How about MS17-010 / wannacry on Windows 2000

[blackwingcat]

https://github.com/RiskSense-Ops/MS17-010

Here is MS17-010 PoC.

How about your Windows 2000 ?

My Windows 2000 blocked it

STATUS_INVALID_SMB and  STATUS_SMB_BAD_TID.

(it from Policy on Extendede Kernel DVD creation Kit )

[Dibya]

cool Man you do rock

[blackwingcat]

I released MS17-010 for Windows 2000.

it based on 5.0.2195.7365 and backport from MS16-114 to MS17-010 fix only.

[jumper]

> it based on 5.0.2195.7365
Why is it 5.00.2195.7367 and why is it based on 5.0.2195.7365 instead of 5.00.2195.7369 (Windows2000-KB2508429-v12-x86-ENU)?

> and backport from MS16-114 to MS17-010 fix only
This doesn't make sense because MS16-114 is older than MS17-010 and doesn't contain the MS17-010 fix.

[roytam1]

7 hours ago, jumper said:

> it based on 5.0.2195.7365
Why is it 5.00.2195.7367 and why is it based on 5.0.2195.7365 instead of 5.00.2195.7369 (Windows2000-KB2508429-v12-x86-ENU)?

> and backport from MS16-114 to MS17-010 fix only
This doesn't make sense because MS16-114 is older than MS17-010 and doesn't contain the MS17-010 fix.
 

I dug in msfn and found this:

and this may be why blackwingcat NOT to use 5.00.2195.7369.

But what about Windows2000-KB2508429-v17(5.00.2195.7371)?

Edited May 24, 2017 by roytam1

[blackwingcat]

On 2017/5/25 at 0:30 AM, roytam1 said:

I dug in msfn and found this:

and this may be why blackwingcat NOT to use 5.00.2195.7369.

But what about Windows2000-KB2508429-v17(5.00.2195.7371)?

I do not know 5.00.2195.7369. 's BSoD bug fixed whether or not, so I uses 5.0.2195.7365 :3 (Perhaps that was WildBill's update.)

[jumper]

Thanks. I'm working on a universal EternalBlue-type flaw patcher for all Win32 OS'es and studying all the versions of Srv.sys I can.