Here we will be looking a kernel level privilege escalation vulnerability CVE - 2014 - 4113 . The vulnerability is exploited by creating tagWND structure at NULL page (0x000 00000). We’ll see here why control is transferred to the shellcode and the reason the malicious tagWND structure is th e crafted the way it is. User - Mode Code The exe first tries to determine the OS it is running on and stores the following data in the vari able based on the OS version and build: Windows Xp S p2 0c8 Windows Xp S p1 12c Windows Xp S p3 0d8 Windows Server 2008 0e0 windows 7 / Windows Server 2008 R2 0f8 Read more: http://www.exploit-db.com/wp-content/themes/exploit/docs/35937.pdf