Beyond configuration and relay, the SMB server code itself has carried serious remote vulnerabilities, several wormable and pre-authentication. They are worth separating from the relay and looting surfaces because they give direct code execution on the server, not just file access. The notable classes:
- EternalBlue (SMBv1): a pre-auth memory-corruption flaw in the SMBv1 server, exploited at scale by WannaCry and NotPetya; any host still offering SMBv1 is a candidate.
- SMBGhost (SMBv3 compression): a pre-auth integer-overflow in the SMBv3.1.1 compression handling, giving remote code execution against unpatched systems.
- Other server bugs: the SMB server has had additional out-of-bounds and use-after-free issues over time, tracked by the vendor.
Fingerprint the exposure#
# which dialects and whether SMBv1 is present
nmap -p445 --script smb-protocols <target> # lists SMBv1/2/3 dialects offered
nxc smb <target> # OS build and SMBv1 status
# version-aware vulnerability scripts
nmap -p445 --script smb-vuln-ms17-010 <target> # EternalBlue check
The server's OS build and the dialects it offers decide which of these applies: SMBv1 presence points at the EternalBlue class, and a vulnerable SMBv3.1.1 build at SMBGhost. Match the build to the advisory.
Exploitation notes#
- These give remote code execution on the SMB server directly, typically as SYSTEM, a higher-value outcome than file access; treat an SMBv1-speaking or unpatched host as a priority.
- EternalBlue targets SMBv1, so disabling SMBv1 removes it; its continued presence on legacy systems is the exposure. SMBGhost targets a specific SMBv3.1.1 compression path on particular Windows builds.
- Fingerprint precisely (
smb-protocols, OS build) and match to the advisory; these are version-specific memory-corruption exploits, not configuration abuses. - Distinct from these implementation bugs, the relay and looting surfaces (which need no server bug) are on the other SMB pages.