Microsoft Windows SMBv1 Remote Code Execution Vulnerability (CVE-2017-0145, EternalBlue/DoublePulsar)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-0145) is a critical remote code execution (RCE) flaw in the legacy Server Message Block v1 (SMBv1) protocol implementation in Microsoft Windows. The root cause lies in the improper handling of specially crafted SMBv1 transaction requests. The SMBv1 server fails to properly validate the buffer size and offset parameters of incoming packets, leading to a buffer overflow and kernel memory corruption.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending malformed SMBv1 packets to a target system listening on TCP port 445. These packets trigger an out-of-bounds write in the Windows kernel pool memory. Once memory corruption is achieved, the attacker can inject and execute shellcode with kernel-level privileges (SYSTEM) without authentication. This specific vulnerability was famously weaponized by the Shadow Brokers under the codename 'EternalBlue' and paired with the 'DoublePulsar' payload injector to orchestrate global ransomware campaigns like WannaCry and NotPetya.

3. Infrastructure & Business Impact

With its inclusion in the CISA KEV catalog and an EPSS score of 0.8985, this vulnerability represents an extreme threat vector. Successful exploitation allows immediate, unauthenticated remote takeover of the target host. In an enterprise environment, this enables rapid lateral movement, domain-wide compromise, massive ransomware deployment, and catastrophic business disruption.