New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Exploiting Ms17 010 Eternalblue Vulnerability

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's…

Apache-2.0Auto-check passedSecurity

Install Exploiting Ms17 010 Eternalblue Vulnerability

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-ms17-010-eternalblue-vulnerability -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills exploiting-ms17-010-eternalblue-vulnerability --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/exploiting-ms17-010-eternalblue-vulnerability .claude/skills/exploiting-ms17-010-eternalblue-vulnerability && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
exploiting-ms17-010-eternalblue-vulnerability
GitHub stars
34k
Token cost
~963 tokens
SKILL.md length
348 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's…

  • Works in 3 steps: Vulnerability Scanning → Exploitation → Post-Exploitation
  • Tasks that involve Penetration testing
  • SKILL.md covers Overview, When to Use, Prerequisites and MITRE ATT&CK Mapping, plus 4 more sections
  • Runs Python scripts from its folder

What it does

Exploiting Ms17 010 Eternalblue Vulnerability is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17010eternalblue/ms17010psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.

Its SKILL.md is about 960 tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Penetration testing and Red teaming and adversary simulation. It works with Metasploit and Nmap. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Penetration testing
  • Tasks that involve Red teaming and adversary simulation

Example prompts

  • “s SMBv1 implementation, using Nmap”
  • “Use the exploiting-ms17-010-eternalblue-vulnerability skill to detect and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in…”
  • “/exploiting-ms17-010-eternalblue-vulnerability”

Requirements

  • Python 3

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Vulnerability Scanning
  2. Exploitation
  3. Post-Exploitation

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Exploiting Ms17 010 Eternalblue Vulnerability loads about 963 tokens when it runs, and up to ~2.3k if it reads all its reference files. Until then it costs about 111 tokens; SKILL.md has 348 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~111
When it runs · the whole SKILL.md, loaded when a task matches
~963
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 348 words, ~963 tokens.

Download SKILL.mdSave it as .claude/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
exploiting-ms17-010-eternalblue-vulnerability
description
Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.
domain
cybersecurity
subdomain
red-teaming
tags
red-team, adversary-simulation, mitre-attack, exploitation, post-exploitation, eternalblue, smb, remote-code-execution
version
1.0
author
mahipal
license
Apache-2.0
d3fend_techniques
Application Protocol Command Analysis, Network Isolation, Network Traffic Analysis, Client-server Payload Profiling, Platform Monitoring
nist_csf
ID.RA-01, GV.OV-02, DE.AE-07
mitre_attack
T1595, T1190, T1059, T1078

Exploiting MS17-010 EternalBlue Vulnerability

Overview

MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it was used in the WannaCry and NotPetya ransomware campaigns. Despite patches being available since March 2017, many organizations still have unpatched systems, making it a viable red team exploitation vector especially in legacy environments.

When to Use

  • When performing authorized security testing that involves exploiting ms17 010 eternalblue vulnerability
  • When analyzing malware samples or attack artifacts in a controlled environment
  • When conducting red team exercises or penetration testing engagements
  • When building detection capabilities based on offensive technique understanding

Prerequisites

  • Familiarity with red teaming concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

MITRE ATT&CK Mapping

  • T1210 - Exploitation of Remote Services
  • T1190 - Exploit Public-Facing Application
  • T1569.002 - System Services: Service Execution

Workflow

Phase 1: Vulnerability Scanning
  1. Scan target networks for SMB port 445
  2. Check for SMBv1 protocol support
  3. Run MS17-010 vulnerability check (Nmap NSE script or Metasploit auxiliary)
  4. Document vulnerable systems with OS version and patch level
Phase 2: Exploitation
  1. Select appropriate exploit variant based on target OS
  2. Configure exploit payload (Meterpreter, Cobalt Strike beacon, custom shellcode)
  3. Execute exploit against confirmed vulnerable target
  4. Verify code execution and establish session
Phase 3: Post-Exploitation
  1. Establish persistence on compromised system
  2. Dump credentials from memory
  3. Use compromised host as pivot point
  4. Document exploitation evidence

Tools and Resources

ToolPurpose
Nmap ms-17-010 NSE scriptsVulnerability detection
Metasploit ms17_010_eternalblueExploitation module
Metasploit ms17_010_psexecAlternative exploitation
AutoBlue-MS17-010Standalone Python exploit
CrackMapExecMass SMB vulnerability scanning

Detection Indicators

  • IDS/IPS signatures for EternalBlue exploit traffic
  • SMBv1 negotiation from unusual source hosts
  • Event ID 7045: New service installation after exploitation
  • Anomalous named pipe activity on SMB
  • Large SMB write requests characteristic of buffer overflow

Validation Criteria

  • Vulnerable systems identified via scanning
  • Exploitation achieved on authorized target
  • Code execution confirmed with session established
  • Post-exploitation activities documented
  • Remediation recommendations provided

