VBScript was such an underrated way to write exploits for IE users. You could have programs run that could make web requests with cookies and process page data.

VBScript was such an underrated way to write exploits for IE users. You could have programs run that could make web requests with cookies and process page data. When I did this pen test back in the day I found forum software that had HTML enabled in the signature field. I wanted to show that you could turn something as simple as XSS into really high-level access. So I ended up writing a program that did this: Payload: change a users signature to the program and hide the code on the edit page Vectors: - VScript - submit a request with the users cookies on IE (also defeats client-side CSRF tokens) - Phispher - use javascript to show a phisphing page for the login screen as the signature code runs (works cross-browser but requires interaction.) - PHP - collect forum logins and send requests to update signatures with the program Results: I ended up spreading to most signatures in the forum, undetected. Ended up gaining access to all the forum admin users. From there is was easy to get a shell on the forum because there were theme uploads via the admin page. Called a reverse shell via perl -> nc with the www-data user and then privilege escalation with a local exploit to get root. ... but VBScript was still pivotal to spreading the code because IE was very wide-spread back then (and very, very vulnerable.) Good times / 10.