Microsoft Windows SMBv1 Remote Code Execution Vulnerability (CVE-2017-0143, EternalBlue)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-0143) is a critical memory corruption and remote code execution (RCE) flaw in the Microsoft Windows Server Message Block 1.0 (SMBv1) protocol implementation. The root cause lies within the srv.sys kernel driver, which incorrectly handles specially crafted SMB packets. When processing large transaction requests, a buffer overflow and memory misalignment occur during size calculation, allowing attackers to overwrite kernel pool memory with arbitrary data.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates the exploit by scanning for open TCP port 445 (SMB) on target systems. Once identified, the attacker transmits specially crafted SMB_COM_TRANSACTION2 or SMB_COM_NT_TRANSACT request packets. This triggers a mismatch between the declared data offset and the actual size in the packet header, leading to a kernel pool overflow. Successful exploitation allows the attacker to inject and execute shellcode (such as the DoublePulsar payload) with NT AUTHORITY\SYSTEM privileges without authentication.

3. Infrastructure & Business Impact

Widely known as the core vulnerability leveraged by the 'EternalBlue' exploit, this flaw was the primary vector for devastating global ransomware campaigns including WannaCry and NotPetya. It is listed in CISA's KEV catalog and maintains an extremely high EPSS score (>0.93), indicating active and widespread exploitation attempts. A single unpatched system can serve as an entry point for lateral movement, leading to domain-wide compromise and catastrophic business disruption.