Microsoft Windows NtUserMNDragOver Local Privilege Elevation

This module exploits a NULL pointer dereference vulnerability in
MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver() system call.

The NULL pointer dereference occurs because the xxxMNFindWindowFromPoint()
function does not effectively check the validity of the tagPOPUPMENU
objects it processes before passing them on to MNGetpItemFromIndex(),
where the NULL pointer dereference will occur.

This module has been tested against Windows 7 x86 SP0 and SP1. Offsets
within the solution may need to be adjusted to work with other versions
of Windows, such as Windows Server 2008.