I'm working on a presentation to give to high school computer science students where I work at as a volunteer. Part of the presentation is on local and network exploits. I am planning to talk about a story where years ago I was able to get root access by creating a program with an intentional buffer overflow, setting the setuid bit, and running a NOP slide to execute shellcode. When running this program on a modern OS or modern hardware, the exploit no longer works because of the NX bit. (I got this technique from the book "Hacking, the art of exploitation").
I also plan to talk about WannaCry ransomware. Referencing this FireEye link on WannaCry, they talk about that after the malformed packet was sent to SMBv1 on port 445, the software was able to run a NOP slide and then run shellcode.
So my question is, why was the NX bit (either from the OS or the CPU) unable to stop WannaCry from working?