LPE vulnerabilities exploitation on Windows 10 Anniversary Update

Arbitrary write via USER objects
BOOL WINAPI SetMenuItemInfo( HMENU hMenu, UINT uItem, BOOL fByPosition, LPMENUITEMINFO lpmii );
typedef struct tagMENUITEMINFO {
UINT cbSize;
UINT fMask; // MIIM_DATA , MIIM_ID …
UINT fType;
UINT fState; // MIIM_STATE
UINT wID; // -> MIIM_ID
HMENU hSubMenu; // ->MIIM_SUBMENU
HBITMAP hbmpChecked;
HBITMAP hbmpUnchecked;
ULONG_PTR dwItemData; //-> MIIM_DATA
LPTSTR dwTypeData; // -> MIIM_STRING
UINT cch;
HBITMAP hbmpItem;
} MENUITEMINFO, *LPMENUITEMINFO;