{"uuid": "5c10a849-bfaf-4b61-80d2-2151f8e55cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-0143", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/smb/ms17_010_command.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"sleepya\", \"zerosum0x0\", \"Shadow Brokers\", \"Equation Group\"], \"autofilter_ports\": [139, 445], \"autofilter_services\": [\"netbios-ssn\", \"microsoft-ds\"], \"check\": false, \"default_credential\": false, \"description\": \"This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where\\n          primitive. This will then be used to overwrite the connection session information with as an\\n          Administrator session. From there, the normal psexec command execution is done.\\n\\n          Exploits a type confusion between Transaction and WriteAndX requests and a race condition in\\n          Transaction requests, as seen in the EternalRomance, EternalChampion, and EternalSynergy\\n          exploits. This exploit chain is more reliable than the EternalBlue exploit, but requires a\\n          named pipe.\", \"disclosure_date\": \"2017-03-14\", \"fullname\": \"auxiliary/admin/smb/ms17_010_command\", \"is_install_path\": true, \"mod_time\": \"2025-09-22 19:52:39 +0000\", \"name\": \"MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution\", \"needs_cleanup\": false, \"notes\": {\"AKA\": [\"ETERNALSYNERGY\", \"ETERNALROMANCE\", \"ETERNALCHAMPION\", \"ETERNALBLUE\"], \"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/auxiliary/admin/smb/ms17_010_command.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/smb/ms17_010_command\", \"references\": [\"MSB-MS17-010\", \"CVE-2017-0143\", \"CVE-2017-0146\", \"CVE-2017-0147\", \"URL-https://github.com/worawit/MS17-010\", \"URL-https://hitcon.org/2017/CMT/slide-files/d2_s2_r0.pdf\", \"URL-https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/\", \"ATT&CK-T1021.002\"], \"rport\": 445, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:56.290078Z"}