Microsoft Windows SMBv1 Remote Code Execution Vulnerability (CVE-2017-0144, EternalBlue)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-0144) is a critical memory corruption (buffer overflow) vulnerability in the Microsoft Windows Server Message Block v1 (SMBv1) protocol implementation. An integer overflow occurs within the srv.sys kernel driver when processing transaction parameter sizes in incoming SMBv1 requests. This mathematical error leads to an out-of-bounds write, allowing data to overflow from a allocated non-paged pool buffer into adjacent memory regions.

2. Exploitation Mechanics & Attack Scenario

An attacker targets a system with TCP port 445 exposed. By sending a sequence of precisely crafted SMBv1 SMB_COM_TRANSACTION2 or SMB_COM_NT_TRANSACT packets, the attacker performs 'pool grooming' to arrange the kernel memory layout. Once the memory is aligned, the attacker triggers the buffer overflow to hijack the kernel execution flow, injecting and executing an in-memory payload such as the DOUBLEPULSAR backdoor. This entire process requires no authentication or user interaction.

3. Infrastructure & Business Impact

This vulnerability was famously leveraged by the 'WannaCry' and 'NotPetya' ransomware campaigns to achieve rapid self-propagation. A single compromised machine within an internal network allows attackers to automate lateral movement and privilege escalation across all vulnerable Windows hosts on the same subnet. This can result in catastrophic business disruption, widespread data encryption, and sensitive data exfiltration.