SMBv2 DoS
Summary: Cisco Talos described how an SMBv2 NEGOTIATE packet with a non-zero ProcessIDHigh word sent to Vista SP1 or SP2 does not cause a denial of service as expected, but instead lets an attacker control eax and use the srv2.sys ValidateRoutines dispatch table to redirect execution. The technique increments srvnet!SrvNetStatistics via repeated undocumented GET_PRINT_QUEUE requests until the counter becomes an opcode such as push esi; ret (0x56c3), then sets ProcessIDHigh so the table lookup dereferences a pointer into srvnet.sys and transfers control to attacker-supplied packet data.
What you should know: Talos states no reliable remote exploit is finished yet but expects the method to become 100% reliable for remote code execution, and reaching the needed opcode takes roughly 0x56c3 GET_PRINT_QUEUE requests - a couple of minutes, or spread over days to stay stealthy.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026