CVE-2006-2374

This exploit targets a vulnerability in Mrxsmb.sys on Windows XP SP2 and Windows 2000 SP4, allowing local privilege escalation to ring0 by overwriting a driver call via a privileged IOCTL. It allocates executable memory, manipulates the driver's call instruction, and executes arbitrary ring0 shellcode.

This exploit demonstrates a local denial-of-service vulnerability in the Microsoft SMB driver (MRXSMB.SYS) by creating a thread that cannot be terminated due to a deadlock in NtClose. It leverages a specific IOCTL to trigger the condition.