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/exploiting-ms17-010-eternalblue-vulnerability of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Exploiting Ms17 010 Eternalblue Vulnerability next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Exploiting Ms17 010 Eternalblue Vulnerability compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Exploiting Ms17 010 Eternalblue Vulnerability this skillmukul975/Anthropic-Cybersecurity-Skills34k—~963Automated safety check: PassApache-2.0
MetasploitEncod3d-Sec/TORCH329—~1kAutomated safety check: PassMIT
CTF Campaign DriverEncod3d-Sec/TORCH329—~1.8kAutomated safety check: PassMIT
Add Community Skillsamugit83/redamon3k—~775Automated safety check: PassMIT
NmapBrownFineSecurity/iothackbot8591 repos~3.8kAutomated safety check: NotesMIT
Nmap ReconCommonHuman-Lab/nyxstrike157—~639Automated safety check: PassCustom licence

Similar skills

  • Metasploit

    Encod3d-Sec/TORCH

    Drive msfconsole across the workflow - DB-backed recon (dbnmap, auxiliary scanners), version-exploit search/check/run, multi/handler reverse shells (meterpreter-first, plain shellreversetcp backup…

    329 GitHub stars~1k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • CTF Campaign Driver

    Encod3d-Sec/TORCH

    Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.

    329 GitHub stars~1.8k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Add Community Skill

    samugit83/redamon

    Adding a Community Agent Skill: a Markdown attack-workflow file that users import from the catalog, which then competes in the Intent Router and is injected into the agent's system prompt.

    3k GitHub stars~775 tokensUpdated 2 days ago
    SecurityAuto-check passed

  • Nmap

    BrownFineSecurity/iothackbot

    Professional network reconnaissance and port scanning using nmap.

    859 GitHub starsUsed in 1 repo~3.8k tokens
    SecurityAuto-check: notes

  • Nmap Recon

    CommonHuman-Lab/nyxstrike

    Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools

    157 GitHub stars~639 tokensUpdated yesterday
    SecurityAuto-check passed

  • Operate Network Recon

    cyberful/cyberful

    Build a high-fidelity network and service inventory using Nmap, Masscan, packet capture, DNS, and protocol-specific follow-up.

    135 GitHub stars~1.1k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Exploiting Ms17 010 Eternalblue Vulnerability

What does Exploiting Ms17 010 Eternalblue Vulnerability do?

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's…. Exploiting Ms17 010 Eternalblue Vulnerability is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17010eternalblue/ms17010psexec modules for exploitation.

When should I use Exploiting Ms17 010 Eternalblue Vulnerability?

Exploiting Ms17 010 Eternalblue Vulnerability fits situations like: tasks that involve Penetration testing; tasks that involve Red teaming and adversary simulation.

How do I install Exploiting Ms17 010 Eternalblue Vulnerability in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-ms17-010-eternalblue-vulnerability -a claude-code`. Or copy the skill folder (skills/exploiting-ms17-010-eternalblue-vulnerability in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/exploiting-ms17-010-eternalblue-vulnerability in your project. Claude Code loads it when a task matches its description.

How do I install Exploiting Ms17 010 Eternalblue Vulnerability in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-ms17-010-eternalblue-vulnerability -a codex`. Or copy the skill folder (skills/exploiting-ms17-010-eternalblue-vulnerability in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/exploiting-ms17-010-eternalblue-vulnerability in your project. Codex loads it when a task matches its description.

Can I use Exploiting Ms17 010 Eternalblue Vulnerability in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-ms17-010-eternalblue-vulnerability -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/exploiting-ms17-010-eternalblue-vulnerability, .gemini/skills/exploiting-ms17-010-eternalblue-vulnerability, .github/skills/exploiting-ms17-010-eternalblue-vulnerability and .opencode/skills/exploiting-ms17-010-eternalblue-vulnerability in your project.

What does Exploiting Ms17 010 Eternalblue Vulnerability need to run?

Going by SKILL.md and its folder, Exploiting Ms17 010 Eternalblue Vulnerability needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Exploiting Ms17 010 Eternalblue Vulnerability access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Exploiting Ms17 010 Eternalblue Vulnerability safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Exploiting Ms17 010 Eternalblue Vulnerability use?

Exploiting Ms17 010 Eternalblue Vulnerability is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Exploiting Ms17 010 Eternalblue Vulnerability use?

About 963 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.4k tokens, read only when the agent opens those files.

What are the alternatives to Exploiting Ms17 010 Eternalblue Vulnerability?

Skills that share tags, products or a category with Exploiting Ms17 010 Eternalblue Vulnerability: Metasploit (Encod3d-Sec/TORCH, 329 stars), CTF Campaign Driver (Encod3d-Sec/TORCH, 329 stars), Add Community Skill (samugit83/redamon, 3k stars) and Nmap (BrownFineSecurity/iothackbot, 859 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Exploiting Ms17 010 Eternalblue Vulnerability?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.