lassehauballe/eternalblue

Eternalblue written in CSharp. Contains version detection, vulnerability scanner and exploit of MS17-010

Eternalblue in C#

This project is an almost direct translation of https://github.com/EmpireProject/Empire/blob/master/data/module_source/exploitation/Exploit-EternalBlue.ps1. However, the Empire-script did not test if the target is vulnerable. To test for this, I also translated a bit of Metasploits auxiliary/scanner/smb/smb_ms17_010

This was created as an educational project to help myself gain an understanding of how Eternalblue actually works.
Please do use at your own risk, as I have also seen a couple of BSOD during development.
The code has only been tested using msfvenom x64 exec, meterpreter reverse shell shellcode and cobaltstrike. Remember this is the old eternalblue exploit, so should not work on windows 8 and newer.

Updates:

• It is hardcoded with 'Grooms' set to 12
• It can now be run using either "detect or exploit". The first will only detect if its vulnerable or not.
• It can be run with either an IP or the word 'all'. In the latter, it will go through every host on the subnet. At this time, it only spreads on 192.168.XXX.XXX/24 networks.

How to use:

1. Replace the shellcode byte[] called 'buf' in Exploit (line 1028) (The current shellcode just starts notepad.exe (as system))
2. Compile
3. Eternalblue.exe [detect/exploit] [ip/all]

Video: With Cobalt-Strike payload

Eternalblue.exe running in detect-mode on the entire network

Eternalblue.exe running in exploit-mode on the entire network

eternalblue's Issues

net 2.0

It is recommended to adapt to the lower version of net 2.0. Windows Server 2008, etc. only support net 2.0.

Didn't worked on Windows XP

Hi, I wanted to test it on windows XP, the first time it's said exploit sent successfully and nothing happened and in second try the system got crashed.

Which file is Exploit?

How to transform into command parameter input？

Hello, I want to change the script to be able to enter commands for execution, but I changed the notepad.exe bytes in the shellcode of the notepad.exe you provided to ping www.xxx.com, and found that the ping command was not executed, you can give Do I provide a solution?

eternalblue doublepulsar

You're project works very well, but do you know how to install doublepulsar with eternalblue? (instead of shellcode injection)

Crashes x86 Targets

running fine against x64 targets ,but when I generate an x86 shellcode & run it against x86 target
at first it does nothing, but then target crashes "BSoD".

windows2003

如何测试

Unable to connect to cobalt strike

I use Cobalt strike to generate the shellcode of C #, and replace the shellcode of 1028 lines, so I can't successfully go online to cobalt strike

shellcode

how to create a shellcode? decoding the shellcode only shows notepad, i want to know what's the way that notepad is getting executed?