来源：vessial's easylife
另一种利用方式，通过覆盖SSDT表NtVdmControl的地址进行shellcode的执行
#include <stdio.h>
#include <windows.h>
typedef LONG NTSTATUS;
typedef NTSTATUS (NTAPI *PNTALLOCATE)(HANDLE ProcessHandle,
作者：Sowhat
来源：Sowhat的blog
前两天推荐过Mark Dowd的Paper “Exploiting Flash Reliably”
http://hi.baidu.com/secway/blog/item/242655971275376855fb96d8.html
学习了一下，很好很强大。为以后Flash Player漏洞的利用开辟了一条崭新崭新的道路啊。
简单来说，从Flash9开始，实现了一个ActionScript Virtual Machine (AVM)，这个虚拟机首先会验证将要被执行的ActionScript，然后再执行。未经验证的、不可信的ActionScript非常邪恶强大，几乎相当于以Flash Player运行的权限来执行任意代码，所以虚拟机首先要验证ActionScript来源是合法的。
===============================================================
Author:Tr4c3[dot]126[dot]com
版权所有 http://www.nspcn.org
===============================================================
#+++
影响版本：
沸腾展望新闻系统[核心:尘缘雅境] V1.1 Access版 Finish(SP3)
#+++
漏洞文件:
down.asp
#+++
关键代码：
鬼仔注：这个比较强，测试过了。
MS Windows Explorer Unspecified .DOC File Denial of Service Exploit
Download the file anywhere excluding on desktop and try to browse it with the Windows explorer and you'll see how it crashes !
- Tested on Windows XP Service Pack 1 and Service Pack 2. Hope the latest Microsoft fixes will fix that bug ;]
- Iron Team - Hackin' and crackin'
Runs calc.exe on Office XP SP3 with updates < 03/11/08.
Just for fun...
http://milw0rm.com/sploits/2008-ms08-016.tgz
Marsupilamipowa@hotmail.fr
# milw0rm.com [2008-03-30]
Stack overflow in vbe6.dll, (used by all versions of MS Office)
The overflow occurs in Visual Basic for Application.
Creating a property with a long name ( about 247 chars) results in a stack overflow in vbe6.dll which overwrites with a null byte the first byte of the return address.
Probably impossible to exploit, but who knows? ^^ At least,