Internal-SMB Writeup - Proving Grounds
Easy Windows box, an unpatched Windows Server 2008 SP1 host flagged by nmap's SMB vulnerability scripts and taken with the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) for a direct, unauthenticated SYSTEM shell.