[deckar01]

That exploit seems limited to applications that are designed to execute arbitrary commands based on user input (consoles). This exploit goes a step further and finds vulnerabilities in the CTF protocol's implementation so that any process's privileges can be hijacked to run arbitrary code.

[temac]

IIRC shatter attack was exploiting a badly designed general purpose window message protocol that by design quasi-directly allowed arbitrary code execution (especially at the time, with no mitigation).

This one is way more indirect and goes through obscure and less reviewed channels, but the end result is kind of the same, even worse; because the integrity level was supposed to fix that mess, except MS was not lying when they said that this was not a security boundary... only they did explain the full picture properly explain so that we could understand that UAC is this much worthless -- lots of people thought of it as reasonable enough when set on Always notify, turns out it seems just plainly broken -- and because there seems to be no proper design comprehensively focused on that topic, it is very possible that there are other avenues to achieve the same result.

I think I now understand way better why they want so much (and have started since some years) to leverage virtualization for security purposes: it seems impossible for them to evolve their historical crappy design to something sound (without breaking all kind of crazy 3rd party applications) otherwise.