I co-authored a blog post with Mehdi Talbi about an Exim vulnerability exploitation. Blog post is available at https://www.synacktiv.com/posts/exploit/scraps-of-notes-on-exploiting-exim-vulnerabilities.html.

Mehdi Talbi and I have published a case study of VM escape on Phrack. The full paper is available at http://phrack.org/papers/vm-escape-qemu-case-study.html.