Vulnerabilities > CVE-2017-0147

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
microsoft
siemens
nessus
exploit available
metasploit

Summary

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."

Exploit-Db

  • idEDB-ID:47456
    last seen2019-10-02
    modified2019-10-02
    published2019-10-02
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/47456
    titleDOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
  • descriptionMicrosoft Windows - SrvOs2FeaToNt SMB Remote Code Execution (MS17-010). CVE-2017-0143,CVE-2017-0144,CVE-2017-0145,CVE-2017-0146,CVE-2017-0147,CVE-2017-0148. ...
    fileexploits/windows_x86-64/remote/41987.py
    idEDB-ID:41987
    last seen2017-05-10
    modified2017-05-10
    platformwindows_x86-64
    port
    published2017-05-10
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/41987/
    titleMicrosoft Windows - SrvOs2FeaToNt SMB Remote Code Execution (MS17-010)
    typeremote
  • descriptionMicrosoft Windows - Unauthenticated SMB Remote Code Execution (MS17-010) (Metasploit). CVE-2017-0143,CVE-2017-0144,CVE-2017-0145,CVE-2017-0146,CVE-2017-0147,...
    fileexploits/windows/dos/41891.rb
    idEDB-ID:41891
    last seen2017-04-18
    modified2017-04-17
    platformwindows
    port445
    published2017-04-17
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/41891/
    titleMicrosoft Windows - Unauthenticated SMB Remote Code Execution (MS17-010) (Metasploit)
    typedos
  • descriptionWindows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code Execution (Metasploit) (MS17-010). CVE-2017-0143,CVE-2017-0146,CVE-2017-0147. R...
    fileexploits/windows/remote/43970.rb
    idEDB-ID:43970
    last seen2018-02-05
    modified2018-02-05
    platformwindows
    port
    published2018-02-05
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/43970/
    titleWindows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code Execution (Metasploit) (MS17-010)
    typeremote

Metasploit

Msbulletin

bulletin_idms17-010
bulletin_url
date2017-03-14T00:00:00
impactRemote Code Execution
knowledgebase_id4013389
knowledgebase_url
severityCritical
titleSecurity Update for Microsoft Windows SMB Server

Nessus

  • NASL familyWindows
    NASL idMS17-010.NASL
    descriptionThe remote Windows host is affected by the following vulnerabilities : - Multiple remote code execution vulnerabilities exist in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of certain requests. An unauthenticated, remote attacker can exploit these vulnerabilities, via a specially crafted packet, to execute arbitrary code. (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0148) - An information disclosure vulnerability exists in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of certain requests. An unauthenticated, remote attacker can exploit this, via a specially crafted packet, to disclose sensitive information. (CVE-2017-0147) ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers. WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via ETERNALBLUE.
    last seen2020-06-01
    modified2020-06-02
    plugin id97833
    published2017-03-20
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97833
    titleMS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(97833);
      script_version("1.23");
      script_cvs_date("Date: 2019/11/13");
    
      script_cve_id(
        "CVE-2017-0143",
        "CVE-2017-0144",
        "CVE-2017-0145",
        "CVE-2017-0146",
        "CVE-2017-0147",
        "CVE-2017-0148"
      );
      script_bugtraq_id(
        96703,
        96704,
        96705,
        96706,
        96707,
        96709
      );
      script_xref(name:"EDB-ID", value:"41891");
      script_xref(name:"EDB-ID", value:"41987");
      script_xref(name:"MSFT", value:"MS17-010");
      script_xref(name:"IAVA", value:"2017-A-0065");
      script_xref(name:"MSKB", value:"4012212");
      script_xref(name:"MSKB", value:"4012213");
      script_xref(name:"MSKB", value:"4012214");
      script_xref(name:"MSKB", value:"4012215");
      script_xref(name:"MSKB", value:"4012216");
      script_xref(name:"MSKB", value:"4012217");
      script_xref(name:"MSKB", value:"4012606");
      script_xref(name:"MSKB", value:"4013198");
      script_xref(name:"MSKB", value:"4013429");
      script_xref(name:"MSKB", value:"4012598");
    
      script_name(english:"MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)");
      script_summary(english:"Checks the presence of MS17-010.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is affected by the following vulnerabilities :
    
