NTDLL.DLL Exploit Code

You may also like to check out Dave Litchfield's paper on different attack vectors for ntdll at

http://www.nextgenss.com/papers/ms03-007-ntdll.pdf

Rgds,

Raff