Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Repository is a compact proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11 on Windows 10. It contains two exploit HTML files and two supporting C++ DLL source files. The main entry point is exploit/vbscript_bypass_pm.html, which combines VBScript heap/array corruption primitives with JavaScript helpers. The VBScript code builds exploitation primitives to obtain object addresses, leak memory, and overwrite the COleScript SafetyOption field at offset 0x174, effectively disabling VBScript safety restrictions ('god mode'). The first-stage HTML then downloads three attacker-controlled files from a hardcoded HTTP server at 172.16.100.1:8889: ieshell32.dll, ielocalserver.dll, and vbscript_godmode.html. It searches IE's low-integrity cache directories for those downloaded files, moves them into temporary locations, sets environment variables, creates a fake %SystemRoot% tree containing a malicious shell32.dll, and instantiates Shell.Application. That causes the fake shell32 DLL to load. support/ieshell32.cpp is a DLL hijack helper: on load, it restores the original SystemRoot, reads MyDllPath from the environment, and loads the second DLL (ielocalserver.dll) with altered search path semantics. support/ielocalserver.cpp implements a simple HTTP server bound to 127.0.0.1:5555 that serves the staged vbscript_godmode.html file whose path is passed via the stage2file environment variable. After staging, the first HTML redirects the browser to http://localhost:5555/vbscript_godmode.html. The second-stage HTML repeats the VBScript memory corruption technique to disable safety restrictions and then directly executes cmd via Shell.Application.ShellExecute. Overall, the repository demonstrates browser-based remote code execution in IE11 plus a localhost/Protected Mode bypass chain using staged DLL loading and a local HTTP server. It is a real exploit PoC, not merely a detector, and includes a basic but functional payload.

This repository contains a single Metasploit module (ms16_051_vbscript.rb) that exploits CVE-2016-0189, a memory corruption vulnerability in the VBScript engine of Internet Explorer 11 on Windows. The exploit is delivered via a malicious HTTP server (using Metasploit's HttpServer mixin), which serves specially crafted HTML and VBScript to the victim's browser. The exploit leverages the vulnerability to achieve arbitrary code execution, allowing the attacker to deliver and execute a payload (such as a reverse shell) on the victim's system. The module supports automatic targeting and is weaponized, allowing the attacker to easily configure and deliver custom payloads. The exploit interacts with temporary file paths on the victim and delivers DLLs and executables as part of the exploitation process. The main attack vector is a browser-based drive-by attack, requiring the victim to visit the attacker's server with a vulnerable version of Internet Explorer.

This repository is a proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11 on Windows 10. The exploit consists of two main HTML files (vbscript_bypass_pm.html and vbscript_godmode.html) that use a combination of VBScript and JavaScript to trigger the vulnerability, perform heap spraying, and manipulate memory structures to achieve arbitrary code execution. The exploit downloads and loads two malicious DLLs (ieshell32.dll and ielocalserver.dll), which are provided as C++ source files in the support directory. The ieshell32.dll is used to manipulate environment variables and load further payloads, while ielocalserver.dll sets up a local HTTP server to serve the second stage of the exploit. The final payload launches a command shell (cmd.exe) on the victim's machine. The exploit bypasses IE's Protected Mode, escalating privileges from low to medium integrity. The repository is structured with clear separation between exploit scripts and supporting DLLs, and includes a README with usage instructions. The attack vector is browser-based, requiring the victim to visit a malicious web page with IE11. Several fingerprintable endpoints are present, including hardcoded HTTP URLs and file paths used for payload delivery and execution.

This repository is a proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11 on Windows 10. The exploit consists of two main HTML files (vbscript_bypass_pm.html and vbscript_godmode.html) that use a combination of VBScript and JavaScript to trigger a use-after-free vulnerability, gain code execution, and bypass IE's Protected Mode. The exploit downloads and loads two malicious DLLs (ieshell32.dll and ielocalserver.dll), which are provided as C++ source files in the support directory. The DLLs are used to manipulate environment variables and serve the second stage of the exploit via a local HTTP server. The final payload is the execution of cmd.exe on the victim's machine, demonstrating arbitrary code execution. The exploit requires the victim to browse to the malicious HTML file using IE11, and the attacker must serve the exploit files and DLLs via a web server. The repository is well-structured, with clear separation between exploit scripts and supporting DLL code.