Description
RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Camisade · clocalwindows
https://www.exploit-db.com/exploits/21069
References (4)
Scores
EPSS
0.0280
EPSS Percentile
86.1%
Details
Status
published
Products (1)
microsoft/windows_2000
Published
Dec 31, 2001
Tracked Since
Feb 18, 2026