这个Biu漏洞分配给了小四。小四说，不必着急，一定会有人指着这个扬名立万，可以稍微等等。果不其然，吃完午饭上来，就有人放PoC出来了。

　　昨天晚上，“Father of China PT”又问我想不想写ms08-067的代码。我说这么赶着写这个干嘛呀，咱们也不急着下大雨。“Father of China PT”说：这个漏洞大家都在盯着，写了就流芳百世了。我说：关键是想流芳百世的人那么多，咱们又不急用，等两天，各种代码肯定会乌泱乌泱铺天盖地而来，就 跟当年ms03-026一样，咱们可以捡个现成。

　　结果今天早晨发现Alexander Sotirov连逆的代码贴出来了。这段代码很有教学意义，我打算收到我的案例库里去。

　　顺便说一句，这个Alexander Sotirov下个月会来XCon演讲“Bypassing browser memory protections in Windows Vista”。

　　From http://www.phreedom.org/blog/2008/decompiling-ms08-067/

　　Decompiling the vulnerable function for MS08-067

　　Oct 24, 2008

　　I spent a couple of hours tonight reversing the vulnerable code responsible for the MS08-067 vulnerability. This bug is pretty interesting, because it is in the same area of code as the MS06-040 buffer overflow, but it was completely missed by all security researchers and Microsoft. It's quite embarassing.

　　Here's the code of the vulnerable function on Windows XP SP3:

#include <wchar.h>
// This is the decompiled function sub_5B86A51B in netapi32.dll on XP SP3
int ms08_067(wchar_t* path)
{
　　wchar_t* p;
　　wchar_t* q;
　　wchar_t* previous_slash = NULL;
　　wchar_t* current_slash　= NULL;
　　wchar_t　ch;
　　// If the path starts with a server name, skip it
　　if ((path[0] == L''