{"uuid": "c3e5e445-26d1-4a4d-9ea0-3fce1406bf7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-0143", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_doublepulsar_rce.rb", "content": "{\"aliases\": [\"exploit/windows/smb/doublepulsar_rce\"], \"arch\": \"x64\", \"author\": [\"Equation Group\", \"Shadow Brokers\", \"zerosum0x0\", \"Luke Jennings\", \"wvu \", \"Jacob Robles\"], \"autofilter_ports\": [139, 445], \"autofilter_services\": [\"netbios-ssn\", \"microsoft-ds\"], \"check\": true, \"default_credential\": false, \"description\": \"This module executes a Metasploit payload against the Equation Group's\\n          DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE.\\n\\n          While this module primarily performs code execution against the implant,\\n          the \\\"Neutralize implant\\\" target allows you to disable the implant.\", \"disclosure_date\": \"2017-04-14\", \"fullname\": \"exploit/windows/smb/smb_doublepulsar_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:58 +0000\", \"name\": \"SMB DOUBLEPULSAR Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"DOUBLEPULSAR\"], \"RelatedModules\": [\"auxiliary/scanner/smb/smb_ms17_010\", \"exploit/windows/smb/ms17_010_eternalblue\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/windows/smb/smb_doublepulsar_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"windows/smb/smb_doublepulsar_rce\", \"references\": [\"MSB-MS17-010\", \"CVE-2017-0143\", \"CVE-2017-0144\", \"CVE-2017-0145\", \"CVE-2017-0146\", \"CVE-2017-0147\", \"CVE-2017-0148\", \"URL-https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html\", \"URL-https://countercept.com/blog/analyzing-the-doublepulsar-kernel-dll-injection-technique/\", \"URL-https://www.countercept.com/blog/doublepulsar-usermode-analysis-generic-reflective-dll-loader/\", \"URL-https://github.com/countercept/doublepulsar-detection-script\", \"URL-https://github.com/countercept/doublepulsar-c2-traffic-decryptor\", \"URL-https://gist.github.com/msuiche/50a36710ee59709d8c76fa50fc987be1\"], \"rport\": 445, \"session_types\": false, \"targets\": [\"Execute payload (x64)\", \"Neutralize implant\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:33.796833Z"}