      - Multiple remote code execution vulnerabilities exist in
        Microsoft Server Message Block 1.0 (SMBv1) due to
        improper handling of certain requests. An
        unauthenticated, remote attacker can exploit these
        vulnerabilities, via a specially crafted packet, to
        execute arbitrary code. (CVE-2017-0143, CVE-2017-0144,
        CVE-2017-0145, CVE-2017-0146, CVE-2017-0148)
    
      - An information disclosure vulnerability exists in
        Microsoft Server Message Block 1.0 (SMBv1) due to
        improper handling of certain requests. An
        unauthenticated, remote attacker can exploit this, via a
        specially crafted packet, to disclose sensitive
        information. (CVE-2017-0147)
    
    ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are
    four of multiple Equation Group vulnerabilities and exploits disclosed
    on 2017/04/14 by a group known as the Shadow Brokers. WannaCry /
    WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit,
    and EternalRocks is a worm that utilizes seven Equation Group
    vulnerabilities. Petya is a ransomware program that first utilizes
    CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads
    via ETERNALBLUE.");
      # https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?68fc8eff");
      # https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?321523eb");
      # https://cloudblogs.microsoft.com/microsoftsecure/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/?source=mmpc
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?065561d0");
      # https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d9f569cf");
      script_set_attribute(attribute:"see_also", value:"https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/");
      # https://support.microsoft.com/en-us/help/2696547/how-to-detect-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b9d9ebf9");
      # https://www.us-cert.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8dcab5e4");
      # https://www.theregister.co.uk/2017/01/18/uscert_warns_admins_to_kill_smb_after_shadow_brokers_dump/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?234f8ef8");
      # https://www.riskbasedsecurity.com/2016/08/the-shadow-brokers-lifting-the-shadows-of-the-nsas-equation-group/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c7e0cf3");
      script_set_attribute(attribute:"see_also", value:"https://github.com/stamparm/EternalRocks/");
      # https://www.tenable.com/blog/petyanotpetya-ransomware-detection-for-the-modern-enterprise
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59db5b5b");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Windows Vista, 2008, 7,
    2008 R2, 2012, 8.1, RT 8.1, 2012 R2, 10, and 2016. Microsoft has also
    released emergency patches for Windows operating systems that are no
    longer supported, including Windows XP, 2003, and 8.
    
    For unsupported Windows operating systems, e.g. Windows XP, Microsoft
    recommends that users discontinue the use of SMBv1. SMBv1 lacks
    security features that were included in later SMB versions. SMBv1 can
    be disabled by following the vendor instructions provided in Microsoft
    KB2696547. Additionally, US-CERT recommends that users block SMB
    directly by blocking TCP port 445 on all network boundary devices. For
    SMB over the NetBIOS API, block TCP ports 137 / 139 and UDP ports 137
    / 138 on all network boundary devices.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-0148");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_set_attribute(attribute:"in_the_news", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/03/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/20");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("os_fingerprint.nasl", "smb_v1_enabled_remote.nasl");
      script_require_keys("Host/OS", "SMB/SMBv1_is_supported");
      script_require_ports(139, 445);
    
      exit(0);
    }
    
    include("audit.inc");
    include("misc_func.inc");
    include("byte_func.inc");
    include("global_settings.inc");
    include("smb_func.inc");
    
    function smb_get_error_code (data)
    {
     local_var header, flags2, code;
    
     # Some checks in the header first
     header = get_smb_header (smbblob:data);
     if (!header)
       return NULL;
    
     flags2 = get_header_flags2 (header:header);
     if (flags2 & SMB_FLAGS2_32BIT_STATUS)
     {
       code = get_header_nt_error_code (header:header);
     }
     else
     {
       code = get_header_dos_error_code (header:header);
     }
    
     return code;
    }
    
    
    function my_smb_trans_and_x (setup, transname, param, data, max_pcount, max_dcount)
    {
     local_var header, parameters, dat, packet, ret, pad1, trans, p_offset, d_offset, plen, dlen, slen, pad2, npad;
    
     npad = pad1 = pad2 = NULL;
    
     if (session_is_unicode () == 1)
      trans = cstring (string:transname);
     else
      trans = transname;
    
     header = smb_header (Command: SMB_COM_TRANSACTION,
                          Status: nt_status (Status: STATUS_SUCCESS));
    
     p_offset = 32 + 1 + 28 + strlen(setup) + 2 + strlen(trans);
    
