CVE-2022-26937

This PoC demonstrates a stack-based buffer overflow in the Windows Network File System (NFS) driver (nfssvr.sys) leading to a KERNEL_SECURITY_CHECK_FAILURE (0x139) bugcheck. The crash occurs due to a stack cookie check failure, indicating a potential for arbitrary code execution.

This PoC demonstrates a stack-based buffer overflow in the Windows Network File System (NFS) driver (nfssvr.sys), leading to a KERNEL_SECURITY_CHECK_FAILURE (0x139) bugcheck. The crash is triggered by corrupting the stack, as evidenced by the repeated '0x41414141' values in the stack trace.

This repository provides a Zeek script to detect CVE-2022-26937, a vulnerability in Microsoft's NFS implementation. It includes a PCAP file and scripts to analyze network traffic for potential exploit attempts.