CVE-2005-2120
Microsoft Windows 2000 SP4 and XP SP1-SP2 - Stack-Based Buffer Overflow in Plug and Play Service via Registry Key Name
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-2120.
PoCs published by Winny Thomas, anonymous, hdm, including Metasploit module auxiliary/dos/windows/smb/ms05_047_pnp.
AI-analyzed exploit summary This exploit triggers a denial-of-service (DoS) in Microsoft's UMPNPMGR.dll by sending a malformed PNP_GetDeviceList request with an excessively long path, causing services.exe to crash. It follows a multi-step SMB/DCE-RPC negotiation process to reach the vulnerable function.
Description
Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.
Exploits (3)
This exploit triggers a denial-of-service (DoS) in Microsoft's UMPNPMGR.dll by sending a malformed PNP_GetDeviceList request with an excessively long path, causing services.exe to crash. It follows a multi-step SMB/DCE-RPC negotiation process to reach the vulnerable function.
This exploit targets CVE-2005-2120, a buffer overflow vulnerability in the Windows Plug and Play service. It uses a malformed RPC request to trigger the overflow, potentially leading to remote code execution.
This Metasploit module exploits a stack buffer overflow in the Windows Plug and Play service (MS05-047) via a maliciously crafted DCERPC request, leading to a denial-of-service (reboot) on Windows 2000. Code execution is possible under specific memory conditions.