CVE-2003-0109

EXPLOITED

Windows 2000 - Remote Code Execution via WebDAV Request

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2003-0109 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 10 public exploits from researchers including Metasploit, Schizoprenic, alumni, including a Metasploit module exploits/windows/iis/ms03_007_ntdll_webdav.

AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in NTDLL.dll on Windows 2000 via the SEARCH WebDAV method in IIS 5.0. It uses a long URL to trigger the overflow and includes multiple return addresses for brute-forcing.

Description

Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.

Exploits (10)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16470

This Metasploit module exploits a buffer overflow in NTDLL.dll on Windows 2000 via the SEARCH WebDAV method in IIS 5.0. It uses a long URL to trigger the overflow and includes multiple return addresses for brute-forcing.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS 5.0 on Windows 2000
No auth needed
Prerequisites: IIS 5.0 with WebDAV enabled · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Schizoprenic · cremotewindows
https://www.exploit-db.com/exploits/51

This exploit targets a buffer overflow vulnerability in IIS 5.0 WebDAV (CVE-2003-0109) by sending a maliciously crafted XML request. It includes shellcode to spawn a reverse shell on port 31337, leveraging a known NTDLL.DLL overflow.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS 5.0
No auth needed
Prerequisites: Network access to target IIS server · WebDAV enabled on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by alumni · cremotewindows
https://www.exploit-db.com/exploits/36

This exploit targets CVE-2003-0109, a buffer overflow vulnerability in Microsoft IIS WebDAV. It crafts a malicious HTTP SEARCH request with embedded shellcode to spawn a reverse shell on port 32768.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS 5.0/6.0 with WebDAV enabled
No auth needed
Prerequisites: WebDAV enabled on target IIS server · Network access to target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by Morning Wood · textremotewindows
https://www.exploit-db.com/exploits/22367

The writeup describes a vulnerability in the ntdll.dll function 'RtlDosPathNameToNtPathName_U' which lacks sufficient bounds checking. This vulnerability can be exploited through programs like WebDAV in IIS 5.0, allowing remote attackers to execute arbitrary code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Microsoft Windows NT, IIS 5.0
No auth needed
Prerequisites: Access to a vulnerable system running IIS 5.0 with WebDAV enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by ThreaT · cremotewindows
https://www.exploit-db.com/exploits/22366

This exploit generates a malicious .reg file that triggers a buffer overflow in regedit.exe via an unchecked ReadFile() function, leading to arbitrary code execution. The payload downloads and executes a specified URL, demonstrating a remote code execution (RCE) vulnerability.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows regedit.exe (affecting Windows NT, 2000, XP with WebDAV)
No auth needed
Prerequisites: Victim must open the malicious .reg file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by RoMaNSoFt · cremotewindows
https://www.exploit-db.com/exploits/2

This exploit targets a buffer overflow vulnerability in IIS 5.0 WebDAV (CVE-2003-0109) by sending a maliciously crafted HTTP SEARCH request. It uses a Unicode conversion flaw to overwrite the return address and execute shellcode, binding a cmd.exe shell to a specified port.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Microsoft IIS 5.0
No auth needed
Prerequisites: Network access to the target IIS server · WebDAV enabled on the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by mat · perlremotewindows
https://www.exploit-db.com/exploits/22365

This exploit targets a buffer overflow vulnerability in the `RtlDosPathNameToNtPathName_U` function in `ntdll.dll` via WebDAV in IIS 5.0. It uses a unicode decoder scheme and self-modifying shellcode to execute arbitrary commands (e.g., adding a user).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS 5.0 with WebDAV enabled (Windows 2000)
No auth needed
Prerequisites: WebDAV enabled on target IIS 5.0 server · Network access to port 80
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by kralor · cremotewindows
https://www.exploit-db.com/exploits/1

This exploit targets a buffer overflow vulnerability in ntdll.dll through WebDAV on IIS servers. It uses a reverse shell shellcode and requires manual padding adjustments to achieve successful exploitation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Racy
Target: Microsoft IIS with WebDAV enabled (ntdll.dll vulnerability)
No auth needed
Prerequisites: WebDAV enabled on target IIS server · Network access to target · Manual padding adjustment for successful exploitation
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by [email protected] · textremotewindows
https://www.exploit-db.com/exploits/22368

The writeup describes a vulnerability in the ntdll.dll function 'RtlDosPathNameToNtPathName_U' which lacks sufficient bounds checking. This can be exploited remotely via WebDAV in IIS 5.0 or through other attack vectors in programs using the library.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Microsoft Windows NT, XP, IIS 5.0/5.1
No auth needed
Prerequisites: WebDAV enabled on IIS 5.0/5.1 · Network access to vulnerable system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by hdm · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/iis/ms03_007_ntdll_webdav.rb

This Metasploit module exploits a buffer overflow in NTDLL.dll on Windows 2000 through the SEARCH WebDAV method in IIS 5.0. It targets multiple Windows 2000 versions (SP0-SP3) and delivers a reverse shell payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft IIS 5.0 on Windows 2000
No auth needed
Prerequisites: Network access to vulnerable IIS server · WebDAV enabled on target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (16)

Core 16
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=104869293619064&w=2
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A109
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=104861839130254&w=2
Various Sources x_refsource_misc
http://www.nextgenss.com/papers/ms03-007-ntdll.pdf
Patch, Vendor Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/11533.php
Patch, Vendor Advisory third-party-advisory x_refsource_iss
http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=22029
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=104887148323552&w=2
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=104826476427372&w=2
Vendor Advisory vendor-advisory x_refsource_mskb
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ815021
Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/7116
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=105768156625699&w=2
Mailing List mailing-list x_refsource_ntbugtraq
http://marc.info/?l=ntbugtraq&m=104826785731151&w=2
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/117394
Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.cert.org/advisories/CA-2003-09.html

Scores

EPSS 0.8871
EPSS Percentile 99.5%

Details

VulnCheck KEV 2017-06-20
Status published
Products (2)
microsoft/windows_2000 (4 CPE variants)
microsoft/windows_2000_terminal_services (4 CPE variants)
Published Mar 31, 2003
Tracked Since Feb 18, 2026