CVE-2006-2374

MEDIUM

Microsoft Windows 2000 SP4, XP SP1-SP2, Server 2003 SP1 and earlier - Denial of Service via SMB Invalid Handle

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2006-2374. PoCs published by Ruben Santamarta.

AI-analyzed exploit summary This exploit targets a vulnerability in Mrxsmb.sys on Windows XP SP2 and Windows 2000 SP4, allowing local privilege escalation to ring0 by overwriting a driver call via a privileged IOCTL. It allocates executable memory, manipulates the driver's call instruction, and executes arbitrary ring0 shellcode.

Description

The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability."

Exploits (2)

exploitdb WORKING POC VERIFIED

by Ruben Santamarta · clocalwindows

https://www.exploit-db.com/exploits/1911

View Code ZIP pw:eip

This exploit targets a vulnerability in Mrxsmb.sys on Windows XP SP2 and Windows 2000 SP4, allowing local privilege escalation to ring0 by overwriting a driver call via a privileged IOCTL. It allocates executable memory, manipulates the driver's call instruction, and executes arbitrary ring0 shellcode.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Microsoft Windows XP SP2, Windows 2000 SP4 (mrxsmb.sys)

No auth needed

Prerequisites: Disable ReadOnly Memory protection via registry key · Access to the 'shadow' device

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1055 - Process Injection

devstral-2 · analyzed Feb 18, 2026 Full analysis →

exploitdb WORKING POC VERIFIED

by Ruben Santamarta · cdoswindows

https://www.exploit-db.com/exploits/28001

View Code ZIP pw:eip

This exploit demonstrates a local denial-of-service vulnerability in the Microsoft SMB driver (MRXSMB.SYS) by creating a thread that cannot be terminated due to a deadlock in NtClose. It leverages a specific IOCTL to trigger the condition.