Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)
| Reporter | Title | Published | Views | Family All 75 |
|---|---|---|---|---|
 | Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050) Exploit | 26 Feb 201600:00 | – | zdt |
 | Exploit for CVE-2009-3103 | 18 Sep 202602:37 | – | githubexploit |
| Exploit for CVE-2009-3103 | 26 Jan 202607:13 | – | githubexploit |
 | SMBv2 DoS | 7 Sep 202100:00 | – | bdu_fstec |
| SMBv2 Code Execution | 7 Sep 202100:00 | – | bdu_fstec |
| Windows SMBv2 Code Execution | 7 Sep 202100:00 | – | bdu_fstec |
 | CVE-2009-3103 | 9 Sep 200900:00 | – | circl |
 | Microsoft Windows Server Remote Code Execution (CVE-2009-3103) | 30 May 202100:00 | – | checkpoint_advisories |
| Microsoft Windows SMB Negotiate Request Remote Code Execution (CVE-2009-2532; CVE-2009-3103) | 9 Sep 200900:00 | – | checkpoint_advisories |
| Microsoft SMB Infinite Loop Denial of Service (MS09-050; CVE-2009-2526) | 13 Oct 200900:00 | – | checkpoint_advisories |
10
Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
---------------------------------------------------------------------
Exploited by Piotr Bania // www.piotrbania.com
Exploit for Vista SP2/SP1 only, should be reliable!
Tested on:
Vista sp2 (6.0.6002.18005)
Vista sp1 ultimate (6.0.6001.18000)
Kudos for:
Stephen, HDM, Laurent Gaffie(bug) and all the mates i know, peace.
Special kudos for prdelka for testing this shit and all the hosters.
Sample usage
------------
> smb2_exploit.exe 192.167.0.5 45 0
> telnet 192.167.0.5 28876
Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>
When all is done it should spawn a port TARGET_IP:28876
RELEASE UPDATE 08/2010:
----------------------
This exploit was created almost a year ago and wasnt modified from that time
whatsoever. The vulnerability itself is patched for a long time already so
i have decided to release this little exploit. You use it for your own
responsibility and im not responsible for any potential damage this thing
can cause. Finally i don't care whether it worked for you or not.
P.S the technique itself is described here:
http://blog.metasploit.com/2009/10/smb2-351-packets-from-trampoline.html
===========================================================================
Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14674.zip (smb2_exploit_release.zip)Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Aug 2010 00:00Current
8High risk
Vulners AI Score8
CVSS 210
EPSS0.92347