Exploit for CVE-2017-0144

## https://sploitus.com/exploit?id=06770B2C-94BD-58AA-8448-69F12A353089
# LegacyShield — EternalBlue Module

A Windows desktop security application that provides a **defensive
compensating control** for systems still exposed to **CVE-2017-0144
(MS17-010 / EternalBlue)** — most commonly legacy or unsupported Windows
installations that can no longer receive official Microsoft security
updates.

> **LegacyShield does not patch the underlying SMBv1 vulnerability.**
> It reduces attack surface and improves visibility through monitoring,
> heuristic detection, automated (temporary, reversible) firewall
> mitigation, structured logging, and professional reporting. Applying the
> official MS17-010 update, or upgrading to a supported Windows version,
> remains the definitive remediation.
>
> This project contains **no exploit code, proof-of-concept attack code,
> privilege escalation techniques, or offensive tooling of any kind.**

---

## What it does

| Capability | Summary |
|---|---|
| System Assessment | Reads (never writes) Windows version, SMBv1 status, port 139/445 exposure, firewall state, file sharing, and network profile. Produces a 0–100 security score. |
| SMB Monitoring | Polls TCP 139/445 via the OS connection table for new inbound connections. No packet capture or payload inspection. |
| Detection Engine | Configurable heuristics: connection bursts, per-minute volume, repeated failed negotiations. |
| Automated Response | Creates **temporary, tagged, auto-expiring** Windows Firewall block rules for offending sources; never touches rules it didn't create; full rollback support. |
| Logging | Structured JSON/CSV/plain-text logs, plus Windows Event Log entries for high-severity events. |
| Reporting | Executive-summary security reports exportable as JSON, HTML, or PDF. |
| Desktop UI | PySide6 dashboard, sidebar navigation, system tray notifications. |
| Background Service | Optional `pywin32`-based Windows Service so protection continues when the GUI is closed. |

## Project layout

```
LegacyShield/
├── main.py                     # GUI entry point (+ install/uninstall/rollback CLI verbs)
├── legacyshield/
│   ├── core/                   # Read-only system inspection, scoring, shared models
│   ├── modules/                # Config, detection engine, response engine, whitelist
│   ├── services/                # SMB monitor, firewall service, background Windows Service
│   ├── logging_/                # JSON/CSV/text log writers + Windows Event Log mirror
│   ├── reports/                 # JSON/HTML/PDF report generator + HTML template
│   └── ui/                      # PySide6 main window, sidebar, dashboard, pages, tray
├── config/default_config.json  # Shipped default configuration
├── installer/                  # PyInstaller spec, build script, manifest, Inno Setup script
├── tests/                      # pytest suite incl. mocked-Windows-API tests
├── samples/                    # Example config/log/report output
└── docs/                       # Guides referenced below
```

See [ARCHITECTURE.md](ARCHITECTURE.md) for the full design,
including UML class and sequence diagrams.

## Quick start (development)

```bash
python -m venv .venv
.venv\Scripts\activate            # Windows
pip install -r requirements-dev.txt
pytest tests/ -v
python main.py
```

> The GUI (`main.py`) and Windows Service (`legacyshield/services/background_service.py`)
> require Windows + `pywin32`. The core/modules/services business logic is
> platform-independent and its test suite runs on any OS via mocked
> Windows API protocols — see `tests/mocks/windows_mocks.py`.

## Building the installer

```bash
pip install -r requirements-dev.txt
python installer/build.py           # runs tests, then PyInstaller -> dist/LegacyShield.exe
iscc installer/installer.iss        # optional: Inno Setup -> dist/installer/LegacyShield-Setup-*.exe
```

## Documentation

- [Installation Guide](INSTALLATION.md)
- [Administrator Guide](ADMINISTRATOR_GUIDE.md)
- [Developer Guide](DEVELOPER_GUIDE.md)
- [Architecture Overview](ARCHITECTURE.md)
- [API Documentation](API_DOCUMENTATION.md)
- [Known Limitations](KNOWN_LIMITATIONS.md)
- [Future Enhancements](FUTURE_ENHANCEMENTS.md)

## License / Portfolio note

This is a defensive-engineering portfolio project demonstrating Windows
systems programming, monitoring/detection design, and secure application
architecture. It ships without a specific license; add one appropriate to
your intended use before distribution.