1) You need to open a thread handle, and you can only do that on processes running in the same security context the attacking thread. So you can already execute code, and this vector alone does not give you privilege escalation. It does however allow you to execute code in another process.<p>2) It uses NtQueueApcThread for 1), which is a known vector for this type of "attack", see e.g., [1]. That code uses NtQueueApcThread to call LoadLibrary in the target process<p>3) the "new" thing presented in the article is to get a ROP-chain in the called process by using atom tables<p>I don't know. I have been away from windows for about ten years, and a lot may have happened, but this doesn't seem like it would allow me to do something that I couldn't already do. What is the benefit here, compared to e.g., using NtQueueApcThread and LoadLibrary to load the code?<p>[1] <a href="http://www.codeproject.com/Articles/11777/InjLib-A-Library-that-implements-remote-code-injec" rel="nofollow">http://www.codeproject.com/Articles/11777/InjLib-A-Library-t...</a>