Links of the day
http://www.sensepost.com/research/squeeza/
http://www.sensepost.com/research/reDuh/
http://carnal0wnage.blogspot.com/2008/09/passing-hash-with-gsecdump-and-msvctl.html
http://carnal0wnage.blogspot.com/2008/08/owning-client-without-and-exploit.html