Exploitation Summary
EIP tracks 1 public exploit for CVE-2004-2176. PoCs published by americanidiot.
AI-analyzed exploit summary This exploit leverages a weak default configuration in Windows XP SP2's Internet Connection Firewall (ICF) to bypass access controls by injecting shellcode into sessmgr.exe, creating a listening port for remote access. The code dynamically resolves API addresses and injects a payload to spawn a hidden cmd.exe process.
Description
The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users to use sessmgr.exe to create a local listening port that bypasses the ICF access controls.
Exploits (1)
This exploit leverages a weak default configuration in Windows XP SP2's Internet Connection Firewall (ICF) to bypass access controls by injecting shellcode into sessmgr.exe, creating a listening port for remote access. The code dynamically resolves API addresses and injects a payload to spawn a hidden cmd.exe process.