CVE-2017-0144 Vulnerability and EternalBlue Exploit: Risk Assessment and Preventative Measures

Network and Security
Name:
Course
Professor’s name
University name
City, State
Date of submission

Introduction
The CVE-2017-0144 is a vulnerability that uses the EternalBlue exploit that takes advantage of a
vulnerability in the Microsoft’s implementation of SMB protocol. SMB (Server Message Block)
is a file sharing protocol trough the network that employs a client-server mechanism to share
files, serial ports and printers. The protocol allows a client or a user application to communicate
with a remote server and thus the client can view files, read, copy and create files on the remote
server. The SMB protocol also allows communication from client to any server program that
accepts SMB requests. The eternalblue exploit uses the SMB protocol vulnerabilities to gain
access to remote devices that accepts requests through this protocol (Stefan Rass, Bo An,
Christopher Kiekintveld, Fei Fang, Stefan Schauer, 2017).
Why the Vulnerability Exists
The most logical explanation for the existence of this vulnerability is the fact that the SMB
version 1 protocol mishandle some well-crafted packets on various versions of Microsoft devices
allowing remote execution of code on targeted devices. An unauthenticated attacker who

successfully exploits this vulnerability I able to send specially crafted packets to an SMB1 server
(Microsoft, 2017).
EternalBlue Exploit
Step 1. Download eternal blue and copy the module into the folder usr/share/metasploit-
framework/modules/exploits/windows/smb.