CVE-2004-2176

This exploit leverages a weak default configuration in Windows XP SP2's Internet Connection Firewall (ICF) to bypass access controls by injecting shellcode into sessmgr.exe, creating a listening port for remote access. The code dynamically resolves API addresses and injects a payload to spawn a hidden cmd.exe process.