A Dissection of the “Esteem Audit” Windows Remote Desktop Exploit
Summary: A group calling itself the Shadow Brokers released a cache of stolen tools in April 2017, including EsteemAudit, which exploits CVE-2017-9073 in the Windows Remote Desktop service on Windows XP and Windows Server 2003. The flaw is an inter-chunk heap overflow in a 0x80-sized key_data buffer inside the key_set structure allocated by gpkcsp.dll, where a memcpy in gpkcsp!MyCPAcquireContext copies user-controlled data without a boundary check, letting an unauthenticated remote attacker overwrite an adjacent key_object pointer and take control of the system. Neither XP (support ended 2014) nor Server 2003 (ended 2015) receives a Microsoft patch for the vulnerability.
What's compelling: An unauthenticated remote attacker can take over any XP or Server 2003 host still exposed on RDP, and there is no patch coming - Unit 42 notes the exploit is complex but that the EsteemAudit tool makes it usable by novices.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-9073
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026