Obscurity Labs Blog EsteemAudit, A Breakdown & Walk-through

Overview: As we all know EsteemAudit(EA) was one of the many tools released by the shadowbrokers. It targets the RDP service on XP and Server 2003 systems. This is done by exploiting the gpkcsp.dll of the Windows Smart Card. EA performs a buffer overflow of the key_data