MS17-010: Security Update for Microsoft Windows SMB Server

MS17-010 is the Microsoft bulletin that fixed the SMBv1 flaws leaked by the Shadow Brokers in April 2017 — most famously CVE-2017-0144 (EternalBlue), plus EternalRomance, EternalChampion, and EternalSynergy. The bug is a memory corruption in the SMBv1 srv.sys/srv2.sys transaction handling that a remote, unauthenticated attacker can trigger by sending a crafted packet to TCP/445, yielding kernel-mode RCE as NT AUTHORITY\SYSTEM. Affected versions span every mainstream Windows release from Windows XP / Server 2003 through Windows 10 1607 / Server 2016 prior to the March 2017 patches (KB4012212/KB4012213/KB4012214/KB4012215/KB4012216/KB4012217/KB4012598 and the emergency out-of-band KB4012598 for XP/2003).

Tenable's HIGH rating understates reality. This is the vulnerability that powered WannaCry, NotPetya, Bad Rabbit, EternalRocks, TrickBot lateral movement, and every ransomware crew's post-2017 playbook. CISA KEV-listed since day one of the catalog, EPSS pegged at the ceiling, Metasploit + open-source PoCs everywhere. The real-world verdict is CRITICAL — not because the bug is novel, but because any host still exposing SMBv1 in 2026 is unmanaged, unmonitored, and one probe away from wormed ransomware.

Why this verdict

• Unauthenticated + wormable + KEV: the trifecta that historically justifies the CRITICAL floor with no adjustments needed.
• Role multiplier: a hit on plugin 97833 in 2026 almost always identifies a *high-value or high-risk role* host — OT jump box, legacy domain controller, embedded medical/industrial appliance, or forgotten file server — because everything under active management was patched years ago. Chain outcome: SYSTEM → LSASS dump → domain pivot → ransomware fan-out.
• Friction is near zero: exploit is one-shot with Metasploit, no auth, no user interaction, no unusual preconditions beyond reachability + SMBv1 on.
• Historical base rate: every mass ransomware event that used SMB lateral movement since 2017 (WannaCry, NotPetya, Ryuk, Conti) leveraged this exact primitive — the outcome distribution is not theoretical.

Why not higher?

10.0 is reserved for pre-auth RCE with zero prerequisites AND ubiquitous exposure. MS17-010 requires TCP/445 reachability and SMBv1 enabled, both of which are absent in the vast majority of modern managed fleets. That single friction point holds it at 9.8 rather than 10.0.

Why not lower?

You cannot rationally downgrade a KEV-listed, wormable, unauthenticated SYSTEM RCE with EPSS ~0.94 and a nine-year history of ransomware weaponization. The 'requires SMBv1 enabled' argument doesn't lower the verdict — it means the finding itself is a proof of misconfiguration that has already survived every hardening baseline of the last decade.

1. Block TCP/445 (and 139) inbound at every perimeter and between segments today — SMB should never be internet-reachable. Between segments, restrict 445 to explicit file-server subnets. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Disable SMBv1 fleet-wide via GPO / Intune / Ansible — Set-SmbServerConfiguration -EnableSMB1Protocol $false on servers; Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol on clients. Push through configuration management within the 3-day mitigation window.
3. Quarantine any host that Nessus 97833 flags — Move it off the production VLAN into an isolated remediation network until patched and rebooted. Treat every hit as a potential live-implanted host until you confirm otherwise.
4. Hunt for DoublePulsar and existing kernel implants — Run Detect-DoublePulsar.py or Countercept scripts against every flagged host. Assume compromise on any long-lived unpatched box — it's had years to be found.
5. Enable SMB signing and require SMBv2/3 with encryption — Set-SmbServerConfiguration -RequireSecuritySignature $true -EncryptData $true. Defense-in-depth against downstream relay/coercion abuse.

Run this on the target Windows host as Administrator (or under a management agent context with local admin) to determine patch state and SMBv1 status. Example: powershell -ExecutionPolicy Bypass -File Check-MS17-010.ps1. For remote sweeping, wrap it in Invoke-Command -ComputerName $hosts from an admin workstation.

#requires -RunAsAdministrator
# Check-MS17-010.ps1 — noisgate MS17-010 / EternalBlue verifier
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

$ErrorActionPreference = 'Stop'

# Table of minimum patched file versions for srv.sys / srv2.sys per Windows build
# See https://support.microsoft.com/help/4013389
$patchedKBs = @(
    'KB4012212','KB4012213','KB4012214','KB4012215','KB4012216','KB4012217',
    'KB4012606','KB4013198','KB4013429','KB4012598',
    'KB4015550','KB4019215','KB4019216','KB4019264','KB4019472'
)

try {
    $os = Get-CimInstance Win32_OperatingSystem
    Write-Host "Host: $env:COMPUTERNAME  OS: $($os.Caption) $($os.Version)"

    # 1. SMBv1 enabled?
    $smb1 = $null
    try { $smb1 = (Get-SmbServerConfiguration -ErrorAction Stop).EnableSMB1Protocol } catch {}
    if ($null -eq $smb1) {
        $reg = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name SMB1 -ErrorAction SilentlyContinue
        $smb1 = if ($reg -and $reg.SMB1 -eq 0) { $false } else { $true }
    }
    Write-Host "SMBv1 enabled: $smb1"

    # 2. Any relevant hotfix installed?
    $installed = Get-HotFix -ErrorAction SilentlyContinue | Where-Object { $patchedKBs -contains $_.HotFixID }
    $hasKB = [bool]$installed
    if ($hasKB) { Write-Host "Found patch(es): $($installed.HotFixID -join ', ')" }

    # 3. srv.sys file version check as fallback (KB list is incomplete on rolled-up builds)
    $srv = Get-Item -Path "$env:SystemRoot\System32\drivers\srv.sys" -ErrorAction SilentlyContinue
    $srvVer = if ($srv) { $srv.VersionInfo.FileVersion } else { 'not present' }
    Write-Host "srv.sys version: $srvVer"

    # Decision matrix
    if (-not $smb1 -and $hasKB) {
        Write-Host 'RESULT: PATCHED (SMBv1 disabled AND patch present)' -ForegroundColor Green
        exit 0
    }
    if ($smb1 -and -not $hasKB) {
        Write-Host 'RESULT: VULNERABLE (SMBv1 enabled AND no MS17-010 hotfix detected)' -ForegroundColor Red
        exit 1
    }
    if ($smb1 -and $hasKB) {
        Write-Host 'RESULT: PATCHED-BUT-EXPOSED (patch present but SMBv1 still enabled — disable it now)' -ForegroundColor Yellow
        exit 1
    }
    Write-Host 'RESULT: UNKNOWN (SMBv1 disabled but no MS17-010 KB in Get-HotFix; verify via srv.sys build)' -ForegroundColor Yellow
    exit 2
} catch {
    Write-Host "RESULT: UNKNOWN — $($_.Exception.Message)" -ForegroundColor Yellow
    exit 2
}

Sources

1. Microsoft MS17-010 Security Bulletin
2. CISA KEV Catalog — CVE-2017-0144
3. NVD CVE-2017-0144
4. Tenable Plugin 97833
5. Microsoft KB4013389 — MS17-010 patch guidance
6. worawit MS17-010 PoC
7. Metasploit ms17_010_eternalblue module
8. Microsoft — Disable SMBv1