CVE-2006-2370

Windows 2000 and 2003 Server - Remote Code Execution via RRAS RPC Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 6 public exploits for CVE-2006-2370. PoCs published by Metasploit, Pusscat, H D Moore, including Metasploit module exploits/windows/smb/ms06_025_rras.

AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in the Windows Routing and Remote Access Service (RRAS) via a malicious registry key. It uses an egghunter and DCERPC to achieve remote code execution on Windows 2000 SP4.

Description

Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability."

Exploits (6)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16375

This Metasploit module exploits a stack buffer overflow in the Windows Routing and Remote Access Service (RRAS) via a malicious registry key. It uses an egghunter and DCERPC to achieve remote code execution on Windows 2000 SP4.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows 2000 SP4 (RRAS Service)
Auth required
Prerequisites: Valid username and password for Windows 2000 · Access to SMB/DCERPC
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16364

This Metasploit module exploits a stack buffer overflow in the Windows Routing and Remote Access Service (RRAS) via a malformed DCERPC request. It targets Windows 2000 SP4 and Windows XP SP1, requiring authentication for Windows 2000.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows RRAS Service (Windows 2000 SP4, Windows XP SP1)
Auth required
Prerequisites: Valid credentials for Windows 2000 · Network access to the target · SMB/DCERPC connectivity
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Pusscat · remotewindows
https://www.exploit-db.com/exploits/1965

This is a Metasploit module exploiting a stack overflow in the Windows Routing and Remote Access Service (RRAS) via a maliciously crafted registry key. It uses DCERPC and SMB to trigger the vulnerability, achieving remote code execution on Windows 2000 and XP systems.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 2000, Windows XP (RRAS Service)
Auth required
Prerequisites: Valid SMB credentials for Windows 2000 · Network access to target · SMB pipe access (ROUTER or SRVSVC)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by H D Moore · remotewindows
https://www.exploit-db.com/exploits/1940

This is a Metasploit exploit module for CVE-2006-2370, targeting a stack overflow in the Windows Routing and Remote Access Service (RRAS). It leverages DCERPC to deliver a payload, with specific targets for Windows 2000 and XP SP1.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows RRAS (2000, XP SP1)
Auth required
Prerequisites: Network access to target · Valid SMB credentials for Windows 2000 · Correct pipe name (ROUTER or SRVSVC)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms06_025_rras.rb

This Metasploit module exploits a stack buffer overflow in the Windows Routing and Remote Access Service (RRAS) via a malformed DCERPC request. It targets Windows 2000 SP4 and XP SP1, requiring authentication for Windows 2000.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows RRAS Service (Windows 2000 SP4, Windows XP SP1)
Auth required
Prerequisites: Network access to target · Valid credentials for Windows 2000 · SMB/DCERPC connectivity
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GOOD
by pusscat, hdm · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms06_025_rasmans_reg.rb

This Metasploit module exploits a stack buffer overflow in the Windows Routing and Remote Access Service (RRAS) via a malicious registry key. It uses an egghunter to locate and execute the payload, targeting Windows 2000 SP4.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 2000 SP4 (RRAS Service)
Auth required
Prerequisites: Valid username and password for Windows 2000 · Access to SMB/DCERPC
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (15)

Core 15
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26812
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1720
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1587
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1936
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2323
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA06-164A.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1741
Patch vdb-entry x_refsource_osvdb
http://www.osvdb.org/26437
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016285
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/631516
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20630
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18325
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2061
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1823

Scores

EPSS 0.7014
EPSS Percentile 99.3%

Details

Status published
Products (12)
microsoft/windows_2000 (5 CPE variants)
microsoft/windows_2003_server datacenter_edition (2 CPE variants)
microsoft/windows_2003_server datacenter_edition_64-bit (2 CPE variants)
microsoft/windows_2003_server enterprise_64-bit
microsoft/windows_2003_server enterprise_edition sp1
microsoft/windows_2003_server enterprise_edition_64-bit (2 CPE variants)
microsoft/windows_2003_server r2
microsoft/windows_2003_server sp1
microsoft/windows_2003_server standard (2 CPE variants)
microsoft/windows_2003_server standard_64-bit
... and 2 more
Published Jun 13, 2006
Tracked Since Feb 18, 2026