### [CVE-2011-2005](https://www.cve.org/CVERecord?id=CVE-2011-2005)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
![](https://img.shields.io/static/v1?label=CISA%20KEV&message=Known%20Exploited&color=red)

### Description

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

### POC

#### Reference
No PoCs from references.

#### Github
No PoCs found on GitHub currently.

#### ExploitDB
- https://www.exploit-db.com/exploits/21844
- https://www.exploit-db.com/exploits/18176

#### Metasploit
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb

#### Collections
- https://github.com/helloexp/0day/blob/master/97-Windows%E6%8F%90%E6%9D%83/MS11-080/CVE-2011-2005.py