     # Unicode transname should be aligned to 2 byte 
     if(session_is_unicode() == 1)
     {
      npad = crap(data:'\x00', length: (2 - p_offset % 2) % 2);
      p_offset += strlen(npad);
     }
    
     # Parameter is aligned to 4 byte
     pad1 = crap(data:'\x00', length: (4 - p_offset % 4) % 4);
     p_offset += strlen(pad1);
    
     # Data is aligned to 4 byte
     d_offset = p_offset + strlen (param);
     pad2 = crap(data:'\x00', length: (4 - d_offset % 4) % 4);
     d_offset += strlen(pad2);
    
     plen = strlen(param);
     dlen = strlen(data);
     slen = strlen(setup);
    
     if(isnull(max_pcount)) max_pcount =0xffff;
     if(isnull(max_dcount)) max_dcount =0xffff;
    
     parameters = 
            raw_word (w:plen)       +   # total parameter count
    	      raw_word (w:dlen)       +   # total data count
    	      raw_word (w:max_pcount) +   # Max parameter count
    	      raw_word (w:max_dcount) +   # Max data count
    	      raw_byte (b:0)          +   # Max setup count
            raw_byte (b:0)          +   # Reserved
    	      raw_word (w:0)          +   # Flags
    	      raw_dword (d:0)         +   # Timeout
    	      raw_word (w:0)          +   # Reserved
    	      raw_word (w:plen)       +   # Parameter count
    	      raw_word (w:p_offset)   +   # Parameter offset
    	      raw_word (w:dlen)       +   # Data count
    	      raw_word (w:d_offset)   +   # Data offset
    	      raw_byte (b:slen/2)     +   # Setup count
    	      raw_byte (b:0);             # Reserved
    
     parameters += setup;
    
     parameters = smb_parameters (data:parameters);
    
     dat = npad +
           trans +
           pad1 +
           param +
           pad2 +
           data;
    
     dat = smb_data (data:dat);
    
     packet = netbios_packet (header:header, parameters:parameters, data:dat);
    
     ret = smb_sendrecv (data:packet);
     if (!ret)
       return NULL;
    
     return smb_get_error_code (data:ret);
    }
    
    
    #
    # MAIN
    #
    
    # Make sure it's Windows 
    os = get_kb_item_or_exit("Host/OS");
    if ("Windows" >!< os)
      audit(AUDIT_HOST_NOT, "Windows"); 
      
    # Make sure SMBv1 is enabled
    if (! get_kb_item("SMB/SMBv1_is_supported"))
      exit(0, "SMB version 1 does not appear to be enabled on the remote host."); 
    
    if (!smb_session_init(smb2:FALSE)) audit(AUDIT_FN_FAIL, 'smb_session_init');
    
    r = NetUseAdd(share:"IPC$");
    if (r != 1)
    {
      exit(1, 'Failed to connect to the IPC$ share anonymously.');
    }
    
    fid = 0; # Invalid FID 
    setup = raw_word (w:0x23) + raw_word (w:fid);  
    
    status = my_smb_trans_and_x (setup: setup, transname:"\PIPE\");
    NetUseDel();
    
    if(! isnull(status))
    {
      if(status == STATUS_INVALID_HANDLE
        ||  status == STATUS_ACCESS_DENIED # Win 10
      )
      {
        audit(AUDIT_HOST_NOT , "affected"); 
      }
      else if (status == STATUS_INSUFF_SERVER_RESOURCES)
      {
        port = kb_smb_transport();
        security_report_v4(port: port, severity: SECURITY_HOLE);
      }
      else
      {
        status = "0x" + toupper(hexstr(mkdword(status)));
        audit(AUDIT_RESP_BAD, port, "an SMB_COM_TRANSACTION request. Status code: " + status);
      }
    }
    else
    {
      exit(1, "Failed to get response status for an SMB_COM_TRANSACTION request."); 
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17-010.NASL
    descriptionThe remote Windows host is missing a security update. It is, therefore, affected by the following vulnerabilities : - Multiple remote code execution vulnerabilities exist in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of certain requests. An unauthenticated, remote attacker can exploit these vulnerabilities, via a specially crafted packet, to execute arbitrary code. (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0148) - An information disclosure vulnerability exists in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of certain requests. An unauthenticated, remote attacker can exploit this, via a specially crafted packet, to disclose sensitive information. (CVE-2017-0147) ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers. WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via ETERNALBLUE.
    last seen2020-06-01
    modified2020-06-02
    plugin id97737
    published2017-03-15
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97737
    titleMS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(97737);
      script_version("1.24");
      script_cvs_date("Date: 2019/11/13");
    
