This module creates many subfolders into a writeable shared folder in the target. After that it sends an equivalent command like "move \\target_ip\shared_folder\folder1\folder2\..\foldern\*.* \\target_ip\shared_folder" producing an integer underflow in "srv.sys".
This module exploits a remote vulnerability on the FIND_FIRTS2 SMB subcommand on the srv.sys driver. It could allow an attacker to connect to a shared folder and send a specially crafted SMB message to an affected system causing a denial of service.
This module sends a "SMB Browser Election" UDP packet to the "Active Directory" service running in the target. When the Windows kernel processes this crafted packet, the "bowser.sys" kernel module finishes calling to "memcpy" function with the length parameter of 4.294.967.295 bytes. After that, the "memcpy" function corrupts all the kernel heap and finish crashing the target kernel.
This module exploits a vulnerability on srv2.sys via a SMB negociation packet.
This module exploits a vulnerability in "schannel.dll" by sending a crafted certificate packet to the "Internet Information Services" server via TLS protocol producing a heap overflow in the critical LSASS Windows process.
This modules exploits a kernel vulnerability in Microsoft Remote Desktop server by sending a sequence of specially crafted RDP packets to the target system.
This module triggers a memory corruption vulnerability in the Remote Desktop Service by sending a malformed packet to the 3389/TCP port.
This module exploits a vulnerability in "spoolsv.exe" answering a crafted packet to the target, upon success it will leave the service unavailable.
This modules exploits a Windows kernel vulnerability in "nfssvr.sys" by sending a NFS file renaming crafted request to the target.
This module exploits a memory corruption in the Microsoft Windows TCP/IP implementation of ICMPv6 by sending a sequence of TCP/IP packets with a specially crafted Router Advertisement packet. The attack must be issued from the same local net of the target host.