VBScript was such an underrated way to write exploits for IE users. You could have programs run that could make web requests with cookies and process page data. When I did this pen test back in the day I found forum software that had HTML enabled in the signature field. I wanted to show that you could turn something as simple as XSS into really high-level access. So I ended up writing a program that did this:

Payload: change a users signature to the program and hide the code on the edit page

Vectors:

- VScript - submit a request with the users cookies on IE (also defeats client-side CSRF tokens)

- Phispher - use javascript to show a phisphing page for the login screen as the signature code runs (works cross-browser but requires interaction.)

- PHP - collect forum logins and send requests to update signatures with the program

Results: I ended up spreading to most signatures in the forum, undetected. Ended up gaining access to all the forum admin users. From there is was easy to get a shell on the forum because there were theme uploads via the admin page. Called a reverse shell via perl -> nc with the www-data user and then privilege escalation with a local exploit to get root.

... but VBScript was still pivotal to spreading the code because IE was very wide-spread back then (and very, very vulnerable.) Good times / 10.