<commit_before>---
layout: post
title:  Memory analysis of Eternalblue
category: memory-forensics
description: Techinal and memory forensics dive into the Eternalblue exploit that uses SMB v1 vulnerability.
picture: /assets/img/eternal/eternal.png
excerpt: Before Microsoft patching it, SMB version 1 was vulnerable to a buffer overflow attack. The vulnerability is exploitable when a malformed Trans2 request is sent to the server which enables the attacker to overwrite another part of the memory.
---
![]({{site.baseurl}}/assets/img/eternal/eternal.png)
_Code comment from the leaked source code of Windows NT4 which contained the vulnerability_

This post is about trying to fully understand the vulnerability behind WanaCry(pt).

This post consists of the following parts.

1. Understanding the exploit method
2. Using the exploit and popping under the hood of a vulnerable machine to see what happens
<commit_msg>Spell check<commit_after>---
layout: post
title:  Memory analysis of Eternalblue
category: memory-forensics
description: Technical and memory forensics dive into the Eternalblue exploit that uses SMB v1 vulnerability.
picture: /assets/img/eternal/eternal.png
excerpt: Before Microsoft patching it, SMB version 1 was vulnerable to a buffer overflow attack. The vulnerability is exploitable when a malformed Trans2 request is sent to the server which enables the attacker to overwrite another part of the memory.
---
![]({{site.baseurl}}/assets/img/eternal/eternal.png)
_Code comment from the leaked source code of Windows NT4 which contained the vulnerability_

This post is about trying to fully understand the vulnerability behind WanaCry(pt).

This post consists of the following parts.

1. Understanding the exploit method
2. Using the exploit and popping under the hood of a vulnerable machine to see what happens

{'fraction_non_alphanumeric': 0.050081654872074034, 'fraction_numerical': 0.0065323897659227, 'mean_word_length': 4.967532467532467, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1063816', 'n_tokens_mistral': 483, 'n_tokens_neox': 437, 'n_words': 247}