CVE-2011-2005
HIGH KEVMicrosoft Windows XP/Server 2003 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2011-2005 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022. EIP tracks 3 public exploits from researchers including Metasploit, ryujin, Ascotbe.
AI-analyzed exploit summary This Metasploit module exploits a kernel memory corruption vulnerability in afd.sys (CVE-2011-2005) to achieve local privilege escalation by overwriting the HalDispatchTable and triggering execution via NtQueryIntervalProfile. It elevates to SYSTEM and injects payload into another SYSTEM process.
Description
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
Exploits (3)
This Metasploit module exploits a kernel memory corruption vulnerability in afd.sys (CVE-2011-2005) to achieve local privilege escalation by overwriting the HalDispatchTable and triggering execution via NtQueryIntervalProfile. It elevates to SYSTEM and injects payload into another SYSTEM process.
This is a functional privilege escalation exploit for CVE-2011-2005 targeting the Afd.sys driver vulnerability in Windows XP and Windows Server 2003. It leverages a kernel memory corruption flaw to execute arbitrary code in kernel mode, specifically stealing a SYSTEM token for privilege escalation.
This repository contains documentation and configuration scripts for a collection of Windows exploits, including CVE-2003-0352, CVE-2006-3439, CVE-2008-1084, and others. It includes README files in both Chinese and English, as well as a Python script for generating documentation.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H