Version two of this paper discussing more shatter attacks that are possible using SEH memory locations to escalate privileges in Windows. Exploit code included. Related information available here.
612a9a5519a9d7da1fa8a00f1bcf9fc1be3a52c2d4df149c08548435c64b009b
Version three of this paper discussing more shatter attacks that are possible using progress bars. Related information available here.
787e917da3242f5237e198f43f899c54f8b8719ed978cf8961d1090447b3c4c9
Paper discussing more shatter attacks that are possible using SEH memory locations to escalate privileges in Windows. Related information available here.
08eeaae0ef4d604d10152e302c4788b1eb3339d71fd9c5a793d9b0e5a67d44e0