Here’s a little something from pastie.org, pointed out by hdmoore in Twitter (a mine of interesting information!). Capture the logged-in users keystrokes, without disk access, after exploiting MS08-067, through migrate http://pastie.org/423800