The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.

Search for modules

Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference

This module exploits an out of bounds function table dereference in the SMB request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7 release candidates (not RTM), and Windows 2008 Server prior to R2. Windows Vista without SP1 does not seem affected by this flaw.

Rank

• Normal

Authors

• Laurent Gaffie < laurent.gaffie [at] gmail.com >
• hdm < hdm [at] metasploit.com >

References

• CVE-2009-3103
• BID-36299
• OSVDB-57799
• MSB-MS09-050
• http://seclists.org/fulldisclosure/2009/Sep/0039.html
• http://www.microsoft.com/technet/security/advisory/975497.mspx

Development

• Source Code
• History

Similar Modules

• auxiliary/dos/windows/smb/ms05_047_pnp
• auxiliary/dos/windows/smb/ms06_035_mailslot
• auxiliary/dos/windows/smb/ms06_063_trans
• auxiliary/dos/windows/smb/ms09_001_write
• auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff
• auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop
• auxiliary/dos/windows/smb/ms10_054_queryfs_pool_overflow
• auxiliary/dos/windows/smb/ms11_019_electbowser
• auxiliary/dos/windows/smb/rras_vls_null_deref
• auxiliary/dos/windows/smb/vista_negotiate_stop

Usage Information

Module Options