 --script smb-os-discovery $TARGET_IP
nxc smb $TARGET_IP
```

A legacy Windows family plus SMBv1 plus a positive script result is the combination that matters. The smb-os-discovery output and nxc output both show the OS string. Look for Windows 7, Windows XP, Windows Server 2003, Windows Server 2008, or Windows Server 2012. Hosts running those versions without the patch are confirmed targets. If the result is negative, the patch is applied. You still keep the SMBv1 finding as a separate issue. SMBv1 is a deprecated protocol with multiple other weaknesses beyond MS17-010. If the result is inconclusive, keep the wording conservative instead of overstating it. Inconclusive results happen when an IPS or packet filter silently drops the probe. They also occur when the host is behind NAT that breaks the SMB transaction sequence. In those cases, note the attempt as inconclusive and recommend direct host access or a second verification method.

## References

- [smb-vuln-ms17-010 NSE Script](https://nmap.org/nsedoc/scripts/smb-vuln-ms17-010.html) - Safe MS17-010 detection
- [smb-protocols NSE Script](https://nmap.org/nsedoc/scripts/smb-protocols.html) - Confirm SMBv1 before legacy checks
- [Microsoft Security Bulletin MS17-010](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010) - Affected SMBv1 vulnerability context