Ms17-010

MS17-010, also known as "EternalBlue," "EternalSynergy," or "Eternal Romance," is a significant vulnerability in Microsoft's Server Message Block 1.0 (SMBv1) protocol that allows for remote code execution. It was first addressed by Microsoft through the release of security bulletin MS17-010 on March 14, 2017, which provided a patch for the exploit. This vulnerability affects various operating systems, including Windows XP with Service Pack 2 and 3, Windows 7 64 bit with Service Pack 1, and Windows Server 2008 with Service Pack 1. The WannaCry malware, also known as WCry or WanaCryptor, exploited this vulnerability to propagate itself like a worm. It spread through internal networks and over the public internet by taking advantage of MS17-010 in the SMB protocol. The primary infection vector in testing scenarios was a Windows 2008 Server with Service Pack 1, where the WannaCry binary was manually executed on the host. The exploitation process involves the malware executing the service function, registering the service handlers, and attempting to exploit MS17-010 against identified SMB services. When an attempt to connect to an IP on port 445 is successful, the malware tries to exploit the service via the vulnerability described in MS17-010. Despite Microsoft's efforts to patch this flaw, it remains relevant due to its potential for widespread damage and the continued presence of unpatched systems.