Microsoft Windows - DTC Remote (MS05-051) (2)

/ Hard to exploit, isn't it? I have tested it on 10+ box, most of them allocated 0x9X0058 for me, however, I cannot write the pointer to 0x7ffdf020 since the length I can control should be divided exactly by 8 merde, so I choose 0x684191c4. This following program is mostly like a D.O.S. 10+...