How do I install the Exploiting Ms17 010 Eternalblue Vulnerability skill?

Run npx skillmds@latest add gabrielmoreira/exploiting-ms17-010-eternalblue-vulnerability in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Exploiting Ms17 010 Eternalblue Vulnerability safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: WARNING, Skill Scanner: PASS. Capability flags: docs only, executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Exploiting Ms17 010 Eternalblue Vulnerability?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Exploiting Ms17 010 Eternalblue Vulnerability free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Exploiting Ms17 010 Eternalblue Vulnerability?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Exploiting Ms17 010 Eternalblue Vulnerability by gabrielmoreira

Name: Exploiting Ms17 010 Eternalblue Vulnerability
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Exploiting Ms17 010 Eternalblue Vulnerability

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Exploiting MS17-010 EternalBlue Vulnerability

Overview

MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.

When to Use

When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability
When analyzing malware samples or attack artifacts in a controlled environment
When conducting red team exercises or penetration testing engagements
When building detection capabilities based on offensive technique understanding

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

MITRE ATT&CK Mapping

T1210 - Exploitation of Remote Services
T1190 - Exploit Public-Facing Application
T1569.002 - System Services: Service Execution

Workflow

Phase 1: Vulnerability Scanning

Scan target networks for SMB port 445
Check for SMBv1 protocol support
Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)
Document vulnerable systems with OS version and patch level

Phase 2: Exploitation

Select appropriate exploit variant based on target OS
Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode)
Execute exploit against confirmed vulnerable target
Verify code execution and establish session

Phase 3: Post-Exploitation

Establish persistence on compromised system
Dump credentials from memory
Use compromised host as pivot point
Document exploitation evidence

Tools and Resources

Tool	Purpose
Nmap ms-17-010 NSE scripts	Vulnerability detection
Metasploit ms17_010_eternalblue	Exploitation module
Metasploit ms17_010_psexec	Alternative exploitation
AutoBlue-MS17-010	Standalone Python exploit
CrackMapExec	Mass SMB vulnerability scanning

Detection Indicators

IDS/IPS signatures for EternalBlue exploit traffic
SMBv1 negotiation from unusual source hosts
Event ID 7045: New service installation after exploitation
Anomalous named pipe activity on SMB
Large SMB write requests characteristic of buffer overflow

Validation Criteria

Vulnerable systems identified via scanning
Exploitation achieved on authorized target
Code execution confirmed with session established
Post-exploitation activities documented
Remediation recommendations provided

---name: exploiting-ms17-010-eternalblue-vulnerabilitydescription: Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.license: Apache-2.0---# Exploiting MS17-010 EternalBlue Vulnerability ## Overview MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments. ## When to Use - When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability - When analyzing malware samples or attack artifacts in a controlled environment - When conducting red team exercises or penetration testing engagements - When building detection capabilities based on offensive technique understanding ## Prerequisites - Familiarity with red teaming concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities ## MITRE ATT&CK Mapping - **T1210** - Exploitation of Remote Services - **T1190** - Exploit Public-Facing Application - **T1569.002** - System Services: Service Execution ## Workflow ### Phase 1: Vulnerability Scanning 1. Scan target networks for SMB port 445 2. Check for SMBv1 protocol support 3. Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary) 4. Document vulnerable systems with OS version and patch level ### Phase 2: Exploitation 1. Select appropriate exploit variant based on target OS 2. Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode) 3. Execute exploit against confirmed vulnerable target 4. Verify code execution and establish session ### Phase 3: Post-Exploitation 1. Establish persistence on compromised system 2. Dump credentials from memory 3. Use compromised host as pivot point 4. Document exploitation evidence ## Tools and Resources | Tool | Purpose | |------|---------| | Nmap ms-17-010 NSE scripts | Vulnerability detection | | Metasploit ms17_010_eternalblue | Exploitation module | | Metasploit ms17_010_psexec | Alternative exploitation | | AutoBlue-MS17-010 | Standalone Python exploit | | CrackMapExec | Mass SMB vulnerability scanning | ## Detection Indicators - IDS/IPS signatures for EternalBlue exploit traffic - SMBv1 negotiation from unusual source hosts - Event ID 7045: New service installation after exploitation - Anomalous named pipe activity on SMB - Large SMB write requests characteristic of buffer overflow ## Validation Criteria - [ ] Vulnerable systems identified via scanning - [ ] Exploitation achieved on authorized target - [ ] Code execution confirmed with session established - [ ] Post-exploitation activities documented - [ ] Remediation recommendations provided

Frequently asked questions