Exploitation Summary
EIP tracks 2 public exploits for CVE-2006-6696. PoCs published by Ruben Santamarta, anonymous.
AI-analyzed exploit summary This exploit leverages the NtRaiseHardError function in Windows to trigger a memory disclosure vulnerability in csrss.exe by reading arbitrary memory addresses. It uses NtQuerySystemInformation to locate csrss.exe threads and then reads memory contents via crafted NtRaiseHardError calls.
Description
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
Exploits (2)
This exploit leverages the NtRaiseHardError function in Windows to trigger a memory disclosure vulnerability in csrss.exe by reading arbitrary memory addresses. It uses NtQuerySystemInformation to locate csrss.exe threads and then reads memory contents via crafted NtRaiseHardError calls.
This exploit demonstrates a denial-of-service (DoS) vulnerability in Windows by repeatedly calling MessageBoxA with a malformed string, causing system instability. The code leverages the MB_SERVICE_NOTIFICATION flag to trigger the bug.