      script_cve_id(
        "CVE-2017-0143",
        "CVE-2017-0144",
        "CVE-2017-0145",
        "CVE-2017-0146",
        "CVE-2017-0147",
        "CVE-2017-0148"
      );
      script_bugtraq_id(
        96703,
        96704,
        96705,
        96706,
        96707,
        96709
      );
      script_xref(name:"MSFT", value:"MS17-010");
      script_xref(name:"MSKB", value:"4012212");
      script_xref(name:"MSKB", value:"4012213");
      script_xref(name:"MSKB", value:"4012214");
      script_xref(name:"MSKB", value:"4012215");
      script_xref(name:"MSKB", value:"4012216");
      script_xref(name:"MSKB", value:"4012217");
      script_xref(name:"MSKB", value:"4012606");
      script_xref(name:"MSKB", value:"4013198");
      script_xref(name:"MSKB", value:"4013429");
      script_xref(name:"MSKB", value:"4012598");
      script_xref(name:"IAVA", value:"2017-A-0065");
      script_xref(name:"EDB-ID", value:"41891");
      script_xref(name:"EDB-ID", value:"41987");
    
      script_name(english:"MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)");
      script_summary(english:"Checks the version of the SYS files.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing a security update. It is,
    therefore, affected by the following vulnerabilities :
    
      - Multiple remote code execution vulnerabilities exist in
        Microsoft Server Message Block 1.0 (SMBv1) due to
        improper handling of certain requests. An
        unauthenticated, remote attacker can exploit these
        vulnerabilities, via a specially crafted packet, to
        execute arbitrary code. (CVE-2017-0143, CVE-2017-0144,
        CVE-2017-0145, CVE-2017-0146, CVE-2017-0148)
    
      - An information disclosure vulnerability exists in
        Microsoft Server Message Block 1.0 (SMBv1) due to
        improper handling of certain requests. An
        unauthenticated, remote attacker can exploit this, via a
        specially crafted packet, to disclose sensitive
        information. (CVE-2017-0147)
    
    ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are
    four of multiple Equation Group vulnerabilities and exploits disclosed
    on 2017/04/14 by a group known as the Shadow Brokers. WannaCry /
    WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit,
    and EternalRocks is a worm that utilizes seven Equation Group
    vulnerabilities. Petya is a ransomware program that first utilizes
    CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads
    via ETERNALBLUE.");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010");
      # https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?321523eb");
      # https://cloudblogs.microsoft.com/microsoftsecure/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/?source=mmpc
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?065561d0");
      # https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d9f569cf");
      script_set_attribute(attribute:"see_also", value:"https://github.com/stamparm/EternalRocks/");
      # https://www.tenable.com/blog/petyanotpetya-ransomware-detection-for-the-modern-enterprise
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59db5b5b");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Windows Vista, 2008, 7,
    2008 R2, 2012, 8.1, RT 8.1, 2012 R2, 10, and 2016. Microsoft has also
    released emergency patches for Windows operating systems that are no
    longer supported, including Windows XP, 2003, and 8.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-0148");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_set_attribute(attribute:"in_the_news", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/03/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "smb_check_rollup.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS17-010';
    kbs = make_list(
      "4012212",
      "4012213",
      "4012214",
      "4012215",
      "4012216",
      "4012217",
      "4012606",
      "4013198",
      "4013429",
      "4012598"
    );
    
    vuln = 0;
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(xp:'3', win2003:'2',vista:'2', win7:'1', win8:'0', win81:'0', win10:'0') <= 0)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    if (hotfix_check_server_nano() == 1) audit(AUDIT_OS_NOT, "a currently supported OS (Windows Nano Server)");
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows Embedded" >< productname)
      exit(0, "Nessus does not support bulletin / patch checks for Windows Embedded.");
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share))
      audit(AUDIT_SHARE_FAIL, share);
    
