[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXWN049MAJSD5M0ASF5YAZ":3,"skill-same:01M6GXWN049MAJSD5M0ASF5YAZ":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M6GXWN049MAJSD5M0ASF5YAZ","exploiting-ms17-010-eternalblue-vulnerability",null,"MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"vulnerability","eternalblue","exploiting ms17 010 eternalblue vulnerability","remote-code-execution","remote","code execution","post","critical","team","red-teaming","simulation","cybersecurity","execution","smb","exploitation","adversary-simulation","mitre-attack","post-exploitation","red-team","code","2026-11-10 10:12:30",false,"---\nname: exploiting-ms17-010-eternalblue-vulnerability\ndescription: MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it \ndomain: cybersecurity\nsubdomain: red-teaming\ntags: [red-team, adversary-simulation, mitre-attack, exploitation, post-exploitation, eternalblue, smb, remote-code-execution]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Exploiting MS17-010 EternalBlue Vulnerability\n\n## Overview\n\nMS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## MITRE ATT&CK Mapping\n\n- **T1210** - Exploitation of Remote Services\n- **T1190** - Exploit Public-Facing Application\n- **T1569.002** - System Services: Service Execution\n\n## Workflow\n\n### Phase 1: Vulnerability Scanning\n1. Scan target networks for SMB port 445\n2. Check for SMBv1 protocol support\n3. Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)\n4. Document vulnerable systems with OS version and patch level\n\n### Phase 2: Exploitation\n1. Select appropriate exploit variant based on target OS\n2. Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode)\n3. Execute exploit against confirmed vulnerable target\n4. Verify code execution and establish session\n\n### Phase 3: Post-Exploitation\n1. Establish persistence on compromised system\n2. Dump credentials from memory\n3. Use compromised host as pivot point\n4. Document exploitation evidence\n\n## Tools and Resources\n\n| Tool | Purpose |\n|------|---------|\n| Nmap ms-17-010 NSE scripts | Vulnerability detection |\n| Metasploit ms17_010_eternalblue | Exploitation module |\n| Metasploit ms17_010_psexec | Alternative exploitation |\n| AutoBlue-MS17-010 | Standalone Python exploit |\n| CrackMapExec | Mass SMB vulnerability scanning |\n\n## Detection Indicators\n\n- IDS\u002FIPS signatures for EternalBlue exploit traffic\n- SMBv1 negotiation from unusual source hosts\n- Event ID 7045: New service installation after exploitation\n- Anomalous named pipe activity on SMB\n- Large SMB write requests characteristic of buffer overflow\n\n## Validation Criteria\n\n- [ ] Vulnerable systems identified via scanning\n- [ ] Exploitation achieved on authorized target\n- [ ] Code execution confirmed with session established\n- [ ] Post-exploitation activities documented\n- [ ] Remediation recommendations provided\n","# Exploiting MS17-010 EternalBlue Vulnerability\n\n## Overview\n\nMS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## MITRE ATT&CK Mapping\n\n- **T1210** - Exploitation of Remote Services\n- **T1190** - Exploit Public-Facing Application\n- **T1569.002** - System Services: Service Execution\n\n## Workflow\n\n### Phase 1: Vulnerability Scanning\n1. Scan target networks for SMB port 445\n2. Check for SMBv1 protocol support\n3. Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)\n4. Document vulnerable systems with OS version and patch level\n\n### Phase 2: Exploitation\n1. Select appropriate exploit variant based on target OS\n2. Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode)\n3. Execute exploit against confirmed vulnerable target\n4. Verify code execution and establish session\n\n### Phase 3: Post-Exploitation\n1. Establish persistence on compromised system\n2. Dump credentials from memory\n3. Use compromised host as pivot point\n4. Document exploitation evidence\n\n## Tools and Resources\n\n| Tool | Purpose |\n|------|---------|\n| Nmap ms-17-010 NSE scripts | Vulnerability detection |\n| Metasploit ms17_010_eternalblue | Exploitation module |\n| Metasploit ms17_010_psexec | Alternative exploitation |\n| AutoBlue-MS17-010 | Standalone Python exploit |\n| CrackMapExec | Mass SMB vulnerability scanning |\n\n## Detection Indicators\n\n- IDS\u002FIPS signatures for EternalBlue exploit traffic\n- SMBv1 negotiation from unusual source hosts\n- Event ID 7045: New service installation after exploitation\n- Anomalous named pipe activity on SMB\n- Large SMB write requests characteristic of buffer overflow\n\n## Validation Criteria\n\n- [ ] Vulnerable systems identified via scanning\n- [ ] Exploitation achieved on authorized target\n- [ ] Code execution confirmed with session established\n- [ ] Post-exploitation activities documented\n- [ ] Remediation recommendations provided\n",{"name":5,"tags":43,"author":44,"domain":29,"license":14,"version":45,"subdomain":27,"description":7},[36,33,34,32,35,19,31,21],"mahipal","1.0","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add micsapp\u002Fmicstec-skills --skill exploiting-ms17-010-eternalblue-vulnerability",{"tool":59,"command":60},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill exploiting-ms17-010-eternalblue-vulnerability",{"tool":62,"command":63},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill exploiting-ms17-010-eternalblue-vulnerability","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002FSKILL.md",true,[67,73,78,84,88,92,98],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Ftemplate.md","ASSET","资产文件",677,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002Fassets\u002Ftemplate.md",{"path":74,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002FLICENSE",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",2053,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fstandards.md",1279,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002Freferences\u002Fstandards.md",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fworkflows.md",2112,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002Freferences\u002Fworkflows.md",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fagent.py","SCRIPT","脚本",4539,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002Fscripts\u002Fagent.py",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fprocess.py",9856,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002Fscripts\u002Fprocess.py",[103,140,169,190,210,235],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":120,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[110,115],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[121,122,123,124,125,126,127,128,129,130,26,131,132,133,134,135,136,137,138,139],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":154,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[146,147,150,153],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":148,"categoryName":149,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":151,"categoryName":152,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},[155,156,157,158,122,159,37,160,161,162,163,164,130,26,136,165,166,137,167,168],"deployment","apiops deployment","workflows","azure devops","infrastructure","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[175],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},[177,178,179,180,122,125,130,26,181,182,183,184,185,186,187,137,188,189,168,139],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":198,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[196,197],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},[199,180,200,130,184,201,122,155,202,203,204,205,26,206,137,207,208,209,138,139],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":216,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[217,218,219,157,220,221,222,223,130,224,225,226,227,228,229,230,231,232,233,234],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":241,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[237,242,243,244,245,246,247,182,248,249],"npm","js","calculate","node","math","user","compute","errors"]