CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Vulnerability Details : CVE-2017-0144

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Publish Date : 2017-03-16 Last Update Date : 2018-06-20
Search Twitter   Search YouTube   Search Google

- CVSS Scores & Vulnerability Types

CVSS Score
9.3
Confidentiality Impact Complete (There is total information disclosure, resulting in all system files being revealed.)
Integrity Impact Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.)
Availability Impact Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication Not required (Authentication is not required to exploit the vulnerability.)
Gained Access None
Vulnerability Type(s) Execute Code
CWE ID 20

- Products Affected By CVE-2017-0144

# Product Type Vendor Product Version Update Edition Language
1 Application Microsoft Server Message Block 1.0 Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor Product Vulnerable Versions
Microsoft Server Message Block 1

- References For CVE-2017-0144

https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
https://www.exploit-db.com/exploits/42031/
EXPLOIT-DB 42031
https://www.exploit-db.com/exploits/42030/
EXPLOIT-DB 42030
http://www.securitytracker.com/id/1037991
SECTRACK 1037991
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 CONFIRM
https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf CONFIRM
https://www.exploit-db.com/exploits/41891/
EXPLOIT-DB 41891
https://www.exploit-db.com/exploits/41987/
EXPLOIT-DB 41987
https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf CONFIRM
http://www.securityfocus.com/bid/96704
BID 96704 Microsoft Windows SMB Server CVE-2017-0144 Remote Code Execution Vulnerability Release Date:2017-05-19

- Vulnerability Conditions

Vulnerability is valid if product versions listed below are used TOGETHER WITH(AND)

- Metasploit Modules Related To CVE-2017-0144

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
This module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a DWORD is subtracted into a WORD. The kernel pool is groomed so that overflow is well laid-out to overwrite an SMBv1 buffer. Actual RIP hijack is later completed in srvnet!SrvNetWskReceiveComplete. This exploit, like the original may not trigger 100% of the time, and should be run continuously until triggered. It seems like the pool will get hot streaks and need a cool down period before the shells rain in again. The module will attempt to use Anonymous login, by default, to authenticate to perform the exploit. If the user supplies credentials in the SMBUser, SMBPass, and SMBDomain options it will use those instead. On some systems, this module may cause system instability and crashes, such as a BSOD or a reboot. This may be more likely with some payloads.
Module type : exploit Rank : average Platforms : Windows
MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
EternalBlue exploit for Windows 8, Windows 10, and 2012 by sleepya The exploit might FAIL and CRASH a target system (depended on what is overwritten) The exploit support only x64 target Tested on: - Windows 2012 R2 x64 - Windows 8.1 x64 - Windows 10 Pro Build 10240 x64 - Windows 10 Enterprise Evaluation Build 10586 x64 Default Windows 8 and later installation without additional service info: - anonymous is not allowed to access any share (including IPC$) - More info: https://support.microsoft.com/en-us/help/3034016/ipc-share-and-null-session-behavior-in-windows - tcp port 445 is filtered by firewall Reference: - http://blogs.360.cn/360safe/2017/04/17/nsa-eternalblue-smb/ - "Bypassing Windows 10 kernel ASLR (remote) by Stefan Le Berre" https://drive.google.com/file/d/0B3P18M-shbwrNWZTa181ZWRCclk/edit Exploit info: - If you do not know how exploit for Windows 7/2008 work. Please read my exploit for Windows 7/2008 at https://gist.github.com/worawit/bd04bad3cd231474763b873df081c09a because the trick for exploit is almost the same - The exploit use heap of HAL for placing fake struct (address 0xffffffffffd00e00) and shellcode (address 0xffffffffffd01000). On Windows 8 and Wndows 2012, the NX bit is set on this memory page. Need to disable it before controlling RIP. - The exploit is likely to crash a target when it failed - The overflow is happened on nonpaged pool so we need to massage target nonpaged pool. - If exploit failed but target does not crash, try increasing 'GroomAllocations' value (at least 5) - See the code and comment for exploit detail. Disable NX method: - The idea is from "Bypassing Windows 10 kernel ASLR (remote) by Stefan Le Berre" (see link in reference) - The exploit is also the same but we need to trigger bug twice - First trigger, set MDL.MappedSystemVa to target pte address - Write '\x00' to disable the NX flag - Second trigger, do the same as Windows 7 exploit - From my test, if exploit disable NX
Module type : exploit Rank : average Platforms : Windows
MS17-010 SMB RCE Detection
Uses information disclosure to determine if MS17-010 has been patched or not. Specifically, it connects to the IPC$ tree and attempts a transaction on FID 0. If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does not have the MS17-010 patch. If the machine is missing the MS17-010 patch, the module will check for an existing DoublePulsar (ring 0 shellcode/malware) infection. This module does not require valid SMB credentials in default server configurations. It can log on as the user "\" and connect to IPC$.
Module type : auxiliary Rank : normal


CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.