    if (
      ##############
      ## MAY 2017 ##
      ##############
    
      # Windows XP SP2
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"srv.sys", version:"5.2.3790.6021", min_version:"5.2.3790.3000", dir:"\system32\drivers", bulletin:bulletin, kb:"4012598", arch:"x64") ||
      # Windows XP SP3
      hotfix_is_vulnerable(os:"5.1", sp:3, file:"srv.sys", version:"5.1.2600.7208", min_version:"5.1.2600.5000", dir:"\system32\drivers", bulletin:bulletin, kb:"4012598", arch:"x86") ||
      # Windows Server 2003 SP2
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"srv.sys", version:"5.2.3790.6021", min_version:"5.2.3790.3000", dir:"\system32\drivers", bulletin:bulletin, kb:"4012598") ||
      # Windows 8
      (
        ("Windows 8" >< productname && "Windows 8.1" >!< productname && "2012" >!< productname)
        &&
        hotfix_is_vulnerable(os:"6.2", sp:0, file:"srv.sys", version:"6.2.9200.22099", min_version:"6.2.9200.16000", dir:"\system32\drivers", bulletin:bulletin, kb:"4012598")
      )
      ||
      
      # Windows Server 2012
      (
        "Windows 8" >!< productname
        &&
        hotfix_is_vulnerable(os:"6.2", sp:0, file:"srv.sys", version:"6.2.9200.22099", min_version:"6.2.9200.16000", dir:"\system32\drivers", bulletin:bulletin, kb:"4019213")
      ) ||
    
      # Windows 8.1 / Windows Server 2012 R2
        hotfix_is_vulnerable(os:"6.3", sp:0, file:"srv.sys", version:"6.2.9200.22137", min_version:"6.2.9200.16000", dir:"\system32\drivers", bulletin:bulletin, kb:"4019213") ||
    
      ##############
      ## MAR 2017 ##
      ##############
    
      # Windows Vista Service Pack 2 / Windows Server 2008
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"srv.sys", version:"6.0.6002.19743", min_version:"6.0.6002.18000", dir:"\system32\drivers", bulletin:bulletin, kb:"4012598") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"srv.sys", version:"6.0.6002.24067", min_version:"6.0.6002.20000", dir:"\system32\drivers", bulletin:bulletin, kb:"4012598") ||
    
      # Windows 7 / Windows Server 2008 R2
      smb_check_rollup(os:"6.1", sp:1, rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012212, 4012215)) ||
    
      # Windows Server 2012
      (
        "Windows 8" >!< productname
        &&
        smb_check_rollup(os:"6.2", sp:0, rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012214, 4012217))
      ) ||
    
      # Windows 8.1 / Windows Server 2012 R2
      smb_check_rollup(os:"6.3", sp:0, rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012213, 4012216)) ||
    
      # Windows 10
      smb_check_rollup(os:"10", sp:0, os_build:"10240", rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012606)) ||
    
      # Windows 10 1511
      smb_check_rollup(os:"10", sp:0, os_build:"10586", rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4013198)) ||
    
      # Windows 10 1607 / Windows Server 2016
      smb_check_rollup(os:"10", sp:0, os_build:"14393", rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4013429))
    )
    {
      set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    

Packetstorm

Seebug

bulletinFamilyexploit
descriptionFrom the shadowbroker, Windows XP to Windows 2012 SMB remote code execution vulnerability, corresponding to the number ETERNALBLUE it. * [CVE-2017-0143](<http://cvedetails.com/cve/cve-2017-0143>) * [CVE-2017-0144](<http://cvedetails.com/cve/cve-2017-0144>) * [CVE-2017-0145](<http://cvedetails.com/cve/cve-2017-0145>) * [CVE-2017-0146](<http://cvedetails.com/cve/cve-2017-0146>) * [CVE-2017-0147](<http://cvedetails.com/cve/cve-2017-0147>) * [CVE-2017-0148](<http://cvedetails.com/cve/cve-2017-0148>) Reference: https://github.com/misterch0c/shadowbroker/blob/master/windows/specials/
idSSV:92952
last seen2017-11-19
modified2017-04-15
published2017-04-15
reporterRoot
titleETERNALBLUE - Remote RCE via SMB & NBT (Windows XP to Windows 2012)