Mailslot DOS (srv.sys NULL Dereference) in Microsoft Windows SMB Server

This repository contains a single Metasploit auxiliary module (Ruby) that exploits a kernel pool corruption vulnerability in Microsoft Windows SRV.SYS (CVE-2006-3942, MS06-035). The exploit works by sending repeated SMB mailslot write requests to a specified mailslot (default: 'Alerter'), with increasing data size, which triggers a flaw in the allocation routine of the response packet, leading to slow kernel memory corruption. The module is designed to cause a denial of service (DoS) on vulnerable Windows systems. The code is operational and leverages Metasploit's SMB client libraries. The only required configuration is the target mailslot name, which can be customized. The module does not provide shell access or code execution, but rather aims to crash or destabilize the target system. No external network endpoints or IP addresses are hardcoded; the main fingerprintable elements are the mailslot names used in the SMB requests.

This repository contains a single Metasploit auxiliary module: 'modules/auxiliary/dos/windows/smb/ms06_063_trans.rb'. The module exploits a NULL pointer dereference vulnerability in the SRV.SYS driver on Microsoft Windows (CVE-2006-3942, MS06-063). The exploit works by sending specially crafted SMB transaction requests to the target's SMB service (typically on TCP port 445). If the target is vulnerable, this will cause a denial of service by crashing the SRV.SYS driver, potentially leading to a system or service crash. The module does not provide a shell or code execution, only a DoS condition. The code is written in Ruby and is designed to be run within the Metasploit Framework. No hardcoded IP addresses or domains are present; the only fingerprintable endpoint is the SMB service on the target system.