Published: 14/11/2006 Updated: 17/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote malicious users to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows 2000
microsoft windows xp

#!/usr/bin/python # MS06-070 Windows WorkStation NetpManageIPCConnect Vulnerability Exploit # Tested on windows 2000 server SP4 # # Usage: python NetAPI-NetrJoinDomain2py <target ip> <domainname> # Requires a domain controller on the network (configure samba as DC) # Requires python and impacket # # Winny M Thomas ;-) from impacketd ...

## # $Id: ms06_070_wkssvcrb 10554 2010-10-05 19:29:10Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' class ...

/*************************************************************************** Microsoft Windows Wkssvc NetrJoinDomain2 Stack Overflow(MS06-070) Exploit by cocoruder(frankruder_at_hotmailcom),20061115 page:rudercdutnet/defaultasp Code fixed by S A Stevens - 17112006 - changed shellcode, Changed code to correct jmp EBX address and fi ...

/*************************************************************************** Microsoft Windows Wkssvc NetrJoinDomain2 Stack Overflow(MS06-070) Exploit by cocoruder(frankruder_at_hotmailcom),20061115 page:rudercdutnet/defaultasp successfully test on Windows 2000 Server SP4(chinese) usage: ms06070 targetip DomainName notice: Make su ...

NVD-CWE-Other http://secunia.com/advisories/22883 http://www.us-cert.gov/cas/techalerts/TA06-318A.html http://www.securityfocus.com/bid/20985 http://securitytracker.com/id?1017221 http://www.kb.cert.org/vuls/id/778036 http://www.vupen.com/english/advisories/2006/4508 http://research.eeye.com/html/advisories/published/AD20061114.html https://exchange.xforce.ibmcloud.com/vulnerabilities/29948 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A908 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A607 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-070 http://www.securityfocus.com/archive/1/451588/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/2809/https://www.kb.cert.org/vuls/id/778036

CVE-2006-